Question 1

What is Predax?

Accepted Answer

Predax checks IP addresses and tells you whether they belong to a VPN, proxy, Tor network, or known threat source — and gives each IP a risk score from 0 to 100. You can use this to protect your website, block fraud, stop bot signups, and prevent abuse. It works as an API (for developers) or as a WordPress/WooCommerce plugin (no coding required).

Question 2

Do I need to be a developer to use Predax?

Accepted Answer

No. If you run a WordPress or WooCommerce site, you can install our free plugin and be protected in minutes — no coding required. Just install the plugin, paste your API key, and it starts working. Developers can also use our API directly to integrate IP intelligence into any application.

Question 3

What is an IP address and why does it matter?

Accepted Answer

Every device that connects to the internet is assigned an IP address — a unique number like 185.220.101.1. This tells us roughly where a connection is coming from and what kind of network it's on. Fraudsters, bots, and hackers often use VPNs or proxies to hide their real location. Predax identifies these and flags them so you can decide whether to allow or block them.

Question 4

What is a VPN, proxy, or Tor and why should I care?

Accepted Answer

These are tools that hide a user's real identity and location online: • VPN — routes traffic through another server to mask the real IP. Used by privacy-conscious users, but also heavily used by fraudsters. • Proxy — similar to a VPN but typically cheaper and more commonly used for bots and scraping. • Tor — anonymisation network with very high fraud association. These aren't always bad — some legitimate users use VPNs for privacy. Predax gives you the information to make the right call for your business.

Question 5

What is a risk score?

Accepted Answer

Every IP gets a score from 0 (completely clean) to 100 (high threat). Predax combines dozens of signals — VPN/proxy detection, Tor usage, ASN reputation, threat feed matches, and more — into a single number. You can set thresholds: for example, block anything above 70 and flag anything above 40 for review. This gives you fine-grained control without having to understand all the underlying signals.

Question 6

How can I test the API without signing up?

Accepted Answer

You don't need an account to try Predax: • Dashboard IP lookup: the homepage has a public demo — paste any IP address and see the full classification instantly, no signup required. • Interactive docs: browse our documentation for API examples you can copy and run. • Check any IP directly: append an IP to our domain — e.g. predax.io/8.8.8.8 — to see a full shareable IP report with risk score, threat flags, network, and location. When you're ready to integrate, register for a free account and you'll get 5,000 requests per month at no cost — no credit card required.

Question 7

How do I get started?

Accepted Answer

Without coding (WordPress/WooCommerce): 1. Create a free account 2. Install the free plugin — for WordPress, search “Predax Security” in WordPress Admin → Plugins → Add New, or download it from your dashboard 3. Paste your API key and save With the API: 1. Create a free account 2. Copy your API key from the dashboard 3. Make your first request: curl -H "X-API-Key: YOUR_KEY" https://predax.io/api/v1/check/ip -d '{"ip":"8.8.8.8"}'

Question 8

What does the WordPress security plugin do?

Accepted Answer

The Predax Security plugin for WordPress protects your site at multiple points: • Login protection — blocks high-risk IPs from logging in, stops brute force attacks • Registration protection — blocks bot signups and fake account creation • Comment protection — stops spam comments from proxies and bots • Visitor protection — checks every page visit against the threat database • WAF (Web Application Firewall) — blocks SQL injection, XSS, and other attack patterns regardless of IP reputation • Geo-blocking — restrict access by country or region All of this works automatically once the plugin is configured. You don't need to manage IP lists manually.

Question 9

What does the WooCommerce Fraud Guard plugin do?

Accepted Answer

The Predax Fraud Guard plugin checks every checkout against the Predax threat database. When a customer places an order, their IP is scored in real time. You can configure the plugin to: • Tag high-risk orders with a warning label for manual review • Block high-risk checkouts automatically before payment is processed • Block orders from specific countries or regions • Block checkouts from VPNs, proxies, or Tor users This reduces chargebacks and fraud losses without you having to manually review every order.

Question 10

Will the plugin block real customers by mistake?

Accepted Answer

Predax is tuned for low false positives. The default block threshold of 70 means only high-confidence threats are blocked — most legitimate customers score below 30. A few things to be aware of: • Some customers use VPNs for privacy — you can choose to allow these if you're worried about blocking them • Corporate networks sometimes use proxy servers — your B2B customers are unlikely to be affected • The plugin never blocks logged-in WordPress admins or editors regardless of their IP If you're unsure, start by enabling Tag mode instead of Block mode — this flags suspicious orders for review without blocking anyone, so you can see what the plugin would have blocked before committing.

Question 11

How do I install the WordPress plugin?

Accepted Answer

1. In WordPress Admin, go to Plugins → Add New and search for “Predax Security” — it's free on the WordPress.org directory 2. Click Install Now, then Activate 3. Create a free account and copy your API key from the dashboard 4. Go to Predax Security → Settings in the sidebar 5. Paste your API key and click Test Connection 6. Configure your protection settings and save The whole process takes about 5 minutes. See the full setup guide for recommended settings.

Question 12

Does the plugin slow down my WordPress site?

Accepted Answer

No — the plugin is designed to be lightweight. Each IP is only looked up once and the result is cached for 12 hours. Returning visitors within that window don't trigger a new API call, so there's no measurable impact on page load times. The WAF pattern matching runs entirely locally within PHP with no external calls.

Question 13

How does the plugin update itself?

Accepted Answer

Both plugins update automatically through WordPress's built-in update system. When we release a new version, you'll see the standard update notification in WordPress Admin → Updates — just like any other plugin. Click update, it downloads and installs automatically. You don't need to re-download or re-install anything manually.

Question 14

What is a Test IP Override and when should I use it?

Accepted Answer

The Test IP Override (found in Settings → Developer) lets you simulate what the plugin would do for any IP address, without affecting real visitors. For example, entering 185.220.101.1 (a high-risk Tor-adjacent IP) lets you confirm the block page appears correctly. Use it to verify your settings before going live — and always clear it afterwards. A red warning banner appears across all admin pages while a test IP is active so you don't forget.

Question 15

How do I get an API key?

Accepted Answer

Create an account, verify your email, and generate an API key from the dashboard. API keys are prefixed with prdx_live_ and should be treated like passwords — don't share them or commit them to public code repositories. You can create multiple keys per account to separate environments or applications.

Question 16

I lost my API key — can I recover it?

Accepted Answer

For security reasons, API keys are only shown once at the time of creation. If you've lost a key, you'll need to revoke it and create a new one. Go to Dashboard → API Keys, click Revoke on the old key, then Create new key. Update the new key in your plugin settings or application.

Question 17

Can I use the same API key for multiple websites?

Accepted Answer

Yes, but we recommend creating a separate key for each site. This way you can see usage per site in your dashboard, and if a key is compromised on one site you can revoke it without affecting the others. Keys are free to create — there's no limit on how many you can have.

Question 18

What does "requests per second" mean?

Accepted Answer

Every time something checks an IP — a visitor landing on your site, a checkout being scored, a login attempt — that's one request to Predax. Requests per second is simply how many of those checks your plan allows in a single second. For example, 2 requests/sec means up to two IP checks every second. Most websites and stores never come close to their per-second limit — it only matters during sudden bursts of traffic, like a flash sale, a bot attack, or a viral moment. If you do briefly go over, the extra requests are turned away for a moment and retried, rather than slowing everyone down. Busier sites pick a higher plan, which allows more requests per second.

Question 19

How do rate limits and quotas work?

Accepted Answer

Each plan has three limits enforced independently: • Per-second: HTTP 429 if exceeded — applies to bursts of traffic • Daily: HTTP 402 when reached — resets at 00:00 UTC • Monthly: HTTP 402 when reached — resets on the 1st of the month Response headers always show your remaining quota and reset times so you can monitor usage in real time.

Question 20

How many API calls does the WordPress plugin use?

Accepted Answer

The plugin uses one API call per unique IP address per 12 hours. After the first check, the result is cached and no further API calls are made for that IP until the cache expires. This means a site with 500 unique visitors per day uses approximately 500 API calls per day — well within the Hobby plan's 2,000/day limit.

Question 21

How do daily and monthly quotas interact?

Accepted Answer

Each request counts toward both your daily and monthly quota. You'll hit whichever limit comes first. For example, the Free plan has 5,000 requests/month and 1,000 requests/day. If you use all 1,000 on day 1, you must wait until day 2 to make more requests even though you have monthly quota remaining. This prevents a single traffic spike from consuming your whole month's allowance.

Question 22

What plans do you offer and how much do they cost?

Accepted Answer

Predax has four tiers, built around how many IP lookups you need per day: • Free — 5,000 requests/month (1,000/day). No credit card. Perfect for a small WordPress site, testing, or personal projects. • Hobby — 2,000/day. Covers a medium-traffic site or an app in early stages. • Starter — 5,000/day. Growing WooCommerce store or a SaaS with moderate signup volume. • Pro — 17,000/day. High-traffic sites, multi-site setups, or production APIs. All paid plans include the full feature set — no artificial feature gates on WAF, ML scoring, Tor/VPN detection, community threat network, or WordPress/WooCommerce plugins. You pay for volume, not capability. Visit our pricing page for current amounts and to compare plans side-by-side. Upgrades take effect immediately and downgrades apply from the next billing cycle.

Question 23

Is there a free plan?

Accepted Answer

Yes — the Free plan gives you 5,000 requests per month (1,000 per day) with no credit card required. This is enough for a small WordPress site or for testing the API. When you're ready to scale, paid plans start from just a few pounds/dollars per month.

Question 24

What happens if I exceed my plan limits?

Accepted Answer

The API returns HTTP 402 when your daily or monthly quota is exhausted. The WordPress plugin is designed to fail open in this case — meaning visitors are allowed through rather than your entire site going down. You'll see a notification in your dashboard when you're approaching your limit. Upgrading your plan takes effect immediately.

Question 25

Can I upgrade or downgrade my plan?

Accepted Answer

Yes. You can change plans at any time from Dashboard → Billing. Upgrades take effect immediately. Downgrades apply from the start of your next billing cycle.

Question 26

Do you store the IP addresses I look up?

Accepted Answer

We log API requests for usage tracking and billing purposes, which includes the IP addresses you look up. Logs are retained per our Privacy Policy and automatically deleted after the retention period. We don't sell or share your lookup data with third parties. If you have specific data handling requirements, see our Data Processing Agreement.

Question 27

Is Predax GDPR compliant?

Accepted Answer

Yes. We're based in the UK/EU and built with GDPR compliance in mind. We offer a Data Processing Agreement (DPA) for customers who require it. IP addresses are processed as pseudonymous data under legitimate interest for fraud prevention purposes. See our Privacy Policy for full details.

Question 28

Can I rotate or revoke API keys?

Accepted Answer

Yes. You can create, revoke, and rotate keys at any time from the dashboard. Revoked keys stop working immediately. We recommend using separate keys for production, staging, and development, and rotating keys every 90 days as a security best practice.

Question 29

What data does the API return for each IP?

Accepted Answer

Every IP lookup returns a rich JSON payload: • Risk score (0–100) and risk level (minimal / low / medium / high / critical) • Classification flags: is_vpn, is_proxy, is_tor, is_datacenter, is_hosting, is_crawler • Network info: ASN number + organisation name, CIDR block, PTR record, network type • Location: country code, region, city, latitude, longitude, timezone • Threat signals: specific flags matched, reasons, confidence scores, community block count (how many other sites have reported this IP) • VPN provider name when it can be identified (NordVPN, Mullvad, ExpressVPN, ProtonVPN, etc.) • Bot verification: for search engine crawlers, a boolean confirming the IP matches the official crawler DNS (catches spoofed Googlebot / Bingbot user-agents) See the API reference for the full response schema and example payloads.

Question 30

What is the difference between IPv4 and IPv6, and does Predax handle both?

Accepted Answer

IPv4 addresses are 32 bits long (185.220.101.1 format, ~4.3 billion possible addresses). IPv6 is 128 bits (2a02:4780::1 format, ~340 undecillion addresses). Most modern networks run both — a visitor's browser might reach your site over IPv4 one moment and IPv6 the next. Predax treats both the same: same endpoints, same response shape, same risk scoring pipeline, same WAF. Pass either format to the API and the classification works identically. The WordPress plugin also handles both automatically — you don't need to configure anything special for IPv6 traffic. In practice about 30–40% of real-world traffic is IPv6, so full IPv6 support is a core requirement, not an edge case.

Question 31

Do bulk lookups support IPv6 and CIDR ranges?

Accepted Answer

IPv6: yes, fully. You can mix IPv4 and IPv6 addresses in the same bulk request — both get classified identically. CIDR ranges: the bulk endpoint accepts a list of individual IPs (up to 100 per sync request, or unlimited via async bulk jobs), not CIDR blocks directly. If you want to check every IP in a range, expand the CIDR on your side first. For 10.0.0.0/24 that's 256 IPs — submit them as an array. For IPv6 blocks, watch out: a /64 contains 18 quintillion addresses, so you almost certainly want to check only the specific IPs you've actually seen rather than enumerating the whole range. For async bulk jobs, see the bulk jobs API reference. Jobs run in the background and you poll for results, so even very large lookup sets work without timing out.

Question 32

What is the API latency?

Accepted Answer

Cached responses return in approximately 5ms. Uncached lookups (first time we've seen an IP) typically take 20–50ms. The API is fast enough to run inline with login requests and checkout flows without any noticeable impact on user experience.

Question 33

What programming languages are supported?

Accepted Answer

The API is a standard HTTPS + JSON REST API that works with any language. We provide official SDKs for Python, Node.js/TypeScript, and PHP. For other languages, it's a single HTTP POST request — if your language can make an HTTPS call, it can use Predax.

Question 34

How accurate is VPN and proxy detection?

Accepted Answer

Detection rates by type: • Tor exit nodes: ~99% (updated hourly from the official Tor directory) • Commercial VPNs: ~95% (NordVPN, Mullvad, ExpressVPN, ProtonVPN, etc.) • Proxies: ~90% • Datacenter/hosting IPs: ~98% No detection system is perfect — residential proxies are the hardest to catch because they use real ISP IPs. We continuously update our feeds as new VPN servers are deployed.

Frequently Asked Questions

Getting Started

WordPress & WooCommerce Plugins

Accounts & API Keys

Rate Limits & Usage

Billing & Plans

Security & Privacy

Technical