{"id":386415,"date":"2026-10-13T19:24:21","date_gmt":"2026-10-13T19:24:21","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/zaia-security\/"},"modified":"2026-10-17T14:04:49","modified_gmt":"2026-10-17T14:04:49","slug":"zaia-security","status":"publish","type":"plugin","link":"https:\/\/mg.wordpress.org\/plugins\/zaia-security\/","author":23400215,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.1","stable_tag":"1.0.1","tested":"7.1.3","requires":"6.0","requires_php":"7.4","requires_plugins":null,"header_name":"ZAIA Security","header_author":"NEWTIV","header_description":"Checks the context of every login, comment, order and REST API call with the ZAIA service: origin, device, replay, bots, credential stuffing. Works on top of existing WordPress accounts.","assets_banners_color":"","last_updated":"2026-10-17 14:04:49","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/zaia.newtiv.com","header_author_uri":"https:\/\/www.newtiv.com","rating":5,"author_block_rating":0,"active_installs":0,"downloads":172,"num_ratings":2,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"newtiv","date":"2026-10-13 19:24:10","revision":3744777},"1.0.1":{"tag":"1.0.1","author":"newtiv","date":"2026-10-17 14:04:49","revision":3751990}},"upgrade_notice":[],"ratings":{"1":0,"2":0,"3":0,"4":0,"5":2},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3744907,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3744907,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3744907,"resolution":false,"location":"assets","locale":false}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.0.1"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[166108,2439,602,600,286],"plugin_category":[38,45,54],"plugin_contributors":[286558],"plugin_business_model":[],"class_list":["post-386415","plugin","type-plugin","status-publish","hentry","plugin_tags-bot-protection","plugin_tags-brute-force","plugin_tags-login","plugin_tags-security","plugin_tags-woocommerce","plugin_category-authentication","plugin_category-ecommerce","plugin_category-security-and-spam-protection","plugin_contributors-newtiv","plugin_committers-newtiv"],"banners":[],"icons":{"svg":"https:\/\/ps.w.org\/zaia-security\/assets\/icon.svg?rev=3744907","icon":"https:\/\/ps.w.org\/zaia-security\/assets\/icon.svg?rev=3744907","icon_2x":false,"generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>ZAIA Security connects your site to <a href=\"https:\/\/zaia.newtiv.com\">ZAIA<\/a>, a request-context verification service run by NEWTIV. It does not replace WordPress accounts: for every sensitive action, it checks that the request really comes from your site, from the same device, and that the behaviour stays plausible.<\/p>\n\n<p><strong>Actions checked<\/strong> (your choice):<\/p>\n\n<ul>\n<li>login (wp-login.php and WooCommerce), registration, lost password;<\/li>\n<li>comments;<\/li>\n<li>REST API writes from the browser (block editor, admin);<\/li>\n<li>WooCommerce checkout.<\/li>\n<\/ul>\n\n<p><strong>Passwordless sign-in for visitors<\/strong> (optional): \u00ab Continue with Google \u00bb or a code received by email, through the ZAIA sign-in page. In Settings \u2192 ZAIA you choose the page where it appears, the format (inside the page, in a window, or full page) and its appearance (colour, corner radius, light or dark mode), with a preview, no code needed. Accounts stay in WordPress: an existing account is found by its verified email address, and, if you enable it and your site allows registration, a new account is created with the Subscriber role (Customer with WooCommerce) once ZAIA has verified the email address. Sign-in goes through wp_signon(), so other security plugins still apply. Visitor accounts never see the WordPress dashboard.<\/p>\n\n<p><strong>What ZAIA detects<\/strong>: bots and scripts, credential stuffing, replay of captured requests, stolen sessions reused elsewhere, bursts of requests, impossible country changes. Addresses that pile up alerts are quarantined automatically.<\/p>\n\n<p><strong>Safe for your site<\/strong>:<\/p>\n\n<ul>\n<li><strong>observation<\/strong> mode on install: everything is checked and logged in the ZAIA console, nothing is blocked;<\/li>\n<li>if ZAIA does not respond, the site keeps working (configurable);<\/li>\n<li>application passwords, WP-CLI, cron and server integrations are never affected.<\/li>\n<\/ul>\n\n<p>The plugin is ready for translation through translate.wordpress.org.<\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin relies on the ZAIA service (https:\/\/zaia.newtiv.com), operated by NEWTIV (Abidjan, C\u00f4te d'Ivoire). Nothing is sent until an administrator enters a ZAIA application identifier and server key in Settings \u2192 ZAIA.<\/p>\n\n<p>What is sent, and when:<\/p>\n\n<ul>\n<li><strong>From the visitor's browser<\/strong> (only on the forms you choose to protect, and on the sign-in page you enable): the ZAIA client script, bundled with the plugin, opens a session with https:\/\/zaia.newtiv.com\/v1\/handshake\/ and adds ZAIA headers to the form. ZAIA receives the browser's IP address, user agent, page origin and, if available, screen size, time zone and language.<\/li>\n<li><strong>From your server<\/strong>, when a protected form is submitted: a verification request to https:\/\/zaia.newtiv.com\/v1\/verify with the session headers, the visitor's IP address and user agent. For a signed-in user, a technical identifier <code>wp:&lt;user number&gt;<\/code> is sent to https:\/\/zaia.newtiv.com\/v1\/users\/grant. Passwords, content and order data are never sent.<\/li>\n<li><strong>Passwordless sign-in<\/strong> (only if enabled): the visitor uses the ZAIA sign-in page (https:\/\/zaia.newtiv.com\/login\/), shown in your page, in a window or full page. After sign-in, your server exchanges a one-time code at https:\/\/zaia.newtiv.com\/v1\/connect\/token and receives the visitor's identifier, email address and name.<\/li>\n<li><strong>Configuration test<\/strong> (the \u00ab Test \u00bb button in Settings \u2192 ZAIA): https:\/\/zaia.newtiv.com\/v1\/app returns the application's settings.<\/li>\n<\/ul>\n\n<p>The service: <a href=\"https:\/\/zaia.newtiv.com\/conditions\">Terms of use<\/a> \u00b7 <a href=\"https:\/\/zaia.newtiv.com\/confidentialite\">Privacy policy<\/a> \u00b7 <a href=\"https:\/\/zaia.newtiv.com\/statut\">Service status<\/a>.<\/p>\n\n<p>ZAIA offers a free plan (100,000 requests per month per application) and a custom Enterprise plan on quote. Every feature of this plugin works with the free plan.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Create a free account on the <a href=\"https:\/\/zaia.newtiv.com\/console\/\">ZAIA console<\/a> and an application.<\/li>\n<li>In the application: <strong>Origins<\/strong> tab, add your site address (<code>https:\/\/your-site.com<\/code>); <strong>Authentication<\/strong> tab, enable <strong>public access<\/strong> (for signed-out visitors).<\/li>\n<li>In WordPress: <strong>Settings \u2192 ZAIA<\/strong>, paste the public identifier (<code>app_\u2026<\/code>) and the server key (<code>zsk_\u2026<\/code>), or define the key in <code>wp-config.php<\/code>: <code>define('ZAIA_SERVER_KEY', 'zsk_\u2026');<\/code><\/li>\n<li>Click <strong>Test<\/strong>: the plugin checks the key, the origin and public access.<\/li>\n<li>Watch the ZAIA console <strong>Log<\/strong> for a few days, then switch to <strong>Enforce<\/strong> mode.<\/li>\n<li>Passwordless sign-in (optional): in the ZAIA console, <strong>Sign-in<\/strong> tab, enable hosted sign-in, choose the methods and declare the return address shown in Settings \u2192 ZAIA. Then, in Settings \u2192 ZAIA, tick the visitor sign-in option and choose the page, format and appearance.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"my%20site%20is%20behind%20cloudflare\"><h3>My site is behind Cloudflare<\/h3><\/dt>\n<dd><p>Settings \u2192 ZAIA \u2192 Visitor IP address: choose \u00ab Behind Cloudflare \u00bb. Otherwise ZAIA would see Cloudflare's address instead of the visitor's.<\/p><\/dd>\n<dt id=\"are%20cached%20pages%20checked%3F\"><h3>Are cached pages checked?<\/h3><\/dt>\n<dd><p>Page views are not checked (and can stay cached): only actions are. The ZAIA proof is added when the form is submitted.<\/p><\/dd>\n<dt id=\"what%20happens%20when%20zaia%20asks%20for%20an%20extra%20verification%3F\"><h3>What happens when ZAIA asks for an extra verification?<\/h3><\/dt>\n<dd><p>WordPress has no built-in two-factor authentication, so you choose: let the request through (default) or refuse it.<\/p><\/dd>\n<dt id=\"where%20does%20the%20sign-in%20appear%3F\"><h3>Where does the sign-in appear?<\/h3><\/dt>\n<dd><p>On the page chosen in Settings \u2192 ZAIA (above or below its content), or wherever you place the <code>[zaia_login]<\/code> shortcode. Shortcode options: <code>display=\"inline|modal|page\"<\/code>, <code>accent=\"#0a4fa3\"<\/code>, <code>radius=\"8\"<\/code>, <code>mode=\"light|dark|auto\"<\/code>, <code>label<\/code>, <code>redirect<\/code>, <code>account<\/code>, <code>logout=\"0\"<\/code>. It is also offered on the WooCommerce \u00ab My account \u00bb page. The button on wp-login.php (admin login) is off by default.<\/p><\/dd>\n<dt id=\"can%20i%20adjust%20a%20decision%3F\"><h3>Can I adjust a decision?<\/h3><\/dt>\n<dd><p>Filter <code>zaia_security_decision( $result, $action )<\/code>: for example to always let certain addresses through.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Sign-in with ZAIA (Google, email code): an unknown address now gets an account by default, with the Subscriber role (Customer with WooCommerce) and only once ZAIA has verified the email. It no longer depends on \u00ab Anyone can register \u00bb, so sites with their own sign-up form work too. The option can still be turned off, and the <code>zaia_security_create_account<\/code> filter decides case by case.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>First release: verification of login, registration, lost password, comments, REST API and WooCommerce checkout; passwordless sign-in for visitors (Google, email code) placed and styled from Settings \u2192 ZAIA; observation mode; configuration test.<\/li>\n<\/ul>","raw_excerpt":"Checks the context of every login, comment, order and REST API call: origin, device, replay, bots, credential stuffing.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/386415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=386415"}],"author":[{"embeddable":true,"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/newtiv"}],"wp:attachment":[{"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=386415"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=386415"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=386415"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=386415"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=386415"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=386415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}