ZeroBot Security protects your site from the first minute, with no account and no setup.
Activate it and two protections start working inside WordPress itself.
Nothing is sent anywhere.
Free, no account needed
- Login Brute-Force Guard — Counts failed logins per IP and locks the IP out after 5 attempts
for 15 minutes (both adjustable). Blocks password-guessing bots on wp-login.php. - XML-RPC Kill Switch — Shuts down xmlrpc.php, the endpoint bots use to try hundreds of
passwords in one request and to abuse pingbacks. Skipped automatically when Jetpack is active,
because Jetpack needs it. - Attack counter — The dashboard shows how many failed logins, lockouts and XML-RPC requests
were stopped over the last 7 days. - Spoof-proof IP detection — Proxy headers are only trusted from real Cloudflare edges and
local reverse proxies, so attackers cannot fake their IP to dodge a lockout.
Network protection (free 7-day trial, then a ZeroBot plan)
Connect the site from the plugin dashboard: enter your email, confirm it, and the plugin activates
itself. The trial includes 100 IP checks and needs no credit card.
- Site-Wide Firewall — Switches on automatically when you connect. Every public request is
checked against IPs, VPNs, Tor nodes and datacenters seen attacking the ZeroBot network, with
optional country rules. If ZeroBot is slow to answer, the visitor is let through after 3 seconds. - Browser Fingerprint — Detects headless browsers, VMs and automation frameworks.
- Comment Guard — Blocks bot comments before they are saved.
- REST API Guard — Screens public REST calls, with configurable exempt routes.
- Shared blacklist — IPs locked out by the login guard are pushed to your ZeroBot blacklist
and blocked on every site you connect.
When a trial or plan ends, network protection pauses and the free protections keep running.
Full Platform Management
- Domain Rules — Create, edit, and delete antibot rules from inside wp-admin.
- Whitelist — IPs, CIDR ranges, and ASNs scoped per service. Bulk import supported.
- Blacklist — Same scoping and bulk import as the whitelist.
- Threat Logs — Filterable, paginated viewer of every traffic event with CSV export.
- Dashboard — Live stats, 7-day traffic chart, recent threats, account info.
Other Features
- Cloudflare and reverse-proxy IP detection that cannot be spoofed by visitors
- Decision cache via WordPress object cache (Redis/Memcached) with transient fallback
- Fail-open by default — never breaks your site if the API is unreachable
- Daily license verification via wp-cron
- WP-admin dashboard widget showing bots/humans (24h)
- Pure PHP + vanilla JS — no jQuery, no React, no external CDN
External Services
The free protections (login guard, XML-RPC kill switch) run entirely inside WordPress and
contact no external service. The plugin only contacts ZeroBot after the administrator either
submits the “Turn on network protection” form or enters a license key.
0. ZeroBot account signup (https://zerobot.info/v3/wp/connect)
- What it does: Creates a free ZeroBot trial account from inside wp-admin.
- When it’s called: Only when the administrator types an email, ticks the consent box and clicks
“Start free trial”. While the account waits for email confirmation, the open admin page checks
every 10 seconds whether it has been confirmed. - Data transmitted: The email address entered (it must belong to an administrator of the site),
this site’s domain and home URL, the plugin version and the server’s IP address. During signup
ZeroBot fetches a one-time confirmation from the site, including a keyed hash of that email.
ZeroBot then sends an activation email to that address. - What it returns: A one-time claim code, then the license key once the email is confirmed.
- Terms & Privacy: https://zerobot.info/terms — https://zerobot.info/policy
1. ZeroBot API (https://zerobot.info)
- What it does: Classifies visitors as human or bot, synchronizes domain rules / whitelists /
blacklists, and returns threat log data for the dashboard. - When it’s called: On every public request that one of the enabled protection layers handles
(Firewall, Page Protection, Login Guard, Comment Guard, REST API Guard). Also called from the
admin dashboard for stats, rules, lists, and traffic logs. Also called once per day by
wp-cron for license verification. - Data transmitted: Visitor IP address, user agent, current URL host, site domain, and the
plugin’s license key. No post content, no customer personal data, no form submissions. - What it returns: A JSON decision object (
is_bot,reason,risk_score, optional
captcha_html), plan metadata, and aggregate stats for the dashboard. - Terms & Privacy: https://zerobot.info/terms — https://zerobot.info/policy
2. ZeroBot Fingerprint Collector (https://zerobot.info/fingerprint/index.js)
- What it does: Collects client-side browser signals (canvas, WebGL, fonts, behavior) to detect
headless browsers, VMs, and automation frameworks. - When it’s loaded: Injected on public pages and the login screen ONLY when the administrator
enables “Browser Fingerprint” in Protection Settings. It is disabled by default; the plugin
does not load any external JavaScript out of the box. - Data transmitted: Browser fingerprint signals and the visitor’s IP address. No WordPress
user data, no cookies, no form data. - What it returns: A risk score used to decide whether a visitor should face a soft challenge.
- Terms & Privacy: https://zerobot.info/terms — https://zerobot.info/policy
3. FlagCDN (https://flagcdn.com)
- What it does: Serves tiny country-flag PNG images for the admin-only traffic log.
- When it’s loaded: Only inside wp-admin, only when the administrator opens the Dashboard or
Threat Logs page. It is never loaded on the public site. Only 2-letter ISO country codes are
transmitted as part of the image URL. - Data transmitted: The 2-letter country code and standard image-request metadata. No visitor
data, no WordPress data, no cookies. - Service homepage: https://flagcdn.com
If you do not wish to transmit any data to ZeroBot, do not connect the site. The free
protections keep working without any external connection.
Privacy
This plugin does not store visitor personal data in your WordPress database beyond IP
addresses in the local threat-log table (wp_zb_threats, dropped on uninstall). It does
not set any cookies on visitors. Data sent to the ZeroBot service is described in the
External Services section above.