Integrationen → WordPress
ZeroBot Security — WordPress-Plugin
Antibot, Firewall, Captcha und Threat Intelligence direkt im wp-admin. Sechs Schutz-Layer, ein Dashboard, kein Code.
Installation
- Im wp-admin: Plugins → Installieren öffnen, nach "ZeroBot Security" suchen, Jetzt installieren → Aktivieren. Login-Schutz und die XML-RPC-Sperre laufen sofort, kostenlos und ohne Konto.
- Für den Netzwerk-Schutz ZeroBot → Dashboard öffnen, die E-Mail eines Administrators dieser WordPress-Seite eingeben, die Zustimmung ankreuzen und auf "Kostenlos testen" klicken (7 Tage, 100 IP-Prüfungen, keine Karte).
- Auf den Link in der Aktivierungs-E-Mail klicken. Das Plugin verbindet sich selbst, registriert deine Domain und schaltet die Site-Wide Firewall ein.
- Du hast schon ein ZeroBot-Konto? Füge stattdessen den Lizenzschlüssel unter ZeroBot → Lizenz ein. Die einzelnen Layer stellst du unter ZeroBot → Schutz ein.
Sechs Schutz-Layer
Login-Schutz und XML-RPC-Sperre sind kostenlos und von Anfang an aktiv. Die Site-Wide Firewall startet automatisch, sobald die Seite verbunden ist; die übrigen Netzwerk-Layer lassen sich mit gültiger Lizenz unter ZeroBot → Schutz einschalten.
| Layer | What it does |
|---|---|
| Firewall | Site-wide screening of every public request. Blocks bots on page load before PHP does any work. |
| Page Protection | Per-URL antibot with captcha fallback for borderline traffic (Cloudflare Turnstile or ZeroBot native slider). |
| Login Guard | Rate-limits failed logins per IP, auto-blacklists offenders, screens login IPs against the ZeroBot blacklist. |
| Comment Guard | Rejects spam comments before they're saved to the DB. |
| REST API Guard | Screens public REST calls. Auto-exempts WooCommerce Store API and ZeroBot's own routes. |
| XML-RPC Guard | Disables XML-RPC (or screens it per-request). A top brute-force attack vector. |
Einstellungs-Referenz
| Setting | Default | Notes |
|---|---|---|
| Master switch | On | Turns every protection layer on/off globally. |
| Site-Wide Firewall | On once connected | Switches on automatically when the site connects to ZeroBot. Locked off while there is no valid license. If ZeroBot is slow to answer, the visitor is let through after 3 seconds. |
| Allowed countries | all | ISO 2-letter codes, comma-separated. Non-matching visitors are blocked with reason Country Denied. Enforced server-side. |
| Firewall exempt paths | (empty) | One path per line. Any URL matching any line skips the firewall (useful for webhooks, health checks). |
| Fail mode | Fail-open | When the API is unreachable: open lets traffic through, closed returns 503. Switch to closed only if you'd rather block than risk a bot getting through. |
| Login max attempts / block minutes | 5 / 15 | Threshold and cooldown for the Login Guard. |
| Browser fingerprint | Off | Injects the fingerprint collector on every front-end page. Detects headless browsers & automation. Off by default because it's the only layer that loads external JS. |
Dashboard & Logs
- Dashboard — license status, 24h / 7d stats, recent-threat table scoped to this site only.
- Threat Logs — filterable viewer of every
/v3/openapidecision for this site. CSV export, one-click whitelist/blacklist action per row. - Whitelist / Blacklist — IPs, CIDR ranges, ASNs. Scoped to
service=all— covers antibot, hosting, shortener, redirection at once.
Fehlerbehebung
- "The plugin doesn't seem to block anyone."
- Check the master switch AND the specific protection toggle are both on. Open an incognito window — if you're logged in as admin, the Firewall skips you by design. Bots coming from datacenters or known-bad IPs will be blocked; residential visitors are correctly allowed through.
- "I was blocked and whitelisted my IP, but I'm still blocked."
- The plugin remembers a bot verdict for 15 minutes. Whitelisting from the plugin's Whitelist page clears it at once; whitelisting from the ZeroBot dashboard reaches the site within 15 minutes. Clear Cache in Protection Settings also forces a fresh check.
- "Domain not authorized" banner at the top of wp-admin.
- Your domain was removed from the ZeroBot Authorized Domains list (or the license was deactivated). Click Authorize this domain in the banner — it re-registers this site instantly.
- "I want to see every visit logged for debugging."
- The plugin de-duplicates per IP for 24h by design. For full verbose logging, contact support to enable per-request logging temporarily on your account.
Lieber die rohe API?
Wenn du ein eigenes Theme fährst oder die API ohne WordPress nutzen willst, siehe die Guides PHP, Node.js, Python oder cURL/REST. Das WordPress-Plugin ist nur ein Wrapper um /v3/openapi, /v3/antibot und /v3/account/*.