How to Block VPN and Data Center IP Submissions in Bricksforge Forms
Co-founder & Brand Designer
Reviewed by Onar Alili
Co-founder & Engineer
Published 9 min read
Bricksforge Pro Forms has no setting to block VPN or data center IP addresses. The fastest fix is the oopspam Anti-Spam plugin. Install it, turn on Bricksforge Forms protection, then enable Block VPNs and Block Cloud Providers in the IP Filtering tab. For a manual, network-level option, create Cloudflare custom rules that block hosting provider ASNs and Tor traffic.
Why VPN and Data Center IPs Are a Problem for Bricksforge Forms
Bricksforge is an add-on for the Bricks site builder. Its Pro Forms element can create posts, register users, call webhooks and take Stripe or Mollie payments. One bot submission can publish a junk post, create a fake account or push garbage into your CRM.
Most automated form abuse comes from two sources:
- Data centers and cloud providers. Bots run on servers at AWS, Google Cloud, DigitalOcean, Hetzner and similar hosts. Real visitors rarely fill in a contact form from a server.
- VPNs and proxies. Spammers use them to hide their location and switch IP addresses between attempts.
Pro Forms already includes reCAPTCHA v3, hCaptcha, Cloudflare Turnstile, honeypot fields and duplicate limits. These stop simple bots. None of them check where an IP address comes from. A fresh data center IP with no spam history passes straight through. Blocking by IP origin closes that gap.
Not sure where a suspicious IP comes from? Paste it into IP Reputation Check to see if it belongs to a VPN or data center.
Method 1: Block VPN and Cloud IPs with oopspam
The oopspam Anti-Spam plugin supports Bricksforge Pro Forms natively from version 1.2.87. It checks every submission on the server before Bricksforge runs any action, so a blocked entry never creates a post, user or webhook call. There is no CAPTCHA and no change to your forms.
Step 1: Install the Plugin
In WordPress, go to Plugins > Add New, search for oopspam Anti-Spam, then install and activate it. Make sure you run version 1.2.87 or later.
Step 2: Add Your API Key
Create a free oopspam account and copy your API key from the dashboard.
In WordPress, go to Settings > oopspam Anti-Spam. In the General tab, select oopspam Dashboard as the source and paste your key into My API Key.
Step 3: Activate Bricksforge Forms Protection
Scroll to the Bricksforge Forms section and check Activate Spam Protection. This covers every Pro Form on your site. If you also use the native Bricks Form element, turn on the Bricks Forms section too.
Step 4: Enable IP Filtering
Open the IP Filtering tab. You’ll see two toggles:
- Block Cloud Providers: blocks submissions from 1,500+ known cloud providers, such as AWS, Google Cloud and Azure. This is the safer, high-impact setting. Turn it on first.
- Block VPNs: blocks submissions from known VPN services. Use it with care, because some real visitors use a personal VPN for privacy.
Click Save Changes. oopspam now filters your Pro Forms automatically.
Step 5: Turn On Trust Proxy Headers (If You Use Cloudflare)
IP filtering only works if oopspam sees the visitor’s real IP address. If your site runs behind Cloudflare or another proxy, open the Misc tab and turn on Trust proxy headers. Without it, every submission appears to come from the proxy’s own network.
Step 6: Test Your Form
Connect to a VPN, or open your site from a cloud server, and submit a Pro Form. The visitor sees the spam message on the form. Set a custom message in oopspam if you want to explain the block.
Then open Form Spam Entries in WordPress. The entry should show VPN or cloud provider as the reason. If a real visitor was blocked, mark the entry as not spam. Learn more in the form entries guide.
Step 7: Add Extra Layers (Optional)
Spammers often combine tactics. Two more oopspam settings help:
- Rate Limiting: cap submissions per IP or email within a set time window.
- Country Filtering: reject submissions from countries you don’t serve. See How to block countries in Bricksforge Forms.
Method 2: Block VPN and Cloud IPs with Cloudflare
If your site runs behind Cloudflare, you can block traffic at the network edge before it reaches WordPress. You do this with custom rules that target ASNs (Autonomous System Numbers). An ASN identifies the network that owns an IP range, such as a cloud host.
How to Set It Up
- In the Cloudflare dashboard, go to Security > Security Rules.
- Click Create rule, then select Custom rules.
- Name the rule, for example “Block hosting providers on forms.”
-
Click Edit expression and add the ASNs you want to block. Example:
(ip.src.asnum in {14061 16509 14618 396982 63949 24940 16276 20473}) or (ip.src.country eq "T1")This covers DigitalOcean (14061), AWS (16509, 14618), Google Cloud (396982), Linode/Akamai (63949), Hetzner (24940), OVH (16276) and Vultr (20473). The country code T1 is Cloudflare’s label for Tor traffic.
-
To protect only your forms, scope the rule to the URL Pro Forms submit to:
/wp-json/bricksforge/v1/form_submit. Scoping to the page URL isn’t enough, because bots can post straight to this endpoint. Wrap the ASN rule in parentheses and add the path, so the path applies to every condition:((ip.src.asnum in {14061 16509 14618 396982 63949 24940 16276 20473}) or (ip.src.country eq "T1")) and http.request.uri.path eq "/wp-json/bricksforge/v1/form_submit"You can confirm the path in your browser’s developer tools: submit a test form and check the Network tab.
- Choose an action. Block stops the request. Managed Challenge filters bots while letting most humans through.
- Click Deploy.
See Cloudflare’s custom rules documentation for more options.
Limitations
- Manual upkeep. Hosting networks change. You must track and update ASNs yourself.
- No commercial VPN coverage. Most VPN providers rent space across many networks, so ASN rules miss much of that traffic.
- Rule limits. Cloudflare’s Free plan allows only five custom rules.
- False positives. Some legitimate businesses route traffic through cloud servers.
This method suits developers who have time to maintain rules. It works best alongside oopspam, not instead of it. Cloudflare cuts server load. oopspam handles submission-level checks, like message content and email reputation, that a firewall can’t see.
oopspam vs Cloudflare: Quick Comparison
| oopspam | Cloudflare | |
|---|---|---|
| Setup time | About 5 minutes | 15 to 30 minutes |
| Maintenance | Automatic | Manual ASN updates |
| VPN detection | Yes | Tor only (T1) |
| Data center blocking | Yes, 1,500+ cloud providers | Only ASNs you add |
| Checks content and email reputation | Yes | No |
| Logs with block reason | Yes, in WordPress | Cloudflare security events |
| Requires Cloudflare | No | Yes |
Balance Security with Real Visitors
- Start with Block Cloud Providers. It carries the lowest risk, because real people rarely submit forms from a server.
- Turn on Block VPNs only if spam continues. Privacy-focused visitors and remote workers may use VPNs.
- Review your logs weekly. Release any false positives and adjust your settings.
- Watch high-impact forms closely. Registration, post-creation and payment forms deserve stricter rules than a newsletter signup.
FAQ
Does Bricksforge block VPNs on its own?
No. Pro Forms has CAPTCHA, honeypot and duplicate controls, but no IP origin checks. You need a plugin such as oopspam or a firewall such as Cloudflare.
Will blocking VPNs stop real visitors?
It can. Some people use a VPN for privacy or work. Start with Block Cloud Providers, then add Block VPNs only if spam continues, and review your logs for false positives.
What’s the difference between a VPN IP and a data center IP?
A data center IP belongs to a hosting company such as AWS or DigitalOcean, where bots usually run. A VPN IP belongs to a VPN service that people use to hide their location. Many VPNs run on data center networks, so the two often overlap.
Does IP filtering work if my site uses Cloudflare?
Yes, as long as you turn on Trust proxy headers in oopspam’s Misc tab. Otherwise oopspam sees Cloudflare’s IP address instead of the visitor’s.
Does oopspam slow down my forms?
No. oopspam checks submissions on the server after the visitor clicks submit. It adds no CAPTCHA and no script to your page.
Final Thoughts
Bots that spam Bricksforge forms mostly run on cloud servers and VPNs. Blocking those sources stops a large share of fake submissions before Pro Forms creates a post, user or webhook call.
oopspam is the simplest fix: two toggles and no rule maintenance. Cloudflare adds a network-level layer for technical teams. Use one, or use both for full coverage.
Using the native Bricks Form element? See How to block VPN and data center IP submissions in Bricks Forms.
