Frequently Asked Questions

Predax checks IP addresses and tells you whether they belong to a VPN, proxy, Tor network, or known threat source — and gives each IP a risk score from 0 to 100. You can use this to protect your website, block fraud, stop bot signups, and prevent abuse. It works as an API (for developers) or as a WordPress/WooCommerce plugin (no coding required).

No. If you run a WordPress or WooCommerce site, you can install our free plugin and be protected in minutes — no coding required. Just install the plugin, paste your API key, and it starts working. Developers can also use our API directly to integrate IP intelligence into any application.

Every device that connects to the internet is assigned an IP address — a unique number like 185.220.101.1. This tells us roughly where a connection is coming from and what kind of network it's on. Fraudsters, bots, and hackers often use VPNs or proxies to hide their real location. Predax identifies these and flags them so you can decide whether to allow or block them.

These are tools that hide a user's real identity and location online:

• VPN — routes traffic through another server to mask the real IP. Used by privacy-conscious users, but also heavily used by fraudsters.
• Proxy — similar to a VPN but typically cheaper and more commonly used for bots and scraping.
• Tor — anonymisation network with very high fraud association.

These aren't always bad — some legitimate users use VPNs for privacy. Predax gives you the information to make the right call for your business.

Every IP gets a score from 0 (completely clean) to 100 (high threat). Predax combines dozens of signals — VPN/proxy detection, Tor usage, ASN reputation, threat feed matches, and more — into a single number. You can set thresholds: for example, block anything above 70 and flag anything above 40 for review. This gives you fine-grained control without having to understand all the underlying signals.

You don't need an account to try Predax:

• Dashboard IP lookup: the homepage has a public demo — paste any IP address and see the full classification instantly, no signup required.
• Interactive docs: browse our documentation for API examples you can copy and run.
• Check any IP directly: append an IP to our domain — e.g. predax.io/8.8.8.8 — to see a full shareable IP report with risk score, threat flags, network, and location.

When you're ready to integrate, register for a free account and you'll get 5,000 requests per month at no cost — no credit card required.

Without coding (WordPress/WooCommerce):
1. Create a free account
2. Install the free plugin — for WordPress, search “Predax Security” in WordPress Admin → Plugins → Add New, or download it from your dashboard
3. Paste your API key and save

With the API:
1. Create a free account
2. Copy your API key from the dashboard
3. Make your first request: curl -H "X-API-Key: YOUR_KEY" https://predax.io/api/v1/check/ip -d '{"ip":"8.8.8.8"}'

The Predax Security plugin for WordPress protects your site at multiple points:

• Login protection — blocks high-risk IPs from logging in, stops brute force attacks
• Registration protection — blocks bot signups and fake account creation
• Comment protection — stops spam comments from proxies and bots
• Visitor protection — checks every page visit against the threat database
• WAF (Web Application Firewall) — blocks SQL injection, XSS, and other attack patterns regardless of IP reputation
• Geo-blocking — restrict access by country or region

All of this works automatically once the plugin is configured. You don't need to manage IP lists manually.

The Predax Fraud Guard plugin checks every checkout against the Predax threat database. When a customer places an order, their IP is scored in real time. You can configure the plugin to:

• Tag high-risk orders with a warning label for manual review
• Block high-risk checkouts automatically before payment is processed
• Block orders from specific countries or regions
• Block checkouts from VPNs, proxies, or Tor users

This reduces chargebacks and fraud losses without you having to manually review every order.

Predax is tuned for low false positives. The default block threshold of 70 means only high-confidence threats are blocked — most legitimate customers score below 30. A few things to be aware of:

• Some customers use VPNs for privacy — you can choose to allow these if you're worried about blocking them
• Corporate networks sometimes use proxy servers — your B2B customers are unlikely to be affected
• The plugin never blocks logged-in WordPress admins or editors regardless of their IP

If you're unsure, start by enabling Tag mode instead of Block mode — this flags suspicious orders for review without blocking anyone, so you can see what the plugin would have blocked before committing.

1. In WordPress Admin, go to Plugins → Add New and search for “Predax Security” — it's free on the WordPress.org directory
2. Click Install Now, then Activate
3. Create a free account and copy your API key from the dashboard
4. Go to Predax Security → Settings in the sidebar
5. Paste your API key and click Test Connection
6. Configure your protection settings and save

The whole process takes about 5 minutes. See the full setup guide for recommended settings.

No — the plugin is designed to be lightweight. Each IP is only looked up once and the result is cached for 5 minutes, and concurrent requests for the same visitor are coalesced into a single lookup. Returning visitors within that window don't trigger a new API call, so there's no measurable impact on page load times. The WAF pattern matching runs entirely locally within PHP with no external calls.

Both plugins update automatically through WordPress's built-in update system. When we release a new version, you'll see the standard update notification in WordPress Admin → Updates — just like any other plugin. Click update, it downloads and installs automatically. You don't need to re-download or re-install anything manually.

The Test IP Override (found in Settings → Developer) lets you simulate what the plugin would do for any IP address, without affecting real visitors. For example, entering 185.220.101.1 (a high-risk Tor-adjacent IP) lets you confirm the block page appears correctly. Use it to verify your settings before going live — and always clear it afterwards. A red warning banner appears across all admin pages while a test IP is active so you don't forget.

Create an account, verify your email, and generate an API key from the dashboard. API keys are prefixed with prdx_live_ and should be treated like passwords — don't share them or commit them to public code repositories. You can create multiple keys per account to separate environments or applications.

For security reasons, API keys are only shown once at the time of creation. If you've lost a key, you'll need to revoke it and create a new one. Go to Dashboard → API Keys, click Revoke on the old key, then Create new key. Update the new key in your plugin settings or application.

Yes, but we recommend creating a separate key for each site. This way you can see usage per site in your dashboard, and if a key is compromised on one site you can revoke it without affecting the others. Keys are free to create — there's no limit on how many you can have.

Every time something checks an IP — a visitor landing on your site, a checkout being scored, a login attempt — that's one request to Predax. Requests per second is simply how many of those checks your plan allows in a single second. For example, 2 requests/sec means up to two IP checks every second.

Most websites and stores never come close to their per-second limit — it only matters during sudden bursts of traffic, like a flash sale, a bot attack, or a viral moment. If you do briefly go over, the extra requests are turned away for a moment and retried, rather than slowing everyone down. Busier sites pick a higher plan, which allows more requests per second.

Each plan has three limits enforced independently:
• Per-second: HTTP 429 if exceeded — applies to bursts of traffic
• Daily: HTTP 402 when reached — resets at 00:00 UTC
• Monthly: HTTP 402 when reached — resets on the 1st of the month

Response headers always show your remaining quota and reset times so you can monitor usage in real time.

The plugin uses one API call per unique IP address per 12 hours. After the first check, the result is cached and no further API calls are made for that IP until the cache expires. This means a site with 500 unique visitors per day uses approximately 500 API calls per day — well within the Hobby plan's 2,000/day limit.

Each request counts toward both your daily and monthly quota. You'll hit whichever limit comes first. For example, the Free plan has 5,000 requests/month and 1,000 requests/day. If you use all 1,000 on day 1, you must wait until day 2 to make more requests even though you have monthly quota remaining. This prevents a single traffic spike from consuming your whole month's allowance.

Predax has four tiers, built around how many IP lookups you need per day:

• Free — 5,000 requests/month (1,000/day). No credit card. Perfect for a small WordPress site, testing, or personal projects.
• Hobby — 2,000/day. Covers a medium-traffic site or an app in early stages.
• Starter — 5,000/day. Growing WooCommerce store or a SaaS with moderate signup volume.
• Pro — 15,000/day. High-traffic sites, multi-site setups, or production APIs.

All paid plans include the full feature set — no artificial feature gates on WAF, ML scoring, Tor/VPN detection, community threat network, or WordPress/WooCommerce plugins. You pay for volume, not capability. Visit our pricing page for current amounts and to compare plans side-by-side. Upgrades take effect immediately and downgrades apply from the next billing cycle.

Yes — the Free plan gives you 5,000 requests per month (1,000 per day) with no credit card required. This is enough for a small WordPress site or for testing the API. When you're ready to scale, paid plans start from just a few pounds/dollars per month.

The API returns HTTP 402 when your daily or monthly quota is exhausted. The WordPress plugin is designed to fail open in this case — meaning visitors are allowed through rather than your entire site going down. You'll see a notification in your dashboard when you're approaching your limit. Upgrading your plan takes effect immediately.

Yes. You can change plans at any time from Dashboard → Billing. Upgrades take effect immediately. Downgrades apply from the start of your next billing cycle.

We log API requests for usage tracking and billing purposes, which includes the IP addresses you look up. Logs are retained per our Privacy Policy and automatically deleted after the retention period. We don't sell or share your lookup data with third parties. If you have specific data handling requirements, see our Data Processing Agreement.

Yes. We're based in the UK/EU and built with GDPR compliance in mind. We offer a Data Processing Agreement (DPA) for customers who require it. IP addresses are processed as pseudonymous data under legitimate interest for fraud prevention purposes. See our Privacy Policy for full details.

Yes. You can create, revoke, and rotate keys at any time from the dashboard. Revoked keys stop working immediately. We recommend using separate keys for production, staging, and development, and rotating keys every 90 days as a security best practice.

Every IP lookup returns a rich JSON payload:

• Risk score (0–100) and risk level (minimal / low / medium / high / critical)
• Classification flags: is_vpn, is_proxy, is_tor, is_datacenter, is_hosting, is_crawler
• Network info: ASN number + organisation name, CIDR block, PTR record, network type
• Location: country code, region, city, latitude, longitude, timezone
• Threat signals: specific flags matched, reasons, confidence scores, community block count (how many other sites have reported this IP)
• VPN provider name when it can be identified (NordVPN, Mullvad, ExpressVPN, ProtonVPN, etc.)
• Bot verification: for search engine crawlers, a boolean confirming the IP matches the official crawler DNS (catches spoofed Googlebot / Bingbot user-agents)

See the API reference for the full response schema and example payloads.

IPv4 addresses are 32 bits long (185.220.101.1 format, ~4.3 billion possible addresses). IPv6 is 128 bits (2a02:4780::1 format, ~340 undecillion addresses). Most modern networks run both — a visitor's browser might reach your site over IPv4 one moment and IPv6 the next.

Predax treats both the same: same endpoints, same response shape, same risk scoring pipeline, same WAF. Pass either format to the API and the classification works identically. The WordPress plugin also handles both automatically — you don't need to configure anything special for IPv6 traffic. In practice about 30–40% of real-world traffic is IPv6, so full IPv6 support is a core requirement, not an edge case.

IPv6: yes, fully. You can mix IPv4 and IPv6 addresses in the same bulk request — both get classified identically.

CIDR ranges: the bulk endpoint accepts a list of individual IPs (up to 100 per sync request, or unlimited via async bulk jobs), not CIDR blocks directly. If you want to check every IP in a range, expand the CIDR on your side first. For 10.0.0.0/24 that's 256 IPs — submit them as an array. For IPv6 blocks, watch out: a /64 contains 18 quintillion addresses, so you almost certainly want to check only the specific IPs you've actually seen rather than enumerating the whole range.

For async bulk jobs, see the bulk jobs API reference. Jobs run in the background and you poll for results, so even very large lookup sets work without timing out.

Cached responses return in approximately 5ms. Uncached lookups (first time we've seen an IP) typically take 20–50ms. The API is fast enough to run inline with login requests and checkout flows without any noticeable impact on user experience.

The API is a standard HTTPS + JSON REST API that works with any language. We provide an official Python SDK, with a Node.js/TypeScript client coming shortly. For every other language, including PHP, it's a single HTTP POST request — if your language can make an HTTPS call, it can use Predax.

Detection rates by type:
• Tor exit nodes: ~99% (updated hourly from the official Tor directory)
• Commercial VPNs: ~95% (NordVPN, Mullvad, ExpressVPN, ProtonVPN, etc.)
• Proxies: ~90%
• Datacenter/hosting IPs: ~98%

No detection system is perfect — residential proxies are the hardest to catch because they use real ISP IPs. We continuously update our feeds as new VPN servers are deployed.