Best security plugins for WordPress

Files Inspector

Up in the last 7 days:37#32,658

by alexhee12 years ago

Compare files changes within wordpress.

TZ Guard

Up in the last 7 days:37#32,669

by templaza11 years ago

This is a simple plugin which will help you to security your WordPress site.

VMP Security

Up in the last 7 days:11,269#32,683

by VMP™10 days ago

Firewall, 9 malware scanners, 2FA, country blocking, audit log preview — all free. 750+ WAF rules and 170,000+ signatures. No paywall.

WP Cloudflare Guard

Up in the last 7 days:275#32,730

by Tang Rufus9 years ago

Connecting WordPress with Cloudflare firewall, protect your WordPress site at DNS level. Automatically create firewall rules to block dangerous IPs.

JR Security Hardening and Login Protection

#32,778

by reinajhon465 months ago

WordPress hardening and login protection: security headers, enumeration blocking, rate limiting, IP whitelist, event logging and server rules.

NoHackMe Defender

#32,822

by Roman11 days ago

Enhance your WordPress security by blocking IPs that send too many or suspicious requests.

WP WAF

Down in the last 7 days:54#32,884

by guelfoweb13 years ago

WordPress Application Firewall. Protects against current and future attacks.

CyberPulse

#32,900

by Ruslan Gataullin2 days ago

🛡️ Real-time security firewall with IP blocking. Blocks bots, brute force attacks, XSS, and AI scrapers. 10 languages, lightweight, clean interface.

Token2 Hardware Tokens

Down in the last 7 days:2,067#32,905

by token28 years ago

Token2 Hardware Tokens for your WordPress blog.

PowerSuite Modular Admin Toolkit

#32,928

by powersuitetoday

155 WordPress modules: 90 free in this plugin, plus 65 in the separate Pro add-on. Tools for admin, content, media, login, and email.

Double Knot

#33,070

by mattturow9 years ago

Stop brute force login attempts by user name.

BoundaryGuard Headers

#33,106

by Jay Suthar2 months ago

Automatically enforces essential HTTP security headers to protect your site from XSS, clickjacking, and protocol downgrade attacks.

Smart CAPTCHA Alternative with Cloudflare Turnstile

#33,113

by Mayank Majeji7 months ago

Protect WordPress forms from spam using Cloudflare Turnstile. A privacy-friendly CAPTCHA alternative.

24TT Login Security and Brander

Down in the last 7 days:45#33,129

by 24 Tech Time1 month ago

Agency-level visual branding alongside critical perimeter defense, login obfuscation, and strict access controls.

Fullworks Security Scanner

#33,156

by fullworks2 months ago

Fullworks Security Scanner: Your Website's Guardian. Core, Themes, Plugins - Checked. Vulnerabilities - Squashed. Your Site - Secure.

Icey

#33,161

by Icedor Johansson1 year ago

Securely archive inactive plugins to prevent security risks and avoid WordPress warnings. Restore anytime with a single click.

User Security Tools

#33,208

by ericktedeschi13 years ago

User Security Tools provides some improvements to security in wordpress.

Wallet Up Login Customizer

Down in the last 7 days:2,077#33,216

by Wallet Up1 year ago

Enterprise-grade login security and customization for WordPress with beautiful UI, advanced protection, and seamless Wallet Up integration.

CNR Performance

Down in the last 7 days:202#33,275

by Amit Moreno10 years ago

Boost your WordPress performance with additional performance settings.

Lock Login

Down in the last 7 days:133#33,315

by aixeiger3 years ago

Lock Login protects to block attempts to bruteforce your site.

RationalCleanup

Up in the last 7 days:772#33,347

by rationalwp2 months ago

Clean up legacy WordPress bloat, improve security, and optimize performance with toggleable, opinionated defaults.

WPG User Activity Monitor

Up in the last 7 days:1,275#33,349

by Rakesh Raja3 months ago

Track user activity in WordPress with an admin dashboard, filters, retention settings, and owner-managed access control.

Site CliniQ

#33,366

by Bilal Mahmood22 days ago

Scans your WordPress site and explains every problem in plain English — PHP errors, SEO issues, broken links, oversized images, and more.

New Users Monitor

Down in the last 7 days:693#33,421

by wpgear8 months ago

Ext Security. Automatic scanning of the Users list, detect unauthorized addition. Informs immediately Admin by email. Informative Widget.

Raptcha

Down in the last 7 days:452#33,433

by LaughterOnWater9 months ago

A secure, animal-based CAPTCHA for WordPress forms featuring intelligent bot detection and multi-form integrations.

WP Login Alerts by DigiP

#33,448

by DigiP12 years ago

E-mails the site owner if anyone reaches or attempts to login to the site. Also shows the user names they attempt to login with.

Force Login Pro

#33,462

by Brandon Hubbard5 years ago

A simple WordPress plugin to force login.

Filename Randomizer

Down in the last 7 days:1,119#33,537

by mohemiv4 years ago

Filename Randomizer adds randomization to file names when uploading files into WordPress. This is a security plugin designed to prevent unauthorized …

Essential WP Tools

#33,766

by RactStudio2 years ago

Essential WP Tools is an all-in-one solution for customizing features, optimizing speed, boosting security, improving SEO, and enhancing WordPress.

Ultimate Security

#33,776

by WP Ultimate Security14 days ago

Security for the AI era: 2FA, login protection, vulnerability scans, prompt injection scan and AI bot tracking. Free, 3-minute setup.

Hello Security

Up in the last 7 days:769#33,791

by Michele Butcher-Jones11 years ago

Give your users security best practices tips directly on the dashboard.

Login Protection

Up in the last 7 days:616#33,934

by couhie12 years ago

This plugin make improve the security of the administration page by blocking unauthorized access.

Elohim Cyber Guardian

Down in the last 7 days:1,415#33,945

by elohimsoftwaressolutions1 month ago

A lightweight WordPress security plugin with login protection, rate limiting, CAPTCHA, and security hardening.

Strict Security Headers

Up in the last 7 days:57#34,014

by Justin Kopepasah3 years ago

Easily enable modern security headers for your website with the Strict Security Headers plugin, with no configuration required.

Oxicat Password Form Styler

Up in the last 7 days:76#34,233

by ofredon3 months ago

Style and customize the WordPress protected-page password form, globally, without editing your theme.

Tor Blocker by Inazo

Down in the last 7 days:9#34,257

by inazo9 years ago

This plugin blocks Tor users by preventing them from viewing your website.

GhostGate

#34,297

by codegee09589 months ago

Invisible, intelligent protection for WordPress. GhostGate hides your login page, blocks bots, and turns your site into a ghost fortress.

Simple Cron

Down in the last 7 days:178#34,330

by ChrisHurst14 years ago

Manage and Monitor WordPress Cron Scheduling System

Yeasin Geo-Blocker

#34,382

by Yeasin10 days ago

Advanced Geo-blocking, IP restriction, and content protection with a premium UI. Protect your website from unwanted traffic and malicious bots.

Bye Bye Passwords

Down in the last 7 days:729#34,416

by Clayton LZ2 months ago

Enable passwordless authentication for WordPress using WebAuthn/Passkeys. More secure, more convenient.

Disable Add New Plugins

#34,450

by Nikunj Soni1 year ago

This plugin will disable the functionalities of add new plugins and file editing in your WordPress admin panel. It will also give security to file bei …

IP Dependent Cookies

#34,464

by Denis V (Artprima)10 years ago

Plugin IP Dependent Cookies makes your Wordpress installation more secure adding your IP to salt (which makes cookies IP-dependent).

User Login Disable

Down in the last 7 days:453#34,467

by chexwarrior4 years ago

Allows administrators to disable other user logins.

crawler-hunter

Down in the last 7 days:1,115#34,503

by naimgr831 year ago

It is a simple but effective plugin. Stops spam bots by checking browser content. You can also add an ip address to the blacklist.

Bluearctic HTTPS Fixer

Up in the last 7 days:10,377#34,504

by Bluearctic2 months ago

Send every visitor to HTTPS, clear mixed content warnings, and clean old http:// links out of your database.

HeaderShield

#34,506

by Vishwa7 months ago

Add safe, modern HTTP security headers with optional strict cross-origin protections and a simple admin UI.

Guard Dog

Down in the last 7 days:6,909#34,525

by Adam Greenwell7 days ago

Plugin-first WordPress login and account security: custom login URLs, 2FA, passkeys, CAPTCHA, access control, sessions, and activity logging.

Login Secure

Up in the last 7 days:27#34,599

by Rizwan Abbasi5 years ago

Try it out on your free dummy site:

WpCrypt

Down in the last 7 days:168#34,641

by bruno.sousa11 years ago

Allow users to change password encryption method to SHA1, SHA2, AES Rijndael and more...

MembersBlog

#34,645

by DCoda14 years ago

Lock down all your posts and pages so only members can access them