Description
ZAIA Security connects your site to ZAIA, a request-context verification service run by NEWTIV. It does not replace WordPress accounts: for every sensitive action, it checks that the request really comes from your site, from the same device, and that the behaviour stays plausible.
Actions checked (your choice):
- login (wp-login.php and WooCommerce), registration, lost password;
- comments;
- REST API writes from the browser (block editor, admin);
- WooCommerce checkout.
Passwordless sign-in for visitors (optional): « Continue with Google » or a code received by email, through the ZAIA sign-in page. In Settings ZAIA you choose the page where it appears, the format (inside the page, in a window, or full page) and its appearance (colour, corner radius, light or dark mode), with a preview, no code needed. Accounts stay in WordPress: an existing account is found by its verified email address, and, if you enable it and your site allows registration, a new account is created with the Subscriber role (Customer with WooCommerce) once ZAIA has verified the email address. Sign-in goes through wp_signon(), so other security plugins still apply. Visitor accounts never see the WordPress dashboard.
What ZAIA detects: bots and scripts, credential stuffing, replay of captured requests, stolen sessions reused elsewhere, bursts of requests, impossible country changes. Addresses that pile up alerts are quarantined automatically.
Safe for your site:
- observation mode on install: everything is checked and logged in the ZAIA console, nothing is blocked;
- if ZAIA does not respond, the site keeps working (configurable);
- application passwords, WP-CLI, cron and server integrations are never affected.
The plugin is ready for translation through translate.wordpress.org.
External services
This plugin relies on the ZAIA service (https://zaia.newtiv.com), operated by NEWTIV (Abidjan, Côte d’Ivoire). Nothing is sent until an administrator enters a ZAIA application identifier and server key in Settings ZAIA.
What is sent, and when:
- From the visitor’s browser (only on the forms you choose to protect, and on the sign-in page you enable): the ZAIA client script, bundled with the plugin, opens a session with https://zaia.newtiv.com/v1/handshake/ and adds ZAIA headers to the form. ZAIA receives the browser’s IP address, user agent, page origin and, if available, screen size, time zone and language.
- From your server, when a protected form is submitted: a verification request to https://zaia.newtiv.com/v1/verify with the session headers, the visitor’s IP address and user agent. For a signed-in user, a technical identifier
wp:<user number>is sent to https://zaia.newtiv.com/v1/users/grant. Passwords, content and order data are never sent. - Passwordless sign-in (only if enabled): the visitor uses the ZAIA sign-in page (https://zaia.newtiv.com/login/), shown in your page, in a window or full page. After sign-in, your server exchanges a one-time code at https://zaia.newtiv.com/v1/connect/token and receives the visitor’s identifier, email address and name.
- Configuration test (the « Test » button in Settings ZAIA): https://zaia.newtiv.com/v1/app returns the application’s settings.
The service: Terms of use · Privacy policy · Service status.
ZAIA offers a free plan (100,000 requests per month per application) and a custom Enterprise plan on quote. Every feature of this plugin works with the free plan.
Installation
- Create a free account on the ZAIA console and an application.
- In the application: Origins tab, add your site address (
https://your-site.com); Authentication tab, enable public access (for signed-out visitors). - In WordPress: Settings ZAIA, paste the public identifier (
app_…) and the server key (zsk_…), or define the key inwp-config.php:define('ZAIA_SERVER_KEY', 'zsk_…'); - Click Test: the plugin checks the key, the origin and public access.
- Watch the ZAIA console Log for a few days, then switch to Enforce mode.
- Passwordless sign-in (optional): in the ZAIA console, Sign-in tab, enable hosted sign-in, choose the methods and declare the return address shown in Settings ZAIA. Then, in Settings ZAIA, tick the visitor sign-in option and choose the page, format and appearance.
FAQ
-
My site is behind Cloudflare
-
Settings ZAIA Visitor IP address: choose « Behind Cloudflare ». Otherwise ZAIA would see Cloudflare’s address instead of the visitor’s.
-
Are cached pages checked?
-
Page views are not checked (and can stay cached): only actions are. The ZAIA proof is added when the form is submitted.
-
What happens when ZAIA asks for an extra verification?
-
WordPress has no built-in two-factor authentication, so you choose: let the request through (default) or refuse it.
-
Where does the sign-in appear?
-
On the page chosen in Settings ZAIA (above or below its content), or wherever you place the
[zaia_login]shortcode. Shortcode options:display="inline|modal|page",accent="#0a4fa3",radius="8",mode="light|dark|auto",label,redirect,account,logout="0". It is also offered on the WooCommerce « My account » page. The button on wp-login.php (admin login) is off by default. -
Can I adjust a decision?
-
Filter
zaia_security_decision( $result, $action ): for example to always let certain addresses through.
Contributors & Developers
“ZAIA Security” is open source software. The following people have contributed to this plugin.
Contributors
Translate “ZAIA Security” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.0
- First release: verification of login, registration, lost password, comments, REST API and WooCommerce checkout; passwordless sign-in for visitors (Google, email code) placed and styled from Settings ZAIA; observation mode; configuration test.