ZeroBot Security – Login Protection, Firewall & Bot Blocker
Free brute-force login protection and XML-RPC blocking, plus an optional bot firewall backed by the live ZeroBot threat network.
Solid choice
ZeroBot Security is a solid plugin choice in 2026, with a few things worth checking first. Is rated 5/5 and was last updated 2 weeks ago, and scores 71/100 on our health check.
- Actively developed — last update 2 weeks ago
- Tested with the latest WordPress (7.1)
- Momentum — downloads up 2672.5% vs the previous 30 days
- Small user base (<10 active installs)
- Very few reviews so far
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where ZeroBot Security stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| antibot | #4 |
| Brute Force | >100 |
| firewall | >100 |
| login security | >100 |
| security | >100 |
Rating breakdown
★★★★★★★★★★ 5 from 1 reviews
About ZeroBot Security
From the official readme · v1.1.1Description
ZeroBot Security protects your site from the first minute, with no account and no setup.
Activate it and two protections start working inside WordPress itself.
Nothing is sent anywhere.
Free, no account needed
- Login Brute-Force Guard — Counts failed logins per IP and locks the IP out after 5 attempts
for 15 minutes (both adjustable). Blocks password-guessing bots on wp-login.php. - XML-RPC Kill Switch — Shuts down xmlrpc.php, the endpoint bots use to try hundreds of
passwords in one request and to abuse pingbacks. Skipped automatically when Jetpack is active,
because Jetpack needs it. - Attack counter — The dashboard shows how many failed logins, lockouts and XML-RPC requests
were stopped over the last 7 days. - Spoof-proof IP detection — Proxy headers are only trusted from real Cloudflare edges and
local reverse proxies, so attackers cannot fake their IP to dodge a lockout.
Network protection (free 7-day trial, then a ZeroBot plan)
Connect the site from the plugin dashboard: enter your email, confirm it, and the plugin activates
itself. The trial includes 100 IP checks and needs no credit card.
- Site-Wide Firewall — Switches on automatically when you connect. Every public request is
checked against IPs, VPNs, Tor nodes and datacenters seen attacking the ZeroBot network, with
optional country rules. If ZeroBot is slow to answer, the visitor is let through after 3 seconds. - Browser Fingerprint — Detects headless browsers, VMs and automation frameworks.
- Comment Guard — Blocks bot comments before they are saved.
- REST API Guard — Screens public REST calls, with configurable exempt routes.
- Shared blacklist — IPs locked out by the login guard are pushed to your ZeroBot blacklist
and blocked on every site you connect.
When a trial or plan ends, network protection pauses and the free protections keep running.
Full Platform Management
- Domain Rules — Create, edit, and delete antibot rules from inside wp-admin.
- Whitelist — IPs, CIDR ranges, and ASNs scoped per service. Bulk import supported.
- Blacklist — Same scoping and bulk import as the whitelist.
- Threat Logs — Filterable, paginated viewer of every traffic event with CSV export.
- Dashboard — Live stats, 7-day traffic chart, recent threats, account info.
Other Features
- Cloudflare and reverse-proxy IP detection that cannot be spoofed by visitors
- Decision cache via WordPress object cache (Redis/Memcached) with transient fallback
- Fail-open by default — never breaks your site if the API is unreachable
- Daily license verification via wp-cron
- WP-admin dashboard widget showing bots/humans (24h)
- Pure PHP + vanilla JS — no jQuery, no React, no external CDN
External Services
The free protections (login guard, XML-RPC kill switch) run entirely inside WordPress and
contact no external service. The plugin only contacts ZeroBot after the administrator either
submits the “Turn on network protection” form or enters a license key.
0. ZeroBot account signup (https://zerobot.info/v3/wp/connect)
- What it does: Creates a free ZeroBot trial account from inside wp-admin.
- When it’s called: Only when the administrator types an email, ticks the consent box and clicks
“Start free trial”. While the account waits for email confirmation, the open admin page checks
every 10 seconds whether it has been confirmed. - Data transmitted: The email address entered (it must belong to an administrator of the site),
this site’s domain and home URL, the plugin version and the server’s IP address. During signup
ZeroBot fetches a one-time confirmation from the site, including a keyed hash of that email.
ZeroBot then sends an activation email to that address. - What it returns: A one-time claim code, then the license key once the email is confirmed.
- Terms & Privacy: https://zerobot.info/terms — https://zerobot.info/policy
1. ZeroBot API (https://zerobot.info)
- What it does: Classifies visitors as human or bot, synchronizes domain rules / whitelists /
blacklists, and returns threat log data for the dashboard. - When it’s called: On every public request that one of the enabled protection layers handles
(Firewall, Page Protection, Login Guard, Comment Guard, REST API Guard). Also called from the
admin dashboard for stats, rules, lists, and traffic logs. Also called once per day by
wp-cron for license verification. - Data transmitted: Visitor IP address, user agent, current URL host, site domain, and the
plugin’s license key. No post content, no customer personal data, no form submissions. - What it returns: A JSON decision object (
is_bot,reason,risk_score, optional
captcha_html), plan metadata, and aggregate stats for the dashboard. - Terms & Privacy: https://zerobot.info/terms — https://zerobot.info/policy
2. ZeroBot Fingerprint Collector (https://zerobot.info/fingerprint/index.js)
- What it does: Collects client-side browser signals (canvas, WebGL, fonts, behavior) to detect
headless browsers, VMs, and automation frameworks. - When it’s loaded: Injected on public pages and the login screen ONLY when the administrator
enables “Browser Fingerprint” in Protection Settings. It is disabled by default; the plugin
does not load any external JavaScript out of the box. - Data transmitted: Browser fingerprint signals and the visitor’s IP address. No WordPress
user data, no cookies, no form data. - What it returns: A risk score used to decide whether a visitor should face a soft challenge.
- Terms & Privacy: https://zerobot.info/terms — https://zerobot.info/policy
3. FlagCDN (https://flagcdn.com)
- What it does: Serves tiny country-flag PNG images for the admin-only traffic log.
- When it’s loaded: Only inside wp-admin, only when the administrator opens the Dashboard or
Threat Logs page. It is never loaded on the public site. Only 2-letter ISO country codes are
transmitted as part of the image URL. - Data transmitted: The 2-letter country code and standard image-request metadata. No visitor
data, no WordPress data, no cookies. - Service homepage: https://flagcdn.com
If you do not wish to transmit any data to ZeroBot, do not connect the site. The free
protections keep working without any external connection.
Privacy
This plugin does not store visitor personal data in your WordPress database beyond IP
addresses in the local threat-log table (wp_zb_threats, dropped on uninstall). It does
not set any cookies on visitors. Data sent to the ZeroBot service is described in the
External Services section above.
Installation
- Install from Plugins → Add New (search “ZeroBot Security”), or upload the zip.
- Activate the plugin. Login protection and the XML-RPC kill switch are on right away.
- Optional: open ZeroBot → Dashboard and, under “Turn on network protection”, enter the email
of an administrator of this site and click “Start free trial” (7 days, 100 IP checks, no card).
Click the link in the activation email: the site connects and the firewall switches on.
Already have a ZeroBot license key? Paste it under ZeroBot → License. - Adjust the layers in ZeroBot → Protection.
No account is needed for the free protections.
Frequently asked questions
Do I need an account?
No. Login brute-force protection and the XML-RPC kill switch work right after activation, with no account and no data leaving your site. An account is only needed for network protection.
What happens when my trial ends?
Network protection pauses and the free protections keep running. If you activate a plan later, the plugin notices within a day (or immediately with “Check again”) and switches it back on.
I use Cloudflare or another proxy. Will lockouts hit the right IP?
Cloudflare and local reverse proxies (for example nginx in front of Apache) are detected automatically. Behind another CDN, enable “Trust proxy headers” in Protection Settings and check “Your detected IP” on the License page.
I use Jetpack. Is XML-RPC still blocked?
No. Jetpack connects to WordPress.com through XML-RPC, so the kill switch stands down while Jetpack is active. Login protection still runs.
Will this plugin break my site if the ZeroBot API is down?
No. The default Fail Mode is “Fail Open” — visitors are allowed through silently and the incident is logged to the PHP error log. You can switch to Fail Closed in Protection Settings if you prefer strict security.
How much does it call the ZeroBot API?
Every visitor decision is cached per-IP for 24 hours by default, so repeat visitors do not trigger additional API calls. A page that gets 1,000 hits/hour from returning visitors typically results in only a handful of API calls.
Does the fingerprint collector always run?
No. The fingerprint collector is disabled by default and only injects on the public site when the administrator turns on “Browser Fingerprint” under Protection Settings.
Does it work with WooCommerce?
Yes — the REST API Guard auto-exempts /wc/store/ routes. Add other custom routes to the exempt list as needed.
Does it support multisite?
Single-site only for now.
Changelog
In-plugin signup now requires the email of a site administrator.
1.1.1
- Security: a ZeroBot account can only be created from the plugin with the email of an
administrator of the site. ZeroBot also confirms this with the site during signup.
1.1.0
- New: free protection without an account. The Login Brute-Force Guard and the XML-RPC kill
switch now run as soon as the plugin is active. Previously every protection waited for a
license key, so new installs protected nothing. - New: create a ZeroBot trial account from inside wp-admin. Enter an email, confirm it, and
the plugin activates itself. Pasting an existing license key still works. - New: free dashboard with 7-day counts of failed logins, lockouts and blocked XML-RPC requests.
- New: when a plan or trial ends, network protection pauses with a clear notice and the free
layer keeps running. A daily check re-enables it automatically after renewal. - Security: visitor IP detection no longer trusts proxy headers sent by the visitor.
CF-Connecting-IP is only accepted from Cloudflare edges, and X-Real-IP / X-Forwarded-For
only from local reverse proxies or when “Trust proxy headers” is enabled. Forged headers
could previously bypass the login lockout or lock out someone else’s IP. The old default
of trusting all proxy headers is switched off on update. - Fix: a temporary API outage during the daily license check no longer switches network
protection off until the next day. - Fix: the XML-RPC kill switch stands down while Jetpack is active.
- Fix: a visitor flagged as a bot was kept blocked for 24 hours, even after being whitelisted.
Bot verdicts are now cached for 15 minutes, and whitelisting an IP from the plugin applies
immediately. - Change: the Site-Wide Firewall is on by default and switches on whenever a site is connected.
- Change: without a valid license, the network layers (firewall, browser fingerprint, comment
and REST API guards, shared blacklist) are shown off and cannot be switched on. - Fix: the firewall now gives up after 3 seconds with no retries if the API is slow (it could
previously hold a page for up to 24 seconds before failing open). - Fix: when the trial checks are used up or the plan ends, the firewall pauses its API calls for
an hour instead of calling on every page view, and the dashboard explains why. - Fix: the master protection switch is on for new installs. On update it is turned on only
for sites that never saved the settings page. - Tested with WordPress 7.1.
1.0.17
- New: searchable multi-country picker on the Protection Settings page.
Replaces the plain-text “Allowed Countries” input with a chip-based UI
that lists all 249 ISO countries with flag emoji, alphabetical search,
and a clear “Allow all / Only specific” mode toggle. - Fix: visitors blocked by country policy now correctly show a yellow
“Denied” badge on the Dashboard’s Recent Activity widget. They were
previously stacked into the red “Bot” bucket even though the block
reason was “Country Denied (XX)”. - Fix: country flags now render in both the Dashboard widget and the
Threat Logs table. The flag helper expects a 2-letter ISO code, but the
API ships the country as a name — so flags silently failed for every
row. A newHelpers::countryNameToCode()lookup resolves names to
codes, and the flag image renders before the country name on every
log row. - Change: removed the Score column from the Dashboard Recent Activity
widget and the Threat Logs table. The Reason already explains why a
request was flagged, and the numeric score added visual noise without
decision-relevant information. - Security: tightened the firewall verdict cache to bot-only. Clean
verdicts are no longer cached, so an IP that turns malicious mid-cache
doesn’t keep passing through for up to 24 hours. Bot verdicts continue
to be cached for instant re-blocking. - Compliance:
$_SERVER['REQUEST_URI']inXmlRpcGuard::register()is
now run throughwp_unslash()andsanitize_text_field()before the
regex match, clearing the two PHPCS warnings about that variable.
1.0.16
- Fix: critical error on every wp-admin page caused by a missing
License::isDomainAuthorized() method that theadmin_noticeshook called.
The method now exists on the License class, fails open when no
authorization state has been recorded yet, and gets set true/false by
activate() based on whether the auto domain-registration call to the
ZeroBot platform succeeded (HTTP 200) or reported the domain as already
registered (HTTP 409).
1.0.15
- WordPress.org review compliance: removed the broken
flagpedia.net/privacy
URL from the External Services section of readme.txt. - The chart-data bootstrap on the admin dashboard now ships via
wp_add_inline_script() attached to the existingzerobot-security-admin
handle, instead of an inline<script>tag. No behavioural change — the
same JS payload is delivered through the official WordPress enqueue API.
1.0.14
- WordPress.org review compliance: replaced the short “zb_” prefix everywhere
it appeared in PHP and JS (AJAX action names, option keys, transient keys,
nonce names, cron hooks, JS globals, custom DB table names, WP_Error codes,
and the admin script handle) with the full “zerobot_security_” prefix so
every plugin-defined identifier is at least the WP.org-required 4 characters
and is uniquely namespaced. - No functional or UI changes — the rename is purely cosmetic (CSS class
names beginning with “zb-” are stylesheet-internal and were left
unchanged, since they don’t conflict with WordPress core or other plugins).
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best ZeroBot Security alternatives
All antibot plugins →FAQ
ZeroBot Security: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 20, 2026
Is ZeroBot Security free?
Yes. ZeroBot Security is free to download and use from the official WordPress.org plugin directory.
Is ZeroBot Security safe to use in 2026?
ZeroBot Security is a solid plugin choice in 2026, with a few things worth checking first. Is rated 5/5 and was last updated 2 weeks ago, and scores 71/100 on our health check.
How many websites use ZeroBot Security?
ZeroBot Security is active on <10 WordPress websites and has been downloaded 1,378 times since it launched in May 2026. It was downloaded 1,109 times in the last 30 days.
Does ZeroBot Security work with WordPress 7.1?
Yes. The developer has tested ZeroBot Security up to WordPress 7.1.3, the latest release. It requires WordPress 5.8 or newer.
What PHP version does ZeroBot Security need?
ZeroBot Security requires PHP 7.4 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was ZeroBot Security last updated?
The latest version, 1.1.1, was released on October 6, 2026 (2 weeks ago).
Who makes ZeroBot Security?
ZeroBot Security is developed and maintained by ZeroBot.
What are the best alternatives to ZeroBot Security?
The most popular alternatives to ZeroBot Security are Spam Master (200+ installs), Good Question (100+ installs) and wk-email-antibot (40+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
