{"id":386415,"date":"2026-10-13T19:24:21","date_gmt":"2026-10-13T19:24:21","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/zaia-security\/"},"modified":"2026-10-13T19:24:10","modified_gmt":"2026-10-13T19:24:10","slug":"zaia-security","status":"publish","type":"plugin","link":"https:\/\/ja.wordpress.org\/plugins\/zaia-security\/","author":23400215,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.0","stable_tag":"1.0.0","tested":"7.1.3","requires":"6.0","requires_php":"7.4","requires_plugins":null,"header_name":"ZAIA Security","header_author":"NEWTIV","header_description":"Checks the context of every login, comment, order and REST API call with the ZAIA service: origin, device, replay, bots, credential stuffing. Works on top of existing WordPress accounts.","assets_banners_color":"","last_updated":"2026-10-13 19:24:10","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/zaia.newtiv.com","header_author_uri":"https:\/\/www.newtiv.com","rating":5,"author_block_rating":0,"active_installs":0,"downloads":58,"num_ratings":1,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"newtiv","date":"2026-10-13 19:24:10","revision":3744777}},"upgrade_notice":[],"ratings":{"1":0,"2":0,"3":0,"4":0,"5":1},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3744907,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3744907,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3744907,"resolution":false,"location":"assets","locale":false}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[166108,2439,602,600,286],"plugin_category":[38,45,54],"plugin_contributors":[286558],"plugin_business_model":[],"class_list":["post-386415","plugin","type-plugin","status-publish","hentry","plugin_tags-bot-protection","plugin_tags-brute-force","plugin_tags-login","plugin_tags-security","plugin_tags-woocommerce","plugin_category-authentication","plugin_category-ecommerce","plugin_category-security-and-spam-protection","plugin_contributors-newtiv","plugin_committers-newtiv"],"banners":[],"icons":{"svg":"https:\/\/ps.w.org\/zaia-security\/assets\/icon.svg?rev=3744907","icon":"https:\/\/ps.w.org\/zaia-security\/assets\/icon.svg?rev=3744907","icon_2x":false,"generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>ZAIA Security connects your site to <a href=\"https:\/\/zaia.newtiv.com\">ZAIA<\/a>, a request-context verification service run by NEWTIV. It does not replace WordPress accounts: for every sensitive action, it checks that the request really comes from your site, from the same device, and that the behaviour stays plausible.<\/p>\n\n<p><strong>Actions checked<\/strong> (your choice):<\/p>\n\n<ul>\n<li>login (wp-login.php and WooCommerce), registration, lost password;<\/li>\n<li>comments;<\/li>\n<li>REST API writes from the browser (block editor, admin);<\/li>\n<li>WooCommerce checkout.<\/li>\n<\/ul>\n\n<p><strong>Passwordless sign-in for visitors<\/strong> (optional): \u00ab Continue with Google \u00bb or a code received by email, through the ZAIA sign-in page. In Settings \u2192 ZAIA you choose the page where it appears, the format (inside the page, in a window, or full page) and its appearance (colour, corner radius, light or dark mode), with a preview, no code needed. Accounts stay in WordPress: an existing account is found by its verified email address, and, if you enable it and your site allows registration, a new account is created with the Subscriber role (Customer with WooCommerce) once ZAIA has verified the email address. Sign-in goes through wp_signon(), so other security plugins still apply. Visitor accounts never see the WordPress dashboard.<\/p>\n\n<p><strong>What ZAIA detects<\/strong>: bots and scripts, credential stuffing, replay of captured requests, stolen sessions reused elsewhere, bursts of requests, impossible country changes. Addresses that pile up alerts are quarantined automatically.<\/p>\n\n<p><strong>Safe for your site<\/strong>:<\/p>\n\n<ul>\n<li><strong>observation<\/strong> mode on install: everything is checked and logged in the ZAIA console, nothing is blocked;<\/li>\n<li>if ZAIA does not respond, the site keeps working (configurable);<\/li>\n<li>application passwords, WP-CLI, cron and server integrations are never affected.<\/li>\n<\/ul>\n\n<p>The plugin is ready for translation through translate.wordpress.org.<\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin relies on the ZAIA service (https:\/\/zaia.newtiv.com), operated by NEWTIV (Abidjan, C\u00f4te d'Ivoire). Nothing is sent until an administrator enters a ZAIA application identifier and server key in Settings \u2192 ZAIA.<\/p>\n\n<p>What is sent, and when:<\/p>\n\n<ul>\n<li><strong>From the visitor's browser<\/strong> (only on the forms you choose to protect, and on the sign-in page you enable): the ZAIA client script, bundled with the plugin, opens a session with https:\/\/zaia.newtiv.com\/v1\/handshake\/ and adds ZAIA headers to the form. ZAIA receives the browser's IP address, user agent, page origin and, if available, screen size, time zone and language.<\/li>\n<li><strong>From your server<\/strong>, when a protected form is submitted: a verification request to https:\/\/zaia.newtiv.com\/v1\/verify with the session headers, the visitor's IP address and user agent. For a signed-in user, a technical identifier <code>wp:&lt;user number&gt;<\/code> is sent to https:\/\/zaia.newtiv.com\/v1\/users\/grant. Passwords, content and order data are never sent.<\/li>\n<li><strong>Passwordless sign-in<\/strong> (only if enabled): the visitor uses the ZAIA sign-in page (https:\/\/zaia.newtiv.com\/login\/), shown in your page, in a window or full page. After sign-in, your server exchanges a one-time code at https:\/\/zaia.newtiv.com\/v1\/connect\/token and receives the visitor's identifier, email address and name.<\/li>\n<li><strong>Configuration test<\/strong> (the \u00ab Test \u00bb button in Settings \u2192 ZAIA): https:\/\/zaia.newtiv.com\/v1\/app returns the application's settings.<\/li>\n<\/ul>\n\n<p>The service: <a href=\"https:\/\/zaia.newtiv.com\/conditions\">Terms of use<\/a> \u00b7 <a href=\"https:\/\/zaia.newtiv.com\/confidentialite\">Privacy policy<\/a> \u00b7 <a href=\"https:\/\/zaia.newtiv.com\/statut\">Service status<\/a>.<\/p>\n\n<p>ZAIA offers a free plan (100,000 requests per month per application) and a custom Enterprise plan on quote. Every feature of this plugin works with the free plan.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Create a free account on the <a href=\"https:\/\/zaia.newtiv.com\/console\/\">ZAIA console<\/a> and an application.<\/li>\n<li>In the application: <strong>Origins<\/strong> tab, add your site address (<code>https:\/\/your-site.com<\/code>); <strong>Authentication<\/strong> tab, enable <strong>public access<\/strong> (for signed-out visitors).<\/li>\n<li>In WordPress: <strong>Settings \u2192 ZAIA<\/strong>, paste the public identifier (<code>app_\u2026<\/code>) and the server key (<code>zsk_\u2026<\/code>), or define the key in <code>wp-config.php<\/code>: <code>define('ZAIA_SERVER_KEY', 'zsk_\u2026');<\/code><\/li>\n<li>Click <strong>Test<\/strong>: the plugin checks the key, the origin and public access.<\/li>\n<li>Watch the ZAIA console <strong>Log<\/strong> for a few days, then switch to <strong>Enforce<\/strong> mode.<\/li>\n<li>Passwordless sign-in (optional): in the ZAIA console, <strong>Sign-in<\/strong> tab, enable hosted sign-in, choose the methods and declare the return address shown in Settings \u2192 ZAIA. Then, in Settings \u2192 ZAIA, tick the visitor sign-in option and choose the page, format and appearance.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"my%20site%20is%20behind%20cloudflare\"><h3>My site is behind Cloudflare<\/h3><\/dt>\n<dd><p>Settings \u2192 ZAIA \u2192 Visitor IP address: choose \u00ab Behind Cloudflare \u00bb. Otherwise ZAIA would see Cloudflare's address instead of the visitor's.<\/p><\/dd>\n<dt id=\"are%20cached%20pages%20checked%3F\"><h3>Are cached pages checked?<\/h3><\/dt>\n<dd><p>Page views are not checked (and can stay cached): only actions are. The ZAIA proof is added when the form is submitted.<\/p><\/dd>\n<dt id=\"what%20happens%20when%20zaia%20asks%20for%20an%20extra%20verification%3F\"><h3>What happens when ZAIA asks for an extra verification?<\/h3><\/dt>\n<dd><p>WordPress has no built-in two-factor authentication, so you choose: let the request through (default) or refuse it.<\/p><\/dd>\n<dt id=\"where%20does%20the%20sign-in%20appear%3F\"><h3>Where does the sign-in appear?<\/h3><\/dt>\n<dd><p>On the page chosen in Settings \u2192 ZAIA (above or below its content), or wherever you place the <code>[zaia_login]<\/code> shortcode. Shortcode options: <code>display=\"inline|modal|page\"<\/code>, <code>accent=\"#0a4fa3\"<\/code>, <code>radius=\"8\"<\/code>, <code>mode=\"light|dark|auto\"<\/code>, <code>label<\/code>, <code>redirect<\/code>, <code>account<\/code>, <code>logout=\"0\"<\/code>. It is also offered on the WooCommerce \u00ab My account \u00bb page. The button on wp-login.php (admin login) is off by default.<\/p><\/dd>\n<dt id=\"can%20i%20adjust%20a%20decision%3F\"><h3>Can I adjust a decision?<\/h3><\/dt>\n<dd><p>Filter <code>zaia_security_decision( $result, $action )<\/code>: for example to always let certain addresses through.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>First release: verification of login, registration, lost password, comments, REST API and WooCommerce checkout; passwordless sign-in for visitors (Google, email code) placed and styled from Settings \u2192 ZAIA; observation mode; configuration test.<\/li>\n<\/ul>","raw_excerpt":"Checks the context of every login, comment, order and REST API call: origin, device, replay, bots, credential stuffing.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ja.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/386415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ja.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/ja.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/ja.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=386415"}],"author":[{"embeddable":true,"href":"https:\/\/ja.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/newtiv"}],"wp:attachment":[{"href":"https:\/\/ja.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=386415"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/ja.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=386415"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/ja.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=386415"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/ja.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=386415"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/ja.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=386415"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/ja.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=386415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}