Folder Guard — Protected By ZeroBot

What is Folder Guard?

Folder Guard is a small PHP package you drop onto your own server.
Once a folder is protected, every request to it is checked against your ZeroBot account before the page loads — so bots are stopped while real visitors pass through untouched.

It connects to your existing ZeroBot account with your license key, so your whitelist, blacklist, traffic logs and settings stay in sync with your main dashboard.
Nothing is stored with a third party.

How protection works

When a visitor opens a protected folder, the guard runs before your page and asks ZeroBot whether the request is a bot or a human, then applies your chosen rule:

• It loads automatically on every request inside a protected folder (via .user.ini or .htaccess).
• Each request is decided live against your ZeroBot account — no stale caching.
• It is fail-open by design: if ZeroBot is ever unreachable, your site keeps working normally.
• Every visit is logged to your account, so it appears in both the package and your main ZeroBot dashboard.

Requirements

• PHP 8.1 or newer.
• Apache (mod_php), or PHP-FPM / FastCGI / LiteSpeed — the package configures both automatically.
• An active ZeroBot license key (found in your dashboard under Profile).
• A free domain slot on your plan.
  Folder Guard authorizes your domain automatically, and that uses one of your plan's domain slots.

Domain authorization

When you first connect Folder Guard it authorizes your domain automatically, as long as a plan slot is free.
It only adds the domain at connect time — so if you later remove it from your dashboard the guard respects that: it stops protecting and shows a clear «not protected» warning instead of silently adding it back.

Authorizing a domain uses one of your plan's domain slots.
If no slot is free, the domain can't be authorized — and until it is, Folder Guard can't protect your folders and visitors are simply let through.
Free a slot by removing an unused domain in your dashboard, or upgrade your plan to add more.

Install in 4 steps

No code or command line required — just upload and open it in your browser.

Protecting a folder

Open the Protected Folders tab, enter the absolute path of the folder you want to guard (the field is pre-filled with your web root), and click Protect folder.
The guard activates immediately on Apache, and within about five minutes on PHP-FPM.

What Folder Guard protects — and what it can't

Folder Guard works at the PHP layer: every request that runs PHP inside a protected folder is checked before your page loads.
Since v1.3.0 it can also route static files through PHP, so pages and text assets are covered too.

Folder Guard protects

• PHP pages and scripts inside a protected folder — index.php, contact.php, admin panels, member areas, any .php file.
• Static pages (.html, .htm) by default, plus optional text assets (.css, .js, .json, .xml, .svg, .txt) you enable under Settings → Protected extensions — each is served with its correct content type.
• The visitor is blocked, challenged or logged before any content is sent, and allowed HTML pages carry the badge and fingerprint script.
  Protected static files are sent with no-store so browsers never keep a copy that could bypass the guard.

Folder Guard does not protect

• Images and other binary files — pictures, PDFs, videos, fonts and downloads.
  They cannot be routed through PHP safely, so the guard never runs for them.
• Static types you have not enabled — only .html and .htm are covered by default; other text assets stay unprotected until you switch them on in Protected extensions.
• PHP files outside the protected folder, or hosts where the auto-prepend mechanism could not be enabled.
  Static-file routing additionally needs Apache or LiteSpeed — on pure PHP-FPM/nginx use Include Mode, which covers .php only.
• Copies already stored by a CDN before protection was enabled — the guard decides at request time on your server, so purge your CDN cache after protecting a folder.

Protection rules

In Settings you decide, separately, what happens to bots and to real humans:

When a bot is detected

• Block — show a clean "access denied" page.
• Challenge — present the ZeroBot slider captcha; solving it lets the visitor through.
• Redirect — send the visitor to a URL of your choice.
• Log only — record the visit but do not block (great for testing).

When a real human visits

• Do nothing — let them straight through (the default).
• Challenge — ask even humans to pass the captcha.
• Block — deny everyone (useful to fully close a folder).
• Redirect — send humans to another URL.

The ZeroBot captcha

When the challenge rule is active, suspected bots see the genuine ZeroBot slider captcha.
Once a visitor solves it, they get a short-lived pass and are not challenged again — exactly the same captcha used across the ZeroBot platform.

Device fingerprint (optional)

You can enable the ZeroBot device-fingerprint script from Settings.
It collects 40+ browser signals (canvas, WebGL, audio, timezone and more) on protected pages to score each visitor.
A clean visitor passes untouched; a moderate-risk one is shown a quick captcha to prove they are human; a high-risk one is blocked automatically — no extra rule needed.

Whitelist & Blacklist

Allow or block specific IPs straight from the package.
Because it is synced with your ZeroBot account, every change applies everywhere your account protects — and shows up in your main dashboard too.

Traffic & Logs

The Traffic tab shows live verdicts for every request, exactly like your main dashboard:

• IP, status (bot or human), the page that was visited, browser, OS and country.
• Filter by page, paginate through the history, and clear the log when you want.
• An Activity Log records every whitelist and blacklist change you make.
• Turn on Remove duplicates to count each visitor once per folder — a page plus its assets (.css, .js) and quick reloads from the same IP collapse into a single visitor, and assets are grouped under their page instead of each appearing as its own row.

Turning protection on & off

A single switch in Settings pauses or resumes protection across every folder at once, without removing your configuration.
When off, every visitor is simply let through — handy for maintenance.
Protection only actually runs while your domain is authorized: if it is not, the Settings card reads «ON, but not protecting» and every protected page shows a small «Protection Off» notice until you authorize the domain.

Troubleshooting

If a protected folder still lets visitors through, check these four points.
They cover the handful of setups where activation needs a small nudge.

It only protects PHP requests

Folder Guard runs through PHP's auto_prepend_file, so it activates only on requests that PHP handles.
Static .html pages, images, or a folder served without PHP are not protected.
Point it at the folder that runs your PHP app, or add it to that app's entry point.

cPanel / LiteSpeed activation

On LiteSpeed the setting lives in .user.ini and is cached for about 5 minutes, so it is not instant.
Changing your PHP version in Select PHP Version forces a fresh read.
If it still does not activate, your host may not honor .user.ini or .htaccess php_value at all.
Enable the htscanner PHP extension under Select PHP Version and Extensions to make it work.
Keep the curl extension enabled too, because Folder Guard uses it to reach the API.

Bots get through but appear in the logs

That means the bot action is set to Log, which records bots without stopping them.
Open Settings and set the bot action to Block, or Challenge, to actually stop them.

Connected in the dashboard, but nothing is logged

Protection reads your license from a file named .env.php inside the install folder, not from .env.example, which is only a sample and should never be edited.
The dashboard can still look connected from your browser session even when this file is missing.
If you moved or renamed the install folder, just open Settings once and Folder Guard re-saves the license automatically.

Thank You

Need a hand?
Reach us on our Telegram channel or at support@zerobot.info — we're happy to help you get set up.