Integrazioni → WordPress

ZeroBot Security — plugin WordPress

Antibot, firewall, captcha e threat intelligence nel tuo wp-admin. Sei layer di protezione, una dashboard, zero codice.

Installazione

In wp-admin: apri Plugin → Aggiungi nuovo, cerca "ZeroBot Security", clicca Installa → Attiva. Tutti i download passano per WordPress.org — niente zip di terze parti.
Vai su ZeroBot → Licenza e incolla la tua chiave (dalla dashboard ZeroBot).
Il tuo dominio viene registrato automaticamente quando attivi la licenza. Nessun passo manuale.
Apri ZeroBot → Impostazioni di protezione, attiva l'interruttore principale e i layer che vuoi.

Sei layer di protezione

Ogni layer è disattivato di default. Attivali da ZeroBot → Impostazioni di protezione, oltre all'interruttore principale.

Layer	What it does
Firewall	Site-wide screening of every public request. Blocks bots on page load before PHP does any work.
Page Protection	Per-URL antibot with captcha fallback for borderline traffic (Cloudflare Turnstile or ZeroBot native slider).
Login Guard	Rate-limits failed logins per IP, auto-blacklists offenders, screens login IPs against the ZeroBot blacklist.
Comment Guard	Rejects spam comments before they're saved to the DB.
REST API Guard	Screens public REST calls. Auto-exempts WooCommerce Store API and ZeroBot's own routes.
XML-RPC Guard	Disables XML-RPC (or screens it per-request). A top brute-force attack vector.

Riferimento impostazioni

Setting	Default	Notes
Master switch	Off	Turns every protection layer on/off globally. Leave it off while you configure, flip on to go live.
Allowed countries	`all`	ISO 2-letter codes, comma-separated. Non-matching visitors are blocked with reason `Country Denied`. Enforced server-side.
Firewall exempt paths	(empty)	One path per line. Any URL matching any line skips the firewall (useful for webhooks, health checks).
Fail mode	Fail-open	When the API is unreachable: open lets traffic through, closed returns 503. Switch to closed only if you'd rather block than risk a bot getting through.
Login max attempts / block minutes	5 / 15	Threshold and cooldown for the Login Guard.
Browser fingerprint	Off	Injects the fingerprint collector on every front-end page. Detects headless browsers & automation. Off by default because it's the only layer that loads external JS.

Dashboard e log

Dashboard — license status, 24h / 7d stats, recent-threat table scoped to this site only.
Threat Logs — filterable viewer of every /v3/openapi decision for this site. CSV export, one-click whitelist/blacklist action per row.
Whitelist / Blacklist — IPs, CIDR ranges, ASNs. Scoped to service=all — covers antibot, hosting, shortener, redirection at once.

Risoluzione dei problemi

"The plugin doesn't seem to block anyone.": Check the master switch AND the specific protection toggle are both on. Open an incognito window — if you're logged in as admin, the Firewall skips you by design. Bots coming from datacenters or known-bad IPs will be blocked; residential visitors are correctly allowed through.
"My IP shows up once then never again.": The 24-hour per-IP decision cache. Click Clear Cache in Protection Settings to force a re-check on your next visit.
"Domain not authorized" banner at the top of wp-admin.: Your domain was removed from the ZeroBot Authorized Domains list (or the license was deactivated). Click Authorize this domain in the banner — it re-registers this site instantly.
"I want to see every visit logged for debugging.": The plugin de-duplicates per IP for 24h by design. For full verbose logging, contact support to enable per-request logging temporarily on your account.

Preferisci l'API grezza?

Se usi un tema custom o vuoi l'API fuori da WordPress, consulta le guide PHP, Node.js, Python o cURL/REST. Il plugin WordPress è solo un wrapper su /v3/openapi, /v3/antibot e /v3/account/*.