How to Block VPN and Data Center IP Submissions in WP Booking System

By Daniella Attinella

Co-founder & Brand Designer

Reviewed by Onar Alili

Co-founder & Engineer

Published Nov 5, 2026 8 min read

WP Booking System has no setting to block VPN or data center IP addresses. The fastest fix is the oopspam Anti-Spam plugin (that’s us 👋). Install it, turn on WP Booking System protection, then enable Block Cloud Providers and, if needed, Block VPNs in the IP Filtering tab. For a manual, network-level option, create Cloudflare custom rules that block hosting provider ASNs and Tor traffic.

Why VPN and Data Center IPs Are a Problem for WP Booking System

WP Booking System takes bookings for rentals, rooms, tours and appointments. A fake booking costs real money: it can mark dates as unavailable, trigger confirmation emails to fake addresses and waste time on follow-up.

Most automated abuse comes from two sources:

• Data centers and cloud providers. Bots run on servers at AWS, Google Cloud, DigitalOcean, Hetzner and similar hosts. Real guests rarely book a holiday from a server.
• VPNs and proxies. Spammers use them to hide their location and switch IP addresses between attempts.

WP Booking System doesn’t check where a booking comes from. Blocking by IP origin closes that gap, even for a bot with a fresh IP and no spam history.

Not sure where a suspicious IP comes from? Paste it into IP Reputation Check to see if it belongs to a VPN or data center.

Method 1: Block VPN and Cloud IPs with oopspam

The oopspam Anti-Spam plugin supports WP Booking System natively. It checks every booking on the server before WP Booking System saves it. There is no CAPTCHA and no change to your forms.

Step 1: Install the Plugin

In WordPress, go to Plugins > Add New, search for oopspam Anti-Spam, then install and activate it.

Step 2: Add Your API Key

Create a free oopspam account and copy your API key. In WordPress, go to Settings > oopspam Anti-Spam. In the General tab, select oopspam Dashboard as the source and paste your key into My API Key.

Step 3: Activate WP Booking System Protection

Scroll to the WP Booking System section and check Activate Spam Protection. This covers every WP Booking System form on your site.

Step 4: Enable IP Filtering

Open the IP Filtering tab. You’ll see two toggles:

• Block Cloud Providers: blocks bookings from 1,500+ known cloud providers, such as AWS, Google Cloud and Azure. This is the safer, high-impact setting. Turn it on first.
• Block VPNs: blocks bookings from known VPN services. Use it with care. Travelers often book from a work VPN or a privacy VPN on hotel Wi-Fi.

Click Save Changes.

Step 5: Turn On Trust Proxy Headers (If You Use Cloudflare or Another Proxy)

IP filtering only works if oopspam sees the guest’s real IP address. If your site runs behind Cloudflare or another proxy, open the Misc tab and turn on Trust proxy headers.

Step 6: Test Your Form

Connect to a VPN and submit a booking. The guest sees the spam message on the form. Set a custom message in the WP Booking System Spam Message field if you want to explain the block, for example “Please turn off your VPN and try again, or email us to book.”

Then open Form Spam Entries in WordPress. The booking should show VPN or cloud provider as the reason. If a real guest was blocked, mark the entry as not spam. Learn more in the form entries guide.

Step 7: Add Extra Layers (Optional)

• Rate limiting: cap bookings per IP or email per hour.
• Country filtering: reject bookings from countries you don’t serve. See How to block countries in WP Booking System.

Method 2: Block VPN and Cloud IPs with Cloudflare

If your site runs behind Cloudflare, you can block traffic at the network edge with custom rules that target ASNs (Autonomous System Numbers). An ASN identifies the network that owns an IP range, such as a cloud host.

1. In the Cloudflare dashboard, go to Security > Security Rules.
2. Click Create rule, then select Custom rules.
3. Name the rule, for example “Block hosting providers.”

4. Click Edit expression and add the ASNs you want to block:

    (ip.src.asnum in {14061 16509 14618 396982 63949 24940 16276 20473})
    or (ip.src.country eq "T1")
   

   This covers DigitalOcean (14061), AWS (16509, 14618), Google Cloud (396982), Linode/Akamai (63949), Hetzner (24940), OVH (16276) and Vultr (20473). T1 is Cloudflare’s label for Tor traffic.

5. Choose Block, then click Deploy.

This rule applies to your whole site. WP Booking System sends bookings to WordPress’s shared AJAX endpoint, /wp-admin/admin-ajax.php, with the action wpbs_submit_form. To scope the rule to that endpoint, wrap the conditions in parentheses and add the path:

((ip.src.asnum in {14061 16509 14618 396982 63949 24940 16276 20473})
or (ip.src.country eq "T1"))
and http.request.uri.path eq "/wp-admin/admin-ajax.php"

Three things to know:

• Other requests use the same endpoint. WP Booking System also uses it for price calculation, date checks and coupons, and other plugins use it too. The rule blocks all of them from those networks. That’s rarely a problem for hosting providers, but test your booking flow after deploying.
• Cloudflare can’t target the booking action alone. The action name travels in the request body, which custom rules don’t read.
• Use Block, not Managed Challenge. AJAX requests can’t display a challenge page, so a challenged booking simply fails without a clear message.

Limitations

• Manual upkeep. Hosting networks change, so you must update ASNs yourself.
• No commercial VPN coverage. Most VPN providers rent space across many networks.
• Rule limits. Cloudflare’s Free plan allows only five custom rules.
• False positives. Some companies route staff traffic through cloud servers, so a business traveler may be blocked.

Cloudflare works best alongside oopspam, not instead of it. See Cloudflare’s custom rules documentation for more options.

oopspam vs Cloudflare: Quick Comparison

FAQ

Does WP Booking System block VPNs on its own?

No. WP Booking System doesn’t check whether a booking comes from a VPN or data center. Use oopspam or Cloudflare for that.

Will blocking VPNs stop real guests?

It can. Travelers often use a VPN on public Wi-Fi or for work. Start with Block Cloud Providers, add Block VPNs only if spam continues, and review your logs for false positives.

Does IP filtering work if my site uses Cloudflare?

Yes, as long as you turn on Trust proxy headers in oopspam’s Misc tab. Otherwise oopspam sees Cloudflare’s IP address instead of the guest’s.

Final Thoughts

Bots that send fake bookings mostly run on cloud servers and VPNs. oopspam blocks both with two toggles and no rule upkeep. Cloudflare adds a network-level layer for technical teams. Use one, or both for full coverage.

Related guides

• 6 Ways to Protect Your WP Booking System from Spam
• How to Block Countries in WP Booking System
• How to Limit Form Submissions in WP Booking System