Title: xZeroProtect
Author: Ben Khalife
Published: <strong>2026 年 6 月 27 日</strong>
Last modified: 2026 年 6 月 29 日

---

搜尋外掛

![](https://ps.w.org/xzeroprotect/assets/banner-772x250.png?rev=3590614)

![](https://ps.w.org/xzeroprotect/assets/icon-256x256.png?rev=3588106)

# xZeroProtect

 由 [Ben Khalife](https://profiles.wordpress.org/benkhalifedev/) 開發

[下載](https://downloads.wordpress.org/plugin/xzeroprotect.1.1.4.zip)

 * [詳細資料](https://tw.wordpress.org/plugins/xzeroprotect/#description)
 * [使用者評論](https://tw.wordpress.org/plugins/xzeroprotect/#reviews)
 *  [安裝方式](https://tw.wordpress.org/plugins/xzeroprotect/#installation)
 * [開發資訊](https://tw.wordpress.org/plugins/xzeroprotect/#developers)

 [技術支援](https://wordpress.org/support/plugin/xzeroprotect/)

## 外掛說明

xZeroProtect brings the power of the [xZeroProtect PHP library](https://github.com/webrium/xzeroprotect)
to WordPress with a clean admin dashboard. The plugin source is available at [github.com/webrium/xzeroprotect-wp](https://github.com/webrium/xzeroprotect-wp).

**What it does:**

 * Blocks bots, scanners, and common web attacks (SQLi, XSS, path traversal, command
   injection)
 * Rate-limits IPs and automatically bans repeat offenders
 * Verifies legitimate crawlers (Googlebot, Bingbot) via double-DNS — they’re never
   blocked
 * Tracks **real** visitor analytics — bot traffic is already filtered out before
   anything is recorded
 * Shows unique visitors, top pages, device breakdown, and block reasons in a dashboard
 * Zero external dependencies — no Redis, no external API, everything on disk and
   in your database

**Dashboard includes:**

 * Traffic overview chart (visits, unique visitors, blocked)
 * Top pages by hits and unique visitors
 * Device breakdown (desktop / mobile / tablet)
 * Block reason breakdown
 * Real visitor log with browser, OS, and device info
 * Blocked request log with attack type and reason

### Privacy Policy

xZeroProtect stores visitor data (IP address, browser, OS, device type) and blocked

request data locally in your WordPress database. No data is transmitted to external
servers. All stored data is automatically deleted after the configured retention
period (default: 30 days). All data is permanently removed when the plugin is uninstalled.

## 螢幕擷圖

[[

## 安裝方式

 1. Upload the plugin via **Plugins  Add New Plugin  Upload Plugin** and select the
    plugin zip file, or extract the `xzeroprotect` folder into `/wp-content/plugins/`
 2. Activate the plugin in **Plugins  Installed Plugins**
 3. Go to **xZeroProtect  Settings** to configure

## 常見問題集

### Will this block me from my own admin?

No. The plugin automatically whitelists `/wp-admin`, `/wp-login.php`, and other 
WordPress core paths. Logged-in administrators are also exempt.

### Does it work on shared hosting?

Yes — that’s one of its main advantages. No Redis, no system-level access, no external
services required.

### What happens to my data if I deactivate the plugin?

Data is kept on deactivation. It is only removed when you **delete** the plugin (
uninstall).

## 使用者評論

這個外掛目前沒有任何使用者評論。

## 參與者及開發者

以下人員參與了開源軟體〈xZeroProtect〉的開發相關工作。

參與者

 *   [ Ben Khalife ](https://profiles.wordpress.org/benkhalifedev/)

[將〈xZeroProtect〉外掛本地化為台灣繁體中文版](https://translate.wordpress.org/projects/wp-plugins/xzeroprotect)

### 對開發相關資訊感興趣？

任何人均可[瀏覽程式碼](https://plugins.trac.wordpress.org/browser/xzeroprotect/)、
查看 [SVN 存放庫](https://plugins.svn.wordpress.org/xzeroprotect/)，或透過 [RSS](https://plugins.trac.wordpress.org/log/xzeroprotect/?limit=100&mode=stop_on_copy&format=rss)
訂閱[開發記錄](https://plugins.trac.wordpress.org/log/xzeroprotect/)。

## 變更記錄

#### 1.1.4

 * Fix: Blocked Requests page was always empty — now reads directly from the xZeroProtect
   library’s log file, so both blocked and suspicious (Learning Mode) requests are
   shown.
 * Fix: Static assets (favicon.ico, CSS, JS, fonts, images) were inflating the rate-
   limit counter, causing premature bans. A single page view now counts as one request.
 * New: Hint added above the rate-limit fields in Settings explaining what counts
   as a request.

#### 1.1.3

 * Renamed plugin slug from xzeroprotect-wp to xzeroprotect (resolves trademarked-
   term warning for the “wp” suffix)
 * Fixed Text Domain to match the new slug (“xzeroprotect”) across all strings
 * Renamed main plugin file to xzeroprotect.php
 * Removed the unused “Domain Path” header (no languages folder bundled)
 * Moved firewall storage directory from uploads/xzeroprotect-wp to uploads/xzeroprotect
 * Sanitized $_POST[‘days’] in AJAX handlers before casting
 * Added phpcs ignore annotations for safe, already-prepared direct DB queries
 * Renamed internal constants from XZPWP_* to XZP_*

#### 1.1.2

 * Updated bundled Chart.js to v4.5.1
 * Moved firewall storage to the WordPress uploads directory (wp_upload_dir())
 * Replaced inline dashboard with wp_add_inline_script
 * Removed unnecessary load_plugin_textdomain() call (handled by WordPress.org since
   4.6)
 * Removed directory asset files from the plugin package

#### 1.1.1

 * Added real visitor tracking with device and browser detection
 * Added unique visitor fingerprinting (daily-resetting SHA-256)
 * Added analytics dashboard: traffic chart, top pages, device breakdown, block 
   reasons
 * Added real visitor log and blocked request log
 * Removed curl, wget, python-requests, go-http-client from default blocked agents
 * Removed .php extension from default blocked paths to avoid false positives
 * Raised auto-ban violations threshold from 5 to 10

#### 1.0.0

 * Initial release

## 中繼資料

 *  版本 **1.1.4**
 *  最後更新 **2 個月前**
 *  啟用安裝數 **少於 10 次**
 *  WordPress 版本需求 ** 6.0 或更新版本 **
 *  已測試相容的 WordPress 版本 **7.0.4**
 *  PHP 版本需求 ** 8.0 或更新版本 **
 *  語言
 * [English (US)](https://wordpress.org/plugins/xzeroprotect/)
 * 標籤:
 * [analytics](https://tw.wordpress.org/plugins/tags/analytics/)[bot protection](https://tw.wordpress.org/plugins/tags/bot-protection/)
   [firewall](https://tw.wordpress.org/plugins/tags/firewall/)[security](https://tw.wordpress.org/plugins/tags/security/)
   [WAF](https://tw.wordpress.org/plugins/tags/waf/)
 *  [進階檢視](https://tw.wordpress.org/plugins/xzeroprotect/advanced/)

## 評分

這個項目尚無任何評論記錄。

[撰寫評分](https://wordpress.org/support/plugin/xzeroprotect/reviews/#new-post)

[查看全部使用者評論](https://wordpress.org/support/plugin/xzeroprotect/reviews/)

## 參與者

 *   [ Ben Khalife ](https://profiles.wordpress.org/benkhalifedev/)

## 技術支援

使用者可在技術支援論壇提出意見反應或使用問題。

 [檢視技術支援論壇](https://wordpress.org/support/plugin/xzeroprotect/)