ZAIA Security, the free WordPress plugin against bots
Who is it for?
For WordPress sites and WooCommerce stores that get bot registrations, comments or orders, and for agencies running several sites.
ZAIA Security checks the context of every sensitive action on your site: login, registration, lost password, comments, WooCommerce checkout and REST API writes. It does not replace WordPress accounts: it makes sure the request really comes from your site, from the same device, and that the behaviour stays plausible.
What ZAIA detects
- bots and automated scripts;
- credential stuffing (stolen password attempts);
- replay of captured requests and stolen sessions reused elsewhere;
- bursts of requests and impossible country changes.
Safe for your site
- observation mode on install: everything is checked and logged, nothing is blocked;
- if ZAIA does not respond, your site keeps working;
- application passwords, WP-CLI, cron and server integrations are never affected.
Optional: passwordless sign-in for your visitors (« Continue with Google » or an email code), placed and styled from Settings → ZAIA, no code needed.
Install ZAIA Security in 5 minutes
- Download zaia-security-1.0.0.zip above.
- In WordPress: Plugins → Add New → Upload Plugin, choose the file, then Activate.
- Create a free account on the ZAIA console and an application. Add your site address in the Origins tab and enable public access.
- In Settings → ZAIA, paste the public identifier (
app_…) and the server key (zsk_…), then click Test. - Watch the ZAIA console log for a few days, then switch to Enforce mode.
Frequently asked questions
Is ZAIA Security really free?
Yes. The plugin is free and GPL-licensed. The ZAIA service has a free plan of 100,000 requests per month per application, and every feature of the plugin works with it.
What data is sent to ZAIA?
Nothing is sent until an administrator enters the credentials. Then, only for protected actions: IP address, browser, page origin and ZAIA session identifiers. Passwords, content and order data are never sent.
My site is behind Cloudflare, does it work?
Yes: in Settings → ZAIA, choose « Behind Cloudflare » so ZAIA sees the visitor's real address.
Are cached pages affected?
No. Pages stay cached: only actions (login, comment, order…) are checked.
Does ZAIA Security ask visitors to click on pictures?
No. ZAIA checks the context of the request (device, origin, behaviour) without asking the visitor anything.
Need help installing or configuring the plugin, or a custom WordPress plugin? Contact the NEWTIV team.