Title: ZAIA Security Author: newtiv Published: October 13, 2026 Last modified: October 13, 2026 --- Search plugins ![](https://ps.w.org/zaia-security/assets/icon.svg?rev=3744907) # ZAIA Security By [newtiv](https://profiles.wordpress.org/newtiv/) [Download](https://downloads.wordpress.org/plugin/zaia-security.1.0.0.zip) * [Details](https://wordpress.org/plugins/zaia-security/#description) * [Reviews](https://wordpress.org/plugins/zaia-security/#reviews) * [Installation](https://wordpress.org/plugins/zaia-security/#installation) * [Development](https://wordpress.org/plugins/zaia-security/#developers) [Support](https://wordpress.org/support/plugin/zaia-security/) ## Description ZAIA Security connects your site to [ZAIA](https://zaia.newtiv.com), a request-context verification service run by NEWTIV. It does not replace WordPress accounts: for every sensitive action, it checks that the request really comes from your site, from the same device, and that the behaviour stays plausible. **Actions checked** (your choice): * login (wp-login.php and WooCommerce), registration, lost password; * comments; * REST API writes from the browser (block editor, admin); * WooCommerce checkout. **Passwordless sign-in for visitors** (optional): « Continue with Google » or a code received by email, through the ZAIA sign-in page. In Settings ZAIA you choose the page where it appears, the format (inside the page, in a window, or full page) and its appearance (colour, corner radius, light or dark mode), with a preview, no code needed. Accounts stay in WordPress: an existing account is found by its verified email address, and, if you enable it and your site allows registration, a new account is created with the Subscriber role (Customer with WooCommerce) once ZAIA has verified the email address. Sign-in goes through wp_signon(), so other security plugins still apply. Visitor accounts never see the WordPress dashboard. **What ZAIA detects**: bots and scripts, credential stuffing, replay of captured requests, stolen sessions reused elsewhere, bursts of requests, impossible country changes. Addresses that pile up alerts are quarantined automatically. **Safe for your site**: * **observation** mode on install: everything is checked and logged in the ZAIA console, nothing is blocked; * if ZAIA does not respond, the site keeps working (configurable); * application passwords, WP-CLI, cron and server integrations are never affected. The plugin is ready for translation through translate.wordpress.org. ### External services This plugin relies on the ZAIA service (https://zaia.newtiv.com), operated by NEWTIV( Abidjan, Côte d’Ivoire). Nothing is sent until an administrator enters a ZAIA application identifier and server key in Settings ZAIA. What is sent, and when: * **From the visitor’s browser** (only on the forms you choose to protect, and on the sign-in page you enable): the ZAIA client script, bundled with the plugin, opens a session with https://zaia.newtiv.com/v1/handshake/ and adds ZAIA headers to the form. ZAIA receives the browser’s IP address, user agent, page origin and, if available, screen size, time zone and language. * **From your server**, when a protected form is submitted: a verification request to https://zaia.newtiv.com/v1/verify with the session headers, the visitor’s IP address and user agent. For a signed-in user, a technical identifier `wp:< user number>` is sent to https://zaia.newtiv.com/v1/users/grant. Passwords, content and order data are never sent. * **Passwordless sign-in** (only if enabled): the visitor uses the ZAIA sign-in page (https://zaia.newtiv.com/login/), shown in your page, in a window or full page. After sign-in, your server exchanges a one-time code at https://zaia.newtiv. com/v1/connect/token and receives the visitor’s identifier, email address and name. * **Configuration test** (the « Test » button in Settings ZAIA): https://zaia. newtiv.com/v1/app returns the application’s settings. The service: [Terms of use](https://zaia.newtiv.com/conditions) · [Privacy policy](https://zaia.newtiv.com/confidentialite)· [Service status](https://zaia.newtiv.com/statut). ZAIA offers a free plan (100,000 requests per month per application) and a custom Enterprise plan on quote. Every feature of this plugin works with the free plan. ## Installation 1. Create a free account on the [ZAIA console](https://zaia.newtiv.com/console/) and an application. 2. In the application: **Origins** tab, add your site address (`https://your-site. com`); **Authentication** tab, enable **public access** (for signed-out visitors). 3. In WordPress: **Settings ZAIA**, paste the public identifier (`app_…`) and the server key (`zsk_…`), or define the key in `wp-config.php`: `define('ZAIA_SERVER_KEY',' zsk_…');` 4. Click **Test**: the plugin checks the key, the origin and public access. 5. Watch the ZAIA console **Log** for a few days, then switch to **Enforce** mode. 6. Passwordless sign-in (optional): in the ZAIA console, **Sign-in** tab, enable hosted sign-in, choose the methods and declare the return address shown in Settings ZAIA. Then, in Settings ZAIA, tick the visitor sign-in option and choose the page, format and appearance. ## FAQ ### My site is behind Cloudflare Settings ZAIA Visitor IP address: choose « Behind Cloudflare ». Otherwise ZAIA would see Cloudflare’s address instead of the visitor’s. ### Are cached pages checked? Page views are not checked (and can stay cached): only actions are. The ZAIA proof is added when the form is submitted. ### What happens when ZAIA asks for an extra verification? WordPress has no built-in two-factor authentication, so you choose: let the request through (default) or refuse it. ### Where does the sign-in appear? On the page chosen in Settings ZAIA (above or below its content), or wherever you place the `[zaia_login]` shortcode. Shortcode options: `display="inline|modal|page"`,` accent="#0a4fa3"`, `radius="8"`, `mode="light|dark|auto"`, `label`, `redirect`, ` account`, `logout="0"`. It is also offered on the WooCommerce « My account » page. The button on wp-login.php (admin login) is off by default. ### Can I adjust a decision? Filter `zaia_security_decision( $result, $action )`: for example to always let certain addresses through. ## Reviews ![](https://secure.gravatar.com/avatar/ee359798586b7b0f89f518ab0005f209efff16f6e27303ee5c64147b0cc04056? s=60&d=retro&r=g) ### 󠀁[Congratulations](https://wordpress.org/support/topic/congratulations-99/)󠁿 [tah12](https://profiles.wordpress.org/tah12/) October 13, 2026 I recommend this plugin. Great project! [ Read all 1 review ](https://wordpress.org/support/plugin/zaia-security/reviews/) ## Contributors & Developers “ZAIA Security” is open source software. The following people have contributed to this plugin. Contributors * [ newtiv ](https://profiles.wordpress.org/newtiv/) “ZAIA Security” has been translated into 1 locale. Thank you to [the translators](https://translate.wordpress.org/projects/wp-plugins/zaia-security/contributors) for their contributions. [Translate “ZAIA Security” into your language.](https://translate.wordpress.org/projects/wp-plugins/zaia-security) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/zaia-security/), check out the [SVN repository](https://plugins.svn.wordpress.org/zaia-security/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/zaia-security/) by [RSS](https://plugins.trac.wordpress.org/log/zaia-security/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * First release: verification of login, registration, lost password, comments, REST API and WooCommerce checkout; passwordless sign-in for visitors (Google, email code) placed and styled from Settings ZAIA; observation mode; configuration test. ## Meta * Version **1.0.0** * Last updated **16 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1.3** * PHP version ** 7.4 or higher ** * Languages * [English (US)](https://wordpress.org/plugins/zaia-security/) and [Turkish](https://tr.wordpress.org/plugins/zaia-security/). * [Translate into your language](https://translate.wordpress.org/projects/wp-plugins/zaia-security) * Tags * [bot protection](https://wordpress.org/plugins/tags/bot-protection/)[Brute Force](https://wordpress.org/plugins/tags/brute-force/) [login](https://wordpress.org/plugins/tags/login/)[security](https://wordpress.org/plugins/tags/security/) [woocommerce](https://wordpress.org/plugins/tags/woocommerce/) * [Advanced View](https://wordpress.org/plugins/zaia-security/advanced/) ## Ratings 5 out of 5 stars. * [ 1 5-star review ](https://wordpress.org/support/plugin/zaia-security/reviews/?filter=5) * [ 0 4-star reviews ](https://wordpress.org/support/plugin/zaia-security/reviews/?filter=4) * [ 0 3-star reviews ](https://wordpress.org/support/plugin/zaia-security/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/zaia-security/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/zaia-security/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/zaia-security/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/zaia-security/reviews/) ## Contributors * [ newtiv ](https://profiles.wordpress.org/newtiv/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/zaia-security/)