=== ZAIA Security ===
Contributors: newtiv
Tags: security, login, brute force, bot protection, woocommerce
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Checks the context of every login, comment, order and REST API call: origin, device, replay, bots, credential stuffing.

== Description ==

ZAIA Security connects your site to [ZAIA](https://zaia.newtiv.com), a request-context verification service run by NEWTIV. It does not replace WordPress accounts: for every sensitive action, it checks that the request really comes from your site, from the same device, and that the behaviour stays plausible.

**Actions checked** (your choice):

* login (wp-login.php and WooCommerce), registration, lost password;
* comments;
* REST API writes from the browser (block editor, admin);
* WooCommerce checkout.

**Passwordless sign-in for visitors** (optional): « Continue with Google » or a code received by email, through the ZAIA sign-in page. In Settings → ZAIA you choose the page where it appears, the format (inside the page, in a window, or full page) and its appearance (colour, corner radius, light or dark mode), with a preview, no code needed. Accounts stay in WordPress: an existing account is found by its verified email address, and, if you enable it and your site allows registration, a new account is created with the Subscriber role (Customer with WooCommerce) once ZAIA has verified the email address. Sign-in goes through wp_signon(), so other security plugins still apply. Visitor accounts never see the WordPress dashboard.

**What ZAIA detects**: bots and scripts, credential stuffing, replay of captured requests, stolen sessions reused elsewhere, bursts of requests, impossible country changes. Addresses that pile up alerts are quarantined automatically.

**Safe for your site**:

* **observation** mode on install: everything is checked and logged in the ZAIA console, nothing is blocked;
* if ZAIA does not respond, the site keeps working (configurable);
* application passwords, WP-CLI, cron and server integrations are never affected.

The plugin is ready for translation through translate.wordpress.org.

== External services ==

This plugin relies on the ZAIA service (https://zaia.newtiv.com), operated by NEWTIV (Abidjan, Côte d'Ivoire). Nothing is sent until an administrator enters a ZAIA application identifier and server key in Settings → ZAIA.

What is sent, and when:

* **From the visitor's browser** (only on the forms you choose to protect, and on the sign-in page you enable): the ZAIA client script, bundled with the plugin, opens a session with https://zaia.newtiv.com/v1/handshake/ and adds ZAIA headers to the form. ZAIA receives the browser's IP address, user agent, page origin and, if available, screen size, time zone and language.
* **From your server**, when a protected form is submitted: a verification request to https://zaia.newtiv.com/v1/verify with the session headers, the visitor's IP address and user agent. For a signed-in user, a technical identifier `wp:<user number>` is sent to https://zaia.newtiv.com/v1/users/grant. Passwords, content and order data are never sent.
* **Passwordless sign-in** (only if enabled): the visitor uses the ZAIA sign-in page (https://zaia.newtiv.com/login/), shown in your page, in a window or full page. After sign-in, your server exchanges a one-time code at https://zaia.newtiv.com/v1/connect/token and receives the visitor's identifier, email address and name.
* **Configuration test** (the « Test » button in Settings → ZAIA): https://zaia.newtiv.com/v1/app returns the application's settings.

The service: [Terms of use](https://zaia.newtiv.com/conditions) · [Privacy policy](https://zaia.newtiv.com/confidentialite) · [Service status](https://zaia.newtiv.com/statut).

ZAIA offers a free plan (100,000 requests per month per application) and a custom Enterprise plan on quote. Every feature of this plugin works with the free plan.

== Installation ==

1. Create a free account on the [ZAIA console](https://zaia.newtiv.com/console/) and an application.
2. In the application: **Origins** tab, add your site address (`https://your-site.com`); **Authentication** tab, enable **public access** (for signed-out visitors).
3. In WordPress: **Settings → ZAIA**, paste the public identifier (`app_…`) and the server key (`zsk_…`), or define the key in `wp-config.php`: `define('ZAIA_SERVER_KEY', 'zsk_…');`
4. Click **Test**: the plugin checks the key, the origin and public access.
5. Watch the ZAIA console **Log** for a few days, then switch to **Enforce** mode.
6. Passwordless sign-in (optional): in the ZAIA console, **Sign-in** tab, enable hosted sign-in, choose the methods and declare the return address shown in Settings → ZAIA. Then, in Settings → ZAIA, tick the visitor sign-in option and choose the page, format and appearance.

== Frequently Asked Questions ==

= My site is behind Cloudflare =

Settings → ZAIA → Visitor IP address: choose « Behind Cloudflare ». Otherwise ZAIA would see Cloudflare's address instead of the visitor's.

= Are cached pages checked? =

Page views are not checked (and can stay cached): only actions are. The ZAIA proof is added when the form is submitted.

= What happens when ZAIA asks for an extra verification? =

WordPress has no built-in two-factor authentication, so you choose: let the request through (default) or refuse it.

= Where does the sign-in appear? =

On the page chosen in Settings → ZAIA (above or below its content), or wherever you place the `[zaia_login]` shortcode. Shortcode options: `display="inline|modal|page"`, `accent="#0a4fa3"`, `radius="8"`, `mode="light|dark|auto"`, `label`, `redirect`, `account`, `logout="0"`. It is also offered on the WooCommerce « My account » page. The button on wp-login.php (admin login) is off by default.

= Can I adjust a decision? =

Filter `zaia_security_decision( $result, $action )`: for example to always let certain addresses through.

== Changelog ==

= 1.0.0 =
* First release: verification of login, registration, lost password, comments, REST API and WooCommerce checkout; passwordless sign-in for visitors (Google, email code) placed and styled from Settings → ZAIA; observation mode; configuration test.
