xZeroProtect

xZeroProtect brings the power of the xZeroProtect PHP library to WordPress with a clean admin dashboard. The plugin source is available at github.com/webrium/xzeroprotect-wp.

What it does:

• Blocks bots, scanners, and common web attacks (SQLi, XSS, path traversal, command injection)
• Rate-limits IPs and automatically bans repeat offenders
• Verifies legitimate crawlers (Googlebot, Bingbot) via double-DNS — they’re never blocked
• Tracks real visitor analytics — bot traffic is already filtered out before anything is recorded
• Shows unique visitors, top pages, device breakdown, and block reasons in a dashboard
• Zero external dependencies — no Redis, no external API, everything on disk and in your database

Dashboard includes:

• Traffic overview chart (visits, unique visitors, blocked)
• Top pages by hits and unique visitors
• Device breakdown (desktop / mobile / tablet)
• Block reason breakdown
• Real visitor log with browser, OS, and device info
• Blocked request log with attack type and reason

Privacy Policy

xZeroProtect stores visitor data (IP address, browser, OS, device type) and blocked request data locally in your WordPress database. No data is transmitted to external servers. All stored data is automatically deleted after the configured retention period (default: 30 days). All data is permanently removed when the plugin is uninstalled.