IP Blocking & Limits

Keeping Your Spin Wheel Fair

Gamification is fun, but some visitors will try to game the system. If you offer a high-value prize, a determined user may reload the page hoping to spin again and again. The Security tab under Ultimate Spin Wheel → Settings is your referee. It lets you block problem visitors by IP address or device, and stop leads that use throwaway email addresses.

This guide covers exactly what the free plugin can do — manual IP blocking, device-ID blocking, and disposable-email blocking — and clearly marks the per-visitor spin limits that require Ultimate Spin Wheel Pro.

What the Security Tab Controls (Free)

• Manual IP blocking: Add specific IP addresses to a blocklist.
• Device-ID blocking: Block a persistent device fingerprint so a user stays blocked even if they switch IPs.
• Disposable-email blocking: Reject leads using temporary email providers such as Mailinator or 10MinuteMail.

There is no whitelist and no per-country blocking in the plugin, and IP anonymization is not a setting — the sections below explain how each real control behaves.

1. Blocking IP Addresses

If you notice abusive behaviour from a particular source, you can ban it from the wheel.

1. Go to Ultimate Spin Wheel → Settings → Security.
2. In Manually Block IP, type a single IPv4 or IPv6 address and click Block IP.
3. The address appears in the Blocked IP Addresses list. Save your settings to apply it.

Behaviour: A blocked IP does not just fail to win — the wheel refuses to serve at all. On the server, the spin request stops immediately when the visitor’s IP is on the blocklist, so a blocked user cannot see or interact with the wheel.

Note: You add one address at a time. The field validates a single IP — it does not accept CIDR ranges, wildcards, or a pasted multi-line list. To block several addresses, add each one individually.

2. Blocking Devices (Anti-VPN Layer)

IP addresses are easy to change with a VPN, so the plugin adds a second layer. Each visitor is given a unique Device ID stored in a persistent browser cookie. When you block a device, that visitor stays blocked even if their IP changes.

• Blocked device IDs are listed under Blocked Device IDs in the Security tab, alongside the blocked-IP list.
• Like a blocked IP, a blocked device is stopped server-side before the wheel is served.
• Device IDs are added to the blocklist from your Leads dashboard when you block an individual lead — see the Manual Blocking guide.

3. Disposable-Email Blocking

Prize hunters often sign up with throwaway inboxes so they can enter repeatedly. The Security tab includes a free Disposable Email Blocking toggle that checks each lead’s email domain against a bundled list of 100+ known disposable providers (Mailinator, Guerrilla Mail, 10MinuteMail, and similar).

1. Enable Disposable Email Blocking in the Security tab.
2. Optionally enter a custom message to show visitors who try to spin with a disposable address.
3. Save. When someone submits a matching domain, the spin is rejected and your message is shown.

Per-Visitor Spin Limits (Pro)

The free plugin does not impose a “one spin per day” style limit. Limiting how often a single visitor can spin is handled by the Pro Identity Check feature:

• Identity check (Pro): Recognise returning visitors by email, phone, or both.
• Cooldown (Pro): Allow one spin, then block that identity for a set number of hours or days — or forever (“never” lets them play again). The “Come back later” countdown is enforced on the server, so clearing cookies does not reset it.

In the free plugin, use the campaign’s Max Impressions cap, a limited Unique Pool of coupon codes, or low win probabilities to control how often prizes are handed out, and use IP/device blocking to shut down individual abusers.

Privacy & GDPR Notes

IP addresses are personal data, so handle them responsibly. The plugin’s General settings give you the compliance tools that actually exist:

• GDPR consent: Enable a required consent checkbox with your own label text so visitors opt in before entering.
• Data retention: Set how many days lead data is kept before it is cleaned up.

There is no “anonymize IP” toggle in the plugin. If your policy requires IP anonymization, handle it at the server or reverse-proxy level.

Frequently Asked Questions

Can I whitelist my own IP for testing?

There is no whitelist. The Security tab only maintains blocklists, so unless you have explicitly added your own IP or device to the blocklist, nothing stops you from testing the wheel repeatedly.

What if several people share one Wi-Fi network?

They share the same public IP, so blocking that IP blocks everyone behind it. That is why the plugin pairs IP blocking with a per-device ID — it targets the specific browser rather than everyone on the network. Reserve IP blocking for genuinely abusive sources.

Can I block visitors by country?

Not from inside the plugin, which is kept lightweight. To restrict by country, use a dedicated geo-blocking plugin or your CDN/firewall (for example Cloudflare) to block access to your site as a whole.

Does blocking still work with a page-caching plugin?

Yes. The block check runs on the server through the wheel’s AJAX request, not in the cached HTML, so caching plugins do not bypass it. A blocked IP or device is stopped even when the page itself is served from cache.

Related Documentation

• Manual Blocking: Block an individual lead’s IP and device straight from the Leads dashboard.
• Disposable Email Blocking: How the throwaway-email filter works and how to customise its message.
• Win Probabilities: Use probabilities and unique pools to control how often prizes are won.

Conclusion

Keeping your spin wheel fair comes down to three free controls: block abusive IPs, block persistent device IDs to defeat VPN hopping, and reject disposable emails. For automatic per-visitor spin limits with a timed cooldown, upgrade to Ultimate Spin Wheel Pro. If you need help, visit the wowDevs support center.