Skip to content

Home

Jump to bottom Edit New page
Ben Marshall edited this page Nov 3, 2026 · 15 revisions

Zero Spam for WordPress — User Guide

Thanks for choosing Zero Spam for WordPress. It blocks spam and malicious submissions on comments, logins, registrations and the forms of popular plugins, with no captchas and no moderation queue.

This guide covers version 6.0.0. Coming from 5.x? Read Upgrading to 6.0 first.

Requirements: WordPress 6.9 or newer, PHP 8.2 or newer.

Getting started

  1. Install and activate the plugin from Plugins → Add New.
  2. Open Zero Spam in the admin menu, just below Comments. On a fresh install activated on its own, a short setup walks you through three steps: your protection level (Basic, or Enhanced with a license key), what to protect (the form plugins it finds are ticked for you) and how to block. Skip setup applies the recommended settings instead.
  3. Check the Overview to see what is being blocked. Sites updated from 5.x see a What's new in 6.0 tile there instead of the setup.

You can also apply the recommended settings from the command line with wp zerospam autoconfigure.

The Zero Spam admin

Everything lives under the Zero Spam menu. Each page explains its settings in plain language and shows a recommended value.

Page What you do there
Overview See at a glance that your site is protected: what was blocked, a live feed of new detections, the trend over recent weeks, and anything under Needs attention.
Activity Log: search, filter and sort every detection, open one to see who was stopped, from where and why, then block, allow or delete it (with Undo). Reports: detections by type, location, address and hour over 7, 14 or 30 days.
Rules Blocked IPs, Blocked locations, Allowed IPs (the IP Allowlist), Email domains, Words (disallowed and allowed), and No-lockout addresses. Blocks can be permanent or end on a date.
Protection Detection, Integrations and Intelligence tabs, with a card per protection: a switch, what it caught, and the finer settings under Fine-tune. Test my protection checks it all works. Enhanced Protection and your license key are on the Intelligence tab.
Settings General, Logging & data, API monitoring, Advanced (including Trusted proxies), Debug, and Import & errors (import/export, the error log). Also your theme (light, dark or match your device) and the system report for support.
Help The guides (REST API, API monitoring, lockout rescue, developer hooks and, on a network, network settings and statistics), a developer reference of hooks, REST routes and WP-CLI commands, Zero Spam news, and support links.
Zero Spam (Network Admin) On a multisite network, for super admins: Overview, Settings, Templates, Audit log, Comparison, Import/Export, Notifications and Network stats.

The Zero Spam dashboard widget shows recent detections on the WordPress Dashboard when Dashboard widget is turned on under Settings.

What gets protected

  • WordPress comments, registration and login (including wp-login.php and XML-RPC for blocked IPs).
  • Form plugins: Gravity Forms, Contact Form 7, WPForms, Formidable Forms, Fluent Forms and Elementor Pro forms; wpDiscuz comment forms through the David Walsh check.
  • WooCommerce registration and checkout, GiveWP donations, ProfilePress registrations, Mailchimp for WordPress sign-ups.
  • Optional IP and email reputation checks: the Zero Spam Enhanced Protection service, Stop Forum Spam and Project Honeypot, plus geolocation providers (ipbase, IPinfo, ipstack) for country, region and city blocking.

Protection for a third-party plugin is only loaded while that plugin is active. On a multisite network, registrations go through wp-signup.php, which Zero Spam's registration checks do not cover yet.

Locked out?

Try these in order (details in the FAQ):

  1. Emailed rescue link. On the blocked page, open Help for site owners, enter an administrator's email address and press Email me a rescue link. Open the link and press Let me back in to let that browser in for one hour.

  2. Rescue key. Define ZEROSPAM_RESCUE_KEY in wp-config.php, then visit any page with ?zerospam_rescue=your-key:

    define( 'ZEROSPAM_RESCUE_KEY', 'a-long-random-secret' );

  3. Rename the plugin folder. Rename wp-content/plugins/zero-spam over FTP, log in, then rename it back.

Once in, add your IP address under Zero Spam → Rules → Allowed IPs. The IP address of the administrator who activates or updates the plugin is saved automatically and never locked out; you can see it under Zero Spam → Rules → No-lockout addresses. Logged-in users are never blocked.

Multisite

Network-activate the plugin to get Zero Spam in the Network Admin menu. There you set network defaults, lock settings so no site can change them, apply templates, read the audit log, compare sites, and block an address on every site at once (Network stats).

A setting's value is decided in this order: a locked network value, then the site's own value, then the network default, then the plugin default. Sites that never changed a setting follow the network default, including later changes to it. On a site, a locked setting shows Locked by network and cannot be changed through the admin, the REST API or WP-CLI. See the FAQ and the Network Settings Developer Guide.

WP-CLI commands

Site commands

Command What it does
wp zerospam autoconfigure Applies the recommended settings.
wp zerospam settings Lists every setting and its current value.
wp zerospam set --<setting_key>=<value> [...] Updates one or more settings. On a network site, a setting locked by the network administrator is refused with a warning and a non-zero exit code.
wp zerospam regenerate-honeypot Generates a new honeypot field name.
wp zerospam update-blocked-domains --recommended Replaces the blocked email domains with Zero Spam's recommended list. Also accepts --domains="a.com\nb.com", --file=<path> and --append.
wp zerospam api_usage [--period=today|yesterday|week|month|all] [--format=table|json|csv|yaml] [--scope=site|network] Shows Zero Spam API usage statistics (API monitoring must be on).

Network statistics (multisite)

Command What it does
wp zerospam network_stats [--period=...] [--format=...] Network-wide detection statistics.
wp zerospam site_rankings [--limit=10] [--period=...] [--format=...] Sites ranked by detections.
wp zerospam multi_site_attackers [--min-sites=2] [--days=7] [--format=...] IPs seen on several sites.
wp zerospam backfill_stats [--days=30] Rebuilds the daily aggregates.

Network settings (multisite)

Command What it does
wp zerospam network-settings list [--format=...] Lists the network settings. Keys and webhook addresses show only as a hint (••••a1b2).
wp zerospam network-settings show <key> Shows one setting, its value and whether it is locked.
wp zerospam network-settings set <key> <value> [--lock] Sets a network default, optionally locking it.
wp zerospam network-settings lock <key> / unlock <key> Locks or unlocks a setting.
wp zerospam network-settings apply-all [--force] [--mode=all|locked_only|defaults_only] [--sites=2,5] Copies network values into sites' own settings (copied values no longer follow later network changes). The network page's Apply to all sites works differently: it makes sites follow the network again.
wp zerospam network-settings reset <site_id> Removes a site's overrides.
wp zerospam network-settings status / compare / overrides Reports on the network, differences between sites, and which sites override what.
wp zerospam network-settings export / import <file> [--mode=merge|replace|add_only] Backs up and restores network settings as JSON. The export leaves out license keys, API keys and webhook addresses.
wp zerospam network-settings audit Shows the network settings audit log.
wp zerospam network-settings template-list / template-apply <slug> [--scope=network|sites] [--lock] [--sites=...] / template-create / template-delete Manages settings templates.

REST API

Everything the admin does goes through the zero-spam/v1 REST API. See the REST API page for the route groups and who may use them, and Zero Spam → Help for request and response examples.

More

Add a custom footer
Add a custom sidebar

Clone this wiki locally