Korzen
EN
Sign inStart free
Bot Protection

WordPress and WooCommerce

Bot Protection on WordPress without code: the plugin loads the tag and asks before a login, a registration and a WooCommerce checkout, and fails open.

On WordPress you write no server code: the Korzen Bot Protection plugin does the work of the tag and of the call. It loads the tag on your pages and the login page, and asks Bot Protection before a login, a registration (WordPress's and WooCommerce's) and a WooCommerce checkout, the classic one and the block one. When Bot Protection is slow (over 200 ms), down or answers anything unexpected, the visitor goes through. It needs WordPress 6.5 and PHP 8.2 or later.

Install

The plugin is not in the WordPress.org directory yet: write to us for its zip. In WordPress, open Plugins > Add New Plugin > Upload Plugin, choose the zip, then activate it.

Settings

Open Settings > Korzen Bot Protection and paste the two keys from the Set-up page: the site key (YOUR_SITE_KEY), which the tag carries, and an API key, which your server sends. Once saved, the API key is never shown again. To keep it out of the database, define it in wp-config.php instead, and leave the field empty:

// wp-config.php, above "That's all, stop editing!"
define( 'KORZEN_API_KEY', 'your API key' );

Two more settings:

  • Mode. Monitor asks and lets everyone through, whatever the answer: start there, and watch the decisions in your dashboard. Block applies the answer's action, which stays allow until you turn on block mode on the Set-up page too (see monitor and block mode).
  • Visitor's IP. Behind a load balancer, a proxy or Cloudflare, every visitor seems to come from it. Choose the last X-Forwarded-For entry behind your own load balancer or proxy, or CF-Connecting-IP when your server takes traffic from Cloudflare alone; otherwise leave the connection.

What it protects

  • Login: the login page, and WooCommerce's My Account login. Bot Protection is asked after WordPress checks the password, whether it was right or not, so a refusal tells a bot nothing about the password. Logins of apps, over XML-RPC and the REST API, are not asked: no tag ran there.
  • Registration: WordPress's registration page and WooCommerce's My Account registration.
  • Checkout: WooCommerce's classic checkout and its block checkout.

Each is named in your dashboard as /login, /signup or /checkout, whatever your site's addresses.

What a visitor sees

In block mode, a visitor Bot Protection blocks gets the form's usual error, which says the request could not be completed and not why. A visitor it is unsure of (challenge) gets a link to the challenge page, a short check that sends them back to the same form; they submit it again and go on.

What it sends and stores

Before each protected action, your server sends Bot Protection the visitor's IP address, User-Agent, the headers the call lists, the tag's _kz token, the method and the action's name: never the password, the email or the order. The plugin stores only its settings, in one WordPress option, and deleting the plugin removes them.