ZTLayer Logo
Start Building

WordPress Integration Guide

The official ZTLayer WordPress plugin provides native integration with the WordPress hook system to block malicious traffic before it can query the MySQL database, significantly reducing server load during attacks.

1. Installation

The plugin is currently distributed as a manual download while it awaits approval on the official WordPress repository.

  1. Download ztlayer-wordpress.zip from your ZTLayer Dashboard.
  2. Log into your WordPress wp-admin dashboard.
  3. Navigate to Plugins > Add New > Upload Plugin.
  4. Upload the zip file and click Activate.

2. Configuration

Method 1: WP-Admin Dashboard (Recommended)

  1. Navigate to Settings > ZTLayer Security in your WordPress sidebar.
  2. Enter your Project ID and API Key.
  3. Click Save Changes. The plugin will immediately verify the connection.

Method 2: wp-config.php (For Agencies & Bedrock)

If you manage multiple client sites and want to keep API keys out of the database, you can define them as constants in your wp-config.php.

// wp-config.php
 
define('ZTLAYER_PROJECT_ID', 'your_project_id_here');
define('ZTLAYER_API_KEY', 'zt_live_xxxxxxxxxxxxxxxxxxxxxxxx');
 
// Optional: Enable strict mode for WooCommerce checkouts
define('ZTLAYER_WOOCOMMERCE_STRICT', true);

3. What the Plugin Protects

Once activated, the plugin hooks into the plugins_loaded action (priority 1) to inspect traffic as early as possible.

  • wp-login.php Protection: Automatically enforces strict rate limiting and behavioral checks on the login page to prevent brute force attacks.
  • xmlrpc.php Blocking: Disables or filters XML-RPC requests which are commonly used in DDoS attacks against WordPress.
  • WooCommerce Checkout: If WooCommerce is detected, ZTLayer injects the client-side telemetry script on the checkout page to prevent automated card testing and credential stuffing.
  • Comment Spam: Blocks known malicious IPs from submitting POST requests to wp-comments-post.php.

4. Troubleshooting

  • Blank White Screen (WSOD): If you activate the plugin and your site crashes, it is likely conflicting with another caching or security plugin (like Wordfence) attempting to manipulate the same HTTP headers. Ensure you do not have multiple WAFs active simultaneously.
  • Cloudflare Proxy: If your WordPress site is behind Cloudflare, ensure you have the official Cloudflare plugin installed, or define $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CF_CONNECTING_IP']; in your wp-config.php so ZTLayer reads the correct user IP.