Rupt: Fraud and abuse prevention

Rupt is a fraud and abuse prevention platform. It identifies the device, browser, and person behind every account on your site, works out how much you can trust them, and challenges the ones you can’t.

WordPress hands you accounts and nothing else. It cannot tell a paying member from a bot, a stolen login from the real owner, or one password quietly making the rounds in a group chat. This plugin closes that gap.

What it protects

• Onboarding. Fake signups, disposable and invalid emails, bots, multi-accounting, and ban evasion, caught at registration.
• Login. Account takeover and credential stuffing, caught when a stranger signs into a real member’s account.
• Content. Account sharing, paywall bypass, and scraping, caught on every page view.
• Payments. Card testing, risky transactions, and coupon abuse, on any checkout action you choose to evaluate.

How it works

The plugin reports what happens on your site. Your policies, which live in the Rupt dashboard rather than here, decide what to do about it. A policy has a trigger (the event it runs on) and a verdict (allow, challenge, or deny).

Rupt scores every event against the device, browser, IP, email, phone, and behavior behind it. When a policy fires, Rupt runs a challenge (SMS, email, or biometric) and signs the device out if it fails.

What the plugin sends

• access on every front-end page view by a signed-in user.
• login on the first page a user loads after signing in.
• signup on the first page a newly registered user loads.
• Any custom action you queue from PHP or fire from JavaScript.

Custom actions

Queue an evaluation from PHP and it runs on the next page the user loads:

rupt_evaluate('purchase', ['metadata' => ['order_id' => $order_id]]);

Or run one immediately from JavaScript:

window.rupt.evaluate('purchase', { metadata: { order_id: '1234' } });

Filters

• rupt_should_run: return false to skip Rupt on a request.
• rupt_load_for_visitors: return true to load the script for signed-out visitors.
• rupt_user_metadata: change the metadata attached to the signed-in user.
• rupt_loader_config: change the whole loader config before it is printed.

External services

This plugin sends data to Rupt, a third-party fraud and abuse prevention service, so that Rupt can identify the devices and people using each account.

The plugin loads a script from cdn.rupt.dev on your front end. That script sends the signed-in user’s WordPress user ID, email address, display name, roles, optional phone number, page URL, and device and browser characteristics to the Rupt API at ap3.rupt.dev (or the API domain you set in Settings → Rupt) on page views, logins, and registrations.

Service provided by Rupt: terms of service, privacy policy.