Zero Spam for WordPress

Not on its own. Zero Spam for WordPress does not automatically block IP addresses. If a visitor is blocked, it could be due to manual blocking by the site admin or their presence in IP blacklists such as Stop Forum Spam, Project Honeypot, or the Zero Spam. In the event that a legitimate user is blocked, refer to the Log (Admin > Dashboard > Zero Spam > Log) for further details on the reason behind the block. You have the flexibility to adjust the strictness of the 3rd-party blacklist checks or disable them if your users are prone to being flagged as spam or malicious.

No, it doesn't. Zero Spam for WordPress does not have integration with Jetpack. If you have any inquiries regarding this, please refer to https://wordpress.org/support/topic/incompatible-with-jetpack-comments for more details.

Enable caching for optimal performance. Enabling caching is highly recommended as it helps prevent repetitive calls to third-party APIs and access checks during each page visit. To further optimize performance, you can adjust the cache and API timeout settings in the admin panel based on your server specifications and specific requirements.

• wp zerospam autoconfigure — Auto-configures with recommended settings.
• wp zerospam settings — Displays all plugin settings.
• wp zerospam set --[SETTING_KEY]=[VALUE] — Updates a plugin setting.

Yes! Zero Spam provides a secure REST API for reading and updating settings remotely. This is perfect for:

• Syncing settings between staging and production environments
• Automating configuration in CI/CD pipelines
• Managing settings across multiple WordPress sites
• Remote administration and monitoring
• Testing configuration changes safely with dry-run mode

Some hosts have issues with they way they access files. If you're seeing a ftp_fget PHP notice, setting the FS_METHOD constant to direct in wp-config.php above the line /* That's all, stop editing! Happy Pressing. */ should solve the problem: define('FS_METHOD', 'direct'); If hosting with Pantheon, see their known issues page for more information and what to do to resolve it with their $_ENV['PANTHEON_ENVIRONMENT'] variable check.

You can report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team help validate, triage and handle any security vulnerabilities. Report a security vulnerability.

On the blocked page, open Help for site owners, enter the email address of an administrator account on the site and press Email me a rescue link. Open the link in that email (on any device) and press Let me back in: that browser is let in for one hour, so you can log in and add your IP address to IP Whitelist under Settings → Zero Spam → Settings. The link works once, for 15 minutes. If the address isn't an administrator's, nothing is sent; the page says the same either way. Logged-in users are never blocked. When you activate or update Zero Spam, it also saves your current IP address (public addresses only) as one it never locks out. Visitors from that address are still checked for spam. You can see and remove these addresses under the IP Whitelist on Settings → Zero Spam → Settings. You can also define the ZEROSPAM_RESCUE_KEY constant in your wp-config.php file (e.g. define( 'ZEROSPAM_RESCUE_KEY', 'a-long-random-secret' );) and visit any page of your site with ?zerospam_rescue={YOUR_KEY} appended (e.g., https://example.com/wp-login.php?zerospam_rescue=a-long-random-secret). All checks are bypassed in that browser for one hour. If none of these work (for example, you use an .htaccess block method, or your site can't send email), rename the plugin folder via FTP (wp-content/plugins/zero-spam -> zero-spam-disabled) to gain access. If every visitor, including you, suddenly sees "Your IP has been flagged as spam/malicious", your site is probably behind a CDN, load balancer or proxy (for example Hostinger CDN or Sucuri) that Zero Spam doesn't know about, so every visitor appears with the proxy's address. Get back in with the rescue link or Rescue Mode, then add the proxy's IP addresses or ranges under Trusted Proxy IPs in Settings → Zero Spam → Settings (your host can tell you what they are). Cloudflare is recognised automatically.

Yes. Cloudflare is recognised automatically. For any other CDN, load balancer or reverse proxy, list its IP addresses or ranges under Settings → Zero Spam → Settings → Trusted Proxy IPs, one per line (for example 203.0.113.0/24), including internal hops such as a load balancer. Zero Spam only reads forwarded IP headers from those addresses, so visitors can't fake their IP. If many visitors appear to share one IP address, Zero Spam shows administrators a warning on its screens so you know to check this setting. Developers can add proxies with the zerospam_trusted_proxies filter.

Yes, since version 5.7.14. Zero Spam checks the username and password step of the login as before. Once that step succeeds, the later steps of the same login (such as entering a two-factor code from WPMU DEV Defender Pro or the Two Factor plugin) are not checked again. Verification that has expired or was already used, for example from a cached login page or the back button, no longer blocks the login with "Your IP has been flagged as spam/malicious": the visitor is let through, or asked to try again. Developers with custom login flows can use the zerospam_login_skip_check filter.

As of version 5.7.1, Zero Spam now actively protects wp-login.php and xmlrpc.php from blocked IPs. If you are blocked, check your IP reputation, or use the emailed rescue link on the blocked page (or the Rescue Mode key) to log in and whitelist your IP.