Best security plugins for WordPress

AMSites Login Customizer

Down in the last 7 days:85#24,119

by AM-Sites Web Experts4 months ago

Visual login customizer: 30+ templates, gradient/image/video backgrounds, form styling, math captcha and a login attempts limiter.

Email OTP Login

Down in the last 7 days:514#24,120

by Tushar Sharma1 year ago

Adds OTP (One-Time Password) verification after login for enhanced security in WordPress. OTP is sent to the user's email.

RankShield

#24,141

by rankshield1 month ago

Protect your Google rankings and ad budget from bot-driven CTR manipulation, sitemap-sweep attacks, and pay-per-click ad fraud.

NNFP

#24,184

by Ramesh Kumar9 months ago

Short Description: Enable secure passwordless login and registration using secure email-based one-time passwords (OTP).

WordPass

Up in the last 7 days:2#24,311

by Chad Butler2 months ago

Creates word-based passwords for WordPress.

Static Snap

Down in the last 7 days:259#24,320

by staticsnap1 year ago

Static Snap converts your WordPress site into a static website, boosting performance, security, scalability, and SEO.

WhoKnew Shield

Up in the last 7 days:60#24,334

by WhoKnew.io2 months ago

Security plugin blocking spam bots from harvesting email addresses, phone numbers & addresses. Dual-layer anti-spam protection with auto-detection.

Optimal State

Up in the last 7 days:40#24,342

by Luke Garrison1 month ago

One plugin to optimize, backup, secure, and speed up your WordPress site. Replaces 4+ plugins.

Invizo Headless Mode

#24,369

by Invizo4 months ago

Turn WordPress into a headless CMS backend with frontend redirects, CORS controls, draft previews, login branding, and security hardening.

EnumGuard

Up in the last 7 days:709#24,428

by Alex Hedström1 month ago

Stops WordPress user enumeration through author URLs, REST, login errors, XML-RPC, sitemaps, and oEmbed.

blanc Honeypot for Contact Form 7

Up in the last 7 days:687#24,430

by blancto1 month ago

A lightweight, invisible honeypot field for Contact Form 7 that helps reduce automated spam submissions without CAPTCHAs.

Anti Browser DDoS Protection

Down in the last 7 days:401#24,445

by sourcecode3473 months ago

Protects WordPress from DDoS with rate limiting, bot detection, blocking, Cloudflare support, logs, charts, and bot list export/import.

ManicSoup Activity Log & Security Monitoring

#24,508

by ManicSoup9 days ago

A clean, self-hosted WordPress activity log with built-in attack detection. See who did what, when, and where — and catch credential attacks.

WP Secure HTTP Headers

Up in the last 7 days:117#24,515

by WP Academic7 years ago

License: GPLv2 or later WordPress plugin to add secure headers to your website.

Secure WordPress Admin

#24,531

by Yasar Khalifa11 months ago

Secure and customize your WordPress admin login by changing the default wp-login.php URL to a custom slug and blocking unauthorized access to wp-admin …

ReadyGo Toolkit

Down in the last 7 days:4#24,564

by mkbplatinum2 months ago

45+ lightweight modules to tweak the admin, clean up, secure and speed up WordPress. Toggle each on or off from one screen, no bloat.

Access Watch

Down in the last 7 days:358#24,647

by François Hodierne8 years ago

Understand precisely the robot traffic on your website and take actions to improve performance and security.

Support SVG

Down in the last 7 days:67#24,854

by Sayedul Sayem9 months ago

This plugin will help you to upload svg format image in WordPress media library regardless of the theme. That is, it works with every theme.

NoCaptcha Spam Filter for Contact Form 7

#24,862

by pontocinza6 months ago

Honeypot, signed security tokens, and anti-replay protection for Contact Form 7. Built for performance and full-page cache compatibility.

Activity Guard

Up in the last 7 days:3,109#24,897

by wpazleen15 days ago

Free WordPress activity log with IP blocking, vulnerability scanner, WooCommerce abandoned cart analytics, and real-time Slack and Telegram alerts.

Reset Admin Password Periodically

Down in the last 7 days:110#24,951

by Deepak S12 years ago

Resets password of administrator accounts automatically on pre-defined time set by admin in settings and mail new password to registered email of user …

Wonderful Geoblocking Countries

Up in the last 7 days:545#25,041

by wonderfulplugins1 month ago

Blocks site access, login, or registration for visitors from selected countries or VPN services, with a custom message per area.

WP Double Protection

Down in the last 7 days:161#25,073

by Maruti Mohanty11 years ago

This plugin allows a second password option and thus making your website doubly protected.

Securizer

Down in the last 7 days:45#25,138

by WP Podrška1 month ago

Lightweight WordPress security, login protection, hardening, integrity and diagnostics without a firewall or cloud service.

Unstoppable Activity Tracker

Down in the last 7 days:364#25,161

by Unstoppable Solutions3 days ago

Standalone activity log with Insights charts, downtime forensics, CSV/JSON export, email digests, optional WooCommerce tracking, and REST API.

Custom Validation for CF7

Up in the last 7 days:122#25,183

by MOMO Media11 months ago

Advanced validation for Contact Form 7: block URLs, validate phone and email, with admin settings.

Malroot Security

Up in the last 7 days:154#25,192

by Niraj Pal4 months ago

Catches database-resident backdoors, rogue admins, malicious MySQL triggers and self-healing rootkits other scanners miss.

File Change Monitor

#25,267

by Osman5 months ago

Detects file changes in WordPress core, themes, and plugins. Sends email alerts to the site admin.

XML-RPC Settings

Down in the last 7 days:203#25,277

by vavkamil5 years ago

Secure your website with the most comprehensive XML-RPC Settings plugin.

Kovalenko Admin Change Audit

Up in the last 7 days:503#25,341

by dmytrokovalenko7 days ago

Records important WordPress activity and provides an owner-only log viewer for monitoring client changes.

Login Alert Notification

Up in the last 7 days:5#25,385

by hondamarlboro2 months ago

Notify alerts with Email and Push Notification Services if detected someone accessing login form.

TSI Visitor Blocker

Up in the last 7 days:549#25,396

by tsidigitalsolution17 days ago

Protect your WordPress site from unwanted visitors, spam, bots, and brute-force attacks with a lightweight and easy-to-use security solution.

Nexura Security

#25,466

by Nexura Security14 days ago

Free WordPress security plugin with malware scanner, firewall, 2FA & brute force protection. Lightweight alternative to Wordfence & Sucuri.

Secure Private Files

Up in the last 7 days:132#25,514

by Ankit Patel1 month ago

Secure private file access with expiry, role-based permissions, token-based URLs, and detailed download logs.

N0WPScan

Down in the last 7 days:640#25,546

by GeekParadize6 years ago

Secure your Wordpress of WPScan Prevent hackers using WPScan to find vulnerabilities in your site, disable this plugin when you are security testing o …

BotCreds Agent Access

Up in the last 7 days:158#25,559

by Joe Boydston2 days ago

Scoped, per-agent application passwords for AI agents, MCP clients, and automation tools.

Better Login Security and History

Up in the last 7 days:499#25,568

by trieuvinh150812 years ago

By this smart plugin you can protect your login page from Brute-force attacks also you can track login history

INI Protector

Up in the last 7 days:822#25,578

by milenfrom1 month ago

Lightweight WordPress hardening — file integrity monitoring, two-factor authentication, login protection, security headers and privacy.

SIWECOS

Up in the last 7 days:24#25,665

by justsnipy4 years ago

SIWECOS is a free security scanning service trying to help website owners making there site more secure. In order to do so, SIWECOS utilizes a total o …

Disable XML-RPC

Up in the last 7 days:245#25,686

by aph52 months ago

Quickly toggle XML-RPC on/off from your dashboard. Perfect for temporarily enabling access for mobile apps, then securing your site again.

Eazy HTTP Headers

Down in the last 7 days:310#25,691

by Rob Scott8 years ago

Provides settings to activate three HTTP header settings for X-Frame-Options, X-XSS Protection & X-Content-Type-Options.

GhostTrap

#25,715

by LaughterOnWater9 months ago

Advanced 5-layer invisible spam protection for comments. No captcha, no user friction - professional spam blocking.

Head Trimmer

Up in the last 7 days:160#25,744

by John Dalesandro5 months ago

Selectively remove WordPress version information, feeds, shortlinks, emoji support, scripts, styles, and other automatically generated extras from the …

Smart Captcha for Google reCAPTCHA

Down in the last 7 days:487#25,786

by M Arslan Farooq1 year ago

Mrsoukbh Smart CAPTCHA adds Google reCAPTCHA v2 and v3 to WordPress login, registration, comments, and WooCommerce forms.

Shellshock Check

#25,900

by Vladimir Prelovac11 years ago

Test if the server is affected by the Shellshock vulnerability.

Smart Country Blocker

Up in the last 7 days:101#25,962

by Shakib R Khan3 months ago

Block visitors from specific countries for both frontend and backend (wp-admin) access with comprehensive logging and reporting.

Site Add-on Watchdog

#26,014

by aaronhsieh12 days ago

Monitor installed plugins for security notices, outdated releases, and optional version-aware WPScan disclosures.

VeracityAI Bot Detection Tag

#26,023

by beaconmartinbtoday

Adds the VeracityAI tag to your site, so bots and invalid traffic are detected and intercepted in real time and more ad budget reaches humans.

BrandBees Malware Guardian

Down in the last 7 days:206#26,044

by BrandBees6 months ago

Scans WordPress files and database for malware indicators with practical cleanup workflows and backups.

Neurax Site Health Analyzer

Down in the last 7 days:269#26,110

by neuraxhost1 month ago

Analyze SEO, security, malware, performance, accessibility, privacy, visitor analytics, and overall site health.