Pure PHP + vanilla JS \u2014 no jQuery, no React, no external CDN<\/li>\n<\/ul>\n\nExternal Services<\/h3>\n\n
This plugin connects to the following third-party service to provide its core bot-detection\nand threat-intelligence features. Nothing is contacted until the administrator enters a\nlicense key and activates a protection layer.<\/p>\n\n
1. ZeroBot API (https:\/\/zerobot.info)<\/strong><\/p>\n\n\n- What it does: Classifies visitors as human or bot, synchronizes domain rules \/ whitelists \/\nblacklists, and returns threat log data for the dashboard.<\/li>\n
- When it's called: On every public request that one of the enabled protection layers handles\n(Firewall, Page Protection, Login Guard, Comment Guard, REST API Guard). Also called from the\nadmin dashboard for stats, rules, lists, and traffic logs. Also called once per day by\nwp-cron for license verification.<\/li>\n
- Data transmitted: Visitor IP address, user agent, current URL host, site domain, and the\nplugin's license key. No post content, no customer personal data, no form submissions.<\/li>\n
- What it returns: A JSON decision object (
is_bot<\/code>, reason<\/code>, risk_score<\/code>, optional\n captcha_html), plan metadata, and aggregate stats for the dashboard.<\/li>\n- Terms & Privacy: https:\/\/zerobot.info\/terms \u2014 https:\/\/zerobot.info\/policy<\/li>\n<\/ul>\n\n
2. ZeroBot Fingerprint Collector (https:\/\/zerobot.info\/fingerprint\/index.js)<\/strong><\/p>\n\n\n- What it does: Collects client-side browser signals (canvas, WebGL, fonts, behavior) to detect\nheadless browsers, VMs, and automation frameworks.<\/li>\n
- When it's loaded: Injected on public pages and the login screen ONLY when the administrator\nenables \"Browser Fingerprint\" in Protection Settings. It is disabled by default; the plugin\ndoes not load any external JavaScript out of the box.<\/li>\n
- Data transmitted: Browser fingerprint signals and the visitor's IP address. No WordPress\nuser data, no cookies, no form data.<\/li>\n
- What it returns: A risk score used to decide whether a visitor should face a soft challenge.<\/li>\n
- Terms & Privacy: https:\/\/zerobot.info\/terms \u2014 https:\/\/zerobot.info\/policy<\/li>\n<\/ul>\n\n
3. FlagCDN (https:\/\/flagcdn.com)<\/strong><\/p>\n\n\n- What it does: Serves tiny country-flag PNG images for the admin-only traffic log.<\/li>\n
- When it's loaded: Only inside wp-admin, only when the administrator opens the Dashboard or\nThreat Logs page. It is never loaded on the public site. Only 2-letter ISO country codes are\ntransmitted as part of the image URL.<\/li>\n
- Data transmitted: The 2-letter country code and standard image-request metadata. No visitor\ndata, no WordPress data, no cookies.<\/li>\n
- Service homepage: https:\/\/flagcdn.com<\/li>\n<\/ul>\n\n
If you do not wish to transmit any data to ZeroBot, simply do not activate a license \u2014 the\nplugin stays dormant.<\/p>\n\n
Privacy<\/h3>\n\n
This plugin does not store visitor personal data in your WordPress database beyond IP\naddresses in the local threat-log table (wp_zb_threats<\/code>, dropped on uninstall). It does\nnot set any cookies on visitors. Data sent to the ZeroBot service is described in the\nExternal Services section above.<\/p>\n\n\n\n- Upload the plugin zip via Plugins \u2192 Add New \u2192 Upload<\/li>\n
- Activate the plugin<\/li>\n
- Go to ZeroBot \u2192 License<\/strong> and enter your license key<\/li>\n
- Configure protection layers in ZeroBot \u2192 Protection<\/strong><\/li>\n<\/ol>\n\n
A ZeroBot license is required. Get one at https:\/\/zerobot.info<\/p>\n\n\n
\nWill this plugin break my site if the ZeroBot API is down?<\/h3><\/dt>\nNo. The default Fail Mode is \"Fail Open\" \u2014 visitors are allowed through silently and the\nincident is logged to the PHP error log. You can switch to Fail Closed in Protection\nSettings if you prefer strict security.<\/p><\/dd>\n
How much does it call the ZeroBot API?<\/h3><\/dt>\nEvery visitor decision is cached per-IP for 24 hours by default, so repeat visitors do not\ntrigger additional API calls. A page that gets 1,000 hits\/hour from returning visitors\ntypically results in only a handful of API calls.<\/p><\/dd>\n
Does the fingerprint collector always run?<\/h3><\/dt>\nNo. The fingerprint collector is disabled by default and only injects on the public site\nwhen the administrator turns on \"Browser Fingerprint\" under Protection Settings.<\/p><\/dd>\n
Does it work with WooCommerce?<\/h3><\/dt>\nYes \u2014 the REST API Guard auto-exempts \/wc\/store\/<\/code> routes. Add other custom routes to the\nexempt list as needed.<\/p><\/dd>\nDoes it support multisite?<\/h3><\/dt>\nSingle-site only in v1.0. Multisite support is planned for v1.1.<\/p><\/dd>\n\n<\/dl>\n\n\n
1.0.15<\/h4>\n\n\n- WordPress.org review compliance: removed the broken
flagpedia.net\/privacy<\/code>\nURL from the External Services section of readme.txt.<\/li>\n- The chart-data bootstrap on the admin dashboard now ships via\n wp_add_inline_script() attached to the existing
zerobot-security-admin<\/code>\nhandle, instead of an inline <script><\/code> tag. No behavioural change \u2014 the\nsame JS payload is delivered through the official WordPress enqueue API.<\/li>\n<\/ul>\n\n1.0.14<\/h4>\n\n\n- WordPress.org review compliance: replaced the short \"zb_\" prefix everywhere\nit appeared in PHP and JS (AJAX action names, option keys, transient keys,\nnonce names, cron hooks, JS globals, custom DB table names, WP_Error codes,\nand the admin script handle) with the full \"zerobot_security_\" prefix so\nevery plugin-defined identifier is at least the WP.org-required 4 characters\nand is uniquely namespaced.<\/li>\n
- No functional or UI changes \u2014 the rename is purely cosmetic (CSS class\nnames beginning with \"zb-\" are stylesheet-internal and were left\nunchanged, since they don't conflict with WordPress core or other plugins).<\/li>\n<\/ul>\n\n
1.0.12<\/h4>\n\n\n- Second Plugin Check compliance pass: final 3 errors resolved (wrap\ncountryFlagImg() output in wp_kses(); add translators comment for\n\"Cleared %d cached decisions\"; etc.). Input-sanitization warnings\naddressed across Helpers, Firewall, ProtectionSettings, LicensePage.<\/li>\n
- Fingerprint script now passes the plugin version to wp_enqueue_script()\nfor reliable cache-busting.<\/li>\n
- Uninstall variables renamed to zerobot_security_* prefix.<\/li>\n<\/ul>\n\n
1.0.11<\/h4>\n\n\n- Full Plugin Check compliance pass: wrap every Helpers::icon() SVG output\nthrough wp_kses() with a tight SVG tag allowlist; add wp_unslash() +\nsanitize calls on every $SERVER \/ $_POST \/ $_GET read; gate error_log()\nbehind WP_DEBUG; replace date() with gmdate(); rename plugin constants to\nZEROBOT_SECURITY<\/em>* prefix; drop load_plugin_textdomain (WP 4.6+ auto-loads\ntranslations); add translators comments for all placeholders; LoginGuard\nqueries use esc_sql() for the table identifier; uninstall uses prefixed\nvariables and prepared statements.<\/li>\n
- Fingerprint script now enqueued via
wp_enqueue_script()<\/code> with a\n script_loader_tag filter for the data attributes, replacing the raw\n echo ''. Respects standard WordPress script filters.<\/li>\n- DecisionCache::flush() no longer issues a raw LIKE query \u2014 iterates the\nmatching transient option names and calls
delete_transient()<\/code> for each,\nso the object cache and transient DB stay in sync.<\/li>\n- Threat Logs are now always scoped to the current WordPress site's host (the\n\"Domain\" filter is removed \u2014 it's redundant and could leak cross-domain data).<\/li>\n
- Firewall self-heals domain-deauthorization in real time: the plugin flags the\nsite immediately on the first failed API call instead of waiting for the\ndaily verify cron, so the warning banner shows up right after the admin\nremoves the domain from authorized_domains.<\/li>\n
- Admin warning banner is now shown on every wp-admin page, not only the\nplugin's own screens.<\/li>\n
- Country flags in the Dashboard and Threat Logs render as reliable PNG\nimages (via flagcdn.com) instead of Unicode emoji, which some platforms\ndon't render.<\/li>\n<\/ul>\n\n
1.0.9<\/h4>\n\n\n- Per-IP decision cache extended to 24 hours to reduce API load<\/li>\n
- Allowed-countries enforcement moved server-side so denied requests are logged correctly<\/li>\n
- Login verification (device 2FA) toggle added per user<\/li>\n<\/ul>\n\n
1.0.8<\/h4>\n\n\n- Browser Fingerprint layer now also injects on wp-login.php and via wp_footer fallback<\/li>\n
- Fingerprint collector no longer skipped for logged-in users (configurable)<\/li>\n<\/ul>\n\n
1.0.7<\/h4>\n\n\n- \"Country Denied\" badge styled distinctly from generic bot block<\/li>\n
- Threat Logs show the visitor path alongside IP \/ ISP \/ country<\/li>\n<\/ul>\n\n
1.0.6<\/h4>\n\n\n- \/v3\/openapi now receives allowed_countries from the plugin so geo-blocks are enforced\nserver-side and logged with the correct reason<\/li>\n<\/ul>\n\n
1.0.5<\/h4>\n\n\n- Decision caching logic refactored so every request logs correctly<\/li>\n
- Fingerprint injection improvements<\/li>\n<\/ul>\n\n
1.0.3 - 1.0.4<\/h4>\n\n\n- \"Clear Threats for this Domain\" action in Threat Logs<\/li>\n
- \"Path\" column in Threat Logs showing the URL the visitor accessed<\/li>\n<\/ul>\n\n
1.0.0<\/h4>\n\n\n- Initial release<\/li>\n
- Full Dashboard, License, Rules, Whitelist, Blacklist, Protection Settings, Threat Logs<\/li>\n
- Six protection layers: Page, Firewall, Login, Comment, REST API, XML-RPC<\/li>\n
- Decision caching with object cache + transient fallback<\/li>\n
- CSV export for threat logs<\/li>\n
- WP-admin dashboard widget<\/li>\n
- Cloudflare \/ proxy IP detection<\/li>\n<\/ul>","raw_excerpt":"Full-stack antibot, firewall, captcha, and threat intelligence for WordPress \u2014 powered by the ZeroBot platform.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/305505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=305505"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/zerobot"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=305505"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=305505"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=305505"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=305505"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=305505"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=305505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}