ZAIA Security

ZAIA Security connects your site to ZAIA, a request-context verification service run by NEWTIV. It does not replace WordPress accounts: for every sensitive action, it checks that the request really comes from your site, from the same device, and that the behaviour stays plausible.

Actions checked (your choice):

• login (wp-login.php and WooCommerce), registration, lost password;
• comments;
• REST API writes from the browser (block editor, admin);
• WooCommerce checkout.

Passwordless sign-in for visitors (optional): « Continue with Google » or a code received by email, through the ZAIA sign-in page. In Settings → ZAIA you choose the page where it appears, the format (inside the page, in a window, or full page) and its appearance (colour, corner radius, light or dark mode), with a preview, no code needed. Accounts stay in WordPress: an existing account is found by its verified email address, and, if you enable it and your site allows registration, a new account is created with the Subscriber role (Customer with WooCommerce) once ZAIA has verified the email address. Sign-in goes through wp_signon(), so other security plugins still apply. Visitor accounts never see the WordPress dashboard.

What ZAIA detects: bots and scripts, credential stuffing, replay of captured requests, stolen sessions reused elsewhere, bursts of requests, impossible country changes. Addresses that pile up alerts are quarantined automatically.

Safe for your site:

• observation mode on install: everything is checked and logged in the ZAIA console, nothing is blocked;
• if ZAIA does not respond, the site keeps working (configurable);
• application passwords, WP-CLI, cron and server integrations are never affected.

The plugin is ready for translation through translate.wordpress.org.

External services

This plugin relies on the ZAIA service (https://zaia.newtiv.com), operated by NEWTIV (Abidjan, Côte d’Ivoire). Nothing is sent until an administrator enters a ZAIA application identifier and server key in Settings → ZAIA.

What is sent, and when:

• From the visitor’s browser (only on the forms you choose to protect, and on the sign-in page you enable): the ZAIA client script, bundled with the plugin, opens a session with https://zaia.newtiv.com/v1/handshake/ and adds ZAIA headers to the form. ZAIA receives the browser’s IP address, user agent, page origin and, if available, screen size, time zone and language.
• From your server, when a protected form is submitted: a verification request to https://zaia.newtiv.com/v1/verify with the session headers, the visitor’s IP address and user agent. For a signed-in user, a technical identifier wp:<user number> is sent to https://zaia.newtiv.com/v1/users/grant. Passwords, content and order data are never sent.
• Passwordless sign-in (only if enabled): the visitor uses the ZAIA sign-in page (https://zaia.newtiv.com/login/), shown in your page, in a window or full page. After sign-in, your server exchanges a one-time code at https://zaia.newtiv.com/v1/connect/token and receives the visitor’s identifier, email address and name.
• Configuration test (the « Test » button in Settings → ZAIA): https://zaia.newtiv.com/v1/app returns the application’s settings.

The service: Terms of use · Privacy policy · Service status.

ZAIA offers a free plan (100,000 requests per month per application) and a custom Enterprise plan on quote. Every feature of this plugin works with the free plan.