WordPress runs a huge share of the web, and that popularity cuts both ways: it also makes WordPress the single most-scanned CMS on the internet. Every hour, bots are quietly probing for wp-config.php.bak, hammering xmlrpc.php, trying default admin paths, and stuffing SQL injection attempts into every form field they can find. WordPress core has no real answer to any of this — it assumes your host, your security plugin, or sheer luck is handling it. xZeroProtect is a plugin built specifically to close that gap, as a firewall layer that sits in front of every request before WordPress even starts routing it.
What you get after activating it
Once active, xZeroProtect starts checking every request against a set of detection rules: known scanner and exploit-tool User-Agents, paths that only exist on vulnerable installs or exposed config/backup files, SQL injection and XSS signatures in GET/POST/cookie data, and a rate limit that catches anything hammering your site faster than a human ever would. Anything that trips a rule gets blocked and logged; repeat offenders get auto-banned, with the ban escalating the more times an IP comes back.
All of this shows up in a plugin dashboard with two pages that matter most day to day:
- Blocked Requests: a live log of every attack attempt with its type, reason, and full User-Agent.
- Real Visitors: actual human traffic with bot noise already filtered out, so your visitor count means what it says.
It knows the difference between an attacker and Google
A firewall that blocks indiscriminately isn't protecting your site, it's hiding it. This is the part most WordPress security plugins get wrong, and where xZeroProtect puts in real effort: Googlebot and Bingbot are verified through double-DNS resolution — the exact method Google and Bing document themselves — so a scraper spoofing "Googlebot" as its User-Agent gets no special treatment, while the real crawler is never rate-limited or blocked by mistake.
The same trusted list also covers the crawlers that now decide whether your content gets cited in AI answers — GPTBot, ClaudeBot, PerplexityBot, and others — and legitimate SEO audit tools like Semrush and Ahrefs aren't hard-blocked by default either. You get the attack-blocking without quietly losing search rankings or AI visibility, which is exactly the trade-off that's easy to get backwards. We covered this specific update in more detail in our changelog.
Why it's a good fit for an ordinary WordPress install
- No extra services. No Redis, no external API, no database tables beyond what the plugin creates for itself — logs and rate-limit state live in plain files, which is exactly what makes it usable on ordinary shared hosting, not just a managed VPS.
- It doesn't fight your other plugins. It works purely at the request level, before WordPress has routed anything, so it doesn't touch the same hooks your caching, SEO, or form plugins rely on.
- Nothing phones home. Blocked-request logs and visitor data stay on your own server — there's no third-party script loaded into your pages and no data shipped off to an external dashboard.
- A safe way to turn it on. Learning mode logs every violation it would have blocked without actually blocking anything — run your site in that mode for a day or two first, check the Blocked Requests page for any false positives specific to your setup, then switch to Production mode with confidence.
Getting started
Install it the way you'd install any WordPress plugin: from your dashboard, go to Plugins → Add New, search for "xZeroProtect", and click Install, then Activate — or install it directly from its page on the WordPress Plugin Directory.
A new xZeroProtect menu appears with Dashboard, Real Visitors, Blocked Requests, and Settings. The defaults are reasonable out of the box — rate limiting and auto-ban enabled, the common scanner and attack patterns covered — but it's worth spending five minutes in Settings to set Learning mode first, confirm nothing legitimate gets flagged, and then flip the switch.
The plugin is built on top of an open-source PHP firewall library we also maintain, so if you run a custom PHP project outside WordPress — on Webrium or any other framework — the same detection engine is available directly as a Composer package. For a typical WordPress site, though, the plugin is all you need: install it, activate it, and the gap WordPress core leaves open gets a lot smaller.
Top comments (0)