{"id":10634,"date":"2026-05-18T05:31:03","date_gmt":"2026-05-17T21:31:03","guid":{"rendered":"https:\/\/aeosub.com\/zerobot-security\/"},"modified":"2026-05-18T05:31:03","modified_gmt":"2026-05-17T21:31:03","slug":"zerobot-security","status":"publish","type":"post","link":"https:\/\/aeosub.com\/zh\/zerobot-security\/","title":{"rendered":"ZeroBot Security"},"content":{"rendered":"
\n\n\n\n\n\n\n\n
Developer<\/th>\nzerobot<\/a><\/td>\n<\/tr>\n
Version<\/th>\nv1.0.15<\/td>\n<\/tr>\n
Active Installs<\/th>\n0 +<\/td>\n<\/tr>\n
Requires \/ Tested<\/th>\n5.8 \/ 6.9.4<\/td>\n<\/tr>\n
Last Updated<\/th>\n2026-05-17 9:16pm GMT<\/td>\n<\/tr>\n
Official Link<\/th>\nView Details \u2192<\/a><\/td>\n<\/tr>\n<\/table><\/div>\n
Full-stack antibot, firewall, captcha, and threat intelligence for WordPress \u2014 powered by the ZeroBot platform.<\/div>\n

ZeroBot Security brings the full ZeroBot antibot platform to WordPress, adding six layered defenses
\nmanaged from a single dashboard. Every event is screened against a 1.5M+ IP intelligence database,
\nfingerprint-based scoring, and real-time threat sharing across the ZeroBot network.<\/p>\n

Six Protection Layers<\/h4>\n
    \n
  • Page Protection<\/strong> \u2014 Per-page antibot screening. Renders Cloudflare Turnstile or the ZeroBot
    \nnative slider captcha for borderline visitors before letting them through.<\/li>\n
  • Firewall<\/strong> \u2014 Site-wide screening of every public request against the ZeroBot threat database.<\/li>\n
  • Login Brute-Force Guard<\/strong> \u2014 Tracks failed logins per IP, auto-blocks after N attempts,
    \noptionally pushes IPs to your ZeroBot blacklist.<\/li>\n
  • Comment Guard<\/strong> \u2014 Blocks bot comments before they’re saved.<\/li>\n
  • REST API Guard<\/strong> \u2014 Screens public REST calls (with configurable exempt routes).<\/li>\n
  • XML-RPC Guard<\/strong> \u2014 Disables XML-RPC entirely (a major attack vector).<\/li>\n<\/ul>\n

    Full Platform Management<\/h4>\n
      \n
    • Domain Rules<\/strong> \u2014 Create, edit, and delete antibot rules from inside wp-admin.<\/li>\n
    • Whitelist<\/strong> \u2014 IPs, CIDR ranges, and ASNs scoped per service. Bulk import supported.<\/li>\n
    • Blacklist<\/strong> \u2014 Same scoping and bulk import as the whitelist.<\/li>\n
    • Threat Logs<\/strong> \u2014 Filterable, paginated viewer of every traffic event with CSV export.<\/li>\n
    • Dashboard<\/strong> \u2014 Live stats, 7-day traffic chart, recent threats, account info.<\/li>\n<\/ul>\n

      Other Features<\/h4>\n
        \n
      • Cloudflare \/ proxy IP detection (CF-Connecting-IP, X-Real-IP, X-Forwarded-For)<\/li>\n
      • Decision cache via WordPress object cache (Redis\/Memcached) with transient fallback<\/li>\n
      • Fail-open by default \u2014 never breaks your site if the API is unreachable<\/li>\n
      • Daily license verification via wp-cron<\/li>\n
      • WP-admin dashboard widget showing bots\/humans (24h)<\/li>\n
      • Pure PHP + vanilla JS \u2014 no jQuery, no React, no external CDN<\/li>\n<\/ul>\n

        External Services<\/h3>\n

        This plugin connects to the following third-party service to provide its core bot-detection
        \nand threat-intelligence features. Nothing is contacted until the administrator enters a
        \nlicense key and activates a protection layer.<\/p>\n

        1. ZeroBot API (https:\/\/zerobot.info)<\/strong><\/p>\n

          \n
        • What it does: Classifies visitors as human or bot, synchronizes domain rules \/ whitelists \/
          \nblacklists, and returns threat log data for the dashboard.<\/li>\n
        • When it’s called: On every public request that one of the enabled protection layers handles
          \n(Firewall, Page Protection, Login Guard, Comment Guard, REST API Guard). Also called from the
          \nadmin dashboard for stats, rules, lists, and traffic logs. Also called once per day by
          \nwp-cron for license verification.<\/li>\n
        • Data transmitted: Visitor IP address, user agent, current URL host, site domain, and the
          \nplugin’s license key. No post content, no customer personal data, no form submissions.<\/li>\n
        • What it returns: A JSON decision object (is_bot<\/code>, reason<\/code>, risk_score<\/code>, optional
          \n captcha_html), plan metadata, and aggregate stats for the dashboard.<\/li>\n
        • Terms & Privacy: https:\/\/zerobot.info\/terms \u2014 https:\/\/zerobot.info\/policy<\/li>\n<\/ul>\n

          2. ZeroBot Fingerprint Collector (https:\/\/zerobot.info\/fingerprint\/index.js)<\/strong><\/p>\n

            \n
          • What it does: Collects client-side browser signals (canvas, WebGL, fonts, behavior) to detect
            \nheadless browsers, VMs, and automation frameworks.<\/li>\n
          • When it’s loaded: Injected on public pages and the login screen ONLY when the administrator
            \nenables “Browser Fingerprint” in Protection Settings. It is disabled by default; the plugin
            \ndoes not load any external JavaScript out of the box.<\/li>\n
          • Data transmitted: Browser fingerprint signals and the visitor’s IP address. No WordPress
            \nuser data, no cookies, no form data.<\/li>\n
          • What it returns: A risk score used to decide whether a visitor should face a soft challenge.<\/li>\n
          • Terms & Privacy: https:\/\/zerobot.info\/terms \u2014 https:\/\/zerobot.info\/policy<\/li>\n<\/ul>\n

            3. FlagCDN (https:\/\/flagcdn.com)<\/strong><\/p>\n

              \n
            • What it does: Serves tiny country-flag PNG images for the admin-only traffic log.<\/li>\n
            • When it’s loaded: Only inside wp-admin, only when the administrator opens the Dashboard or
              \nThreat Logs page. It is never loaded on the public site. Only 2-letter ISO country codes are
              \ntransmitted as part of the image URL.<\/li>\n
            • Data transmitted: The 2-letter country code and standard image-request metadata. No visitor
              \ndata, no WordPress data, no cookies.<\/li>\n
            • Service homepage: https:\/\/flagcdn.com<\/li>\n<\/ul>\n

              If you do not wish to transmit any data to ZeroBot, simply do not activate a license \u2014 the
              \nplugin stays dormant.<\/p>\n

              Privacy<\/h3>\n

              This plugin does not store visitor personal data in your WordPress database beyond IP
              \naddresses in the local threat-log table (wp_zb_threats<\/code>, dropped on uninstall). It does
              \nnot set any cookies on visitors. Data sent to the ZeroBot service is described in the
              \nExternal Services section above.<\/p>","protected":false},"excerpt":{"rendered":"

              Full-stack antibot, firewall, captcha, and threat intelligence for WordPress \u2014 powered by the ZeroBot platform.<\/p>","protected":false},"author":1,"featured_media":9317,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[252],"tags":[1110,1111,932,664,1112,555],"class_list":["post-10634","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-trends","tag-antibot","tag-captcha","tag-firewall","tag-security","tag-threat-intelligence","tag-wordpress-plugin"],"_links":{"self":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/10634","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/comments?post=10634"}],"version-history":[{"count":0,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/10634\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media\/9317"}],"wp:attachment":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media?parent=10634"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/categories?post=10634"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/tags?post=10634"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}