Best security plugins for WordPress

DollarMates U2 Secured Authenticator

Up in the last 7 days:21,311#49,872

by dollarmates13 days ago

Tap-to-approve two-factor authentication for WordPress logins, backed by the U2 Secured Authenticator app.

BeleGuard Domain Scanner

Up in the last 7 days:6,934#49,921

by beletech7621 days ago

Scans your subdomains and content links for dangling DNS records (abandoned cloud resources) an attacker could claim.

MarketVistaAi Site Hardening

Up in the last 7 days:15,509#50,019

by MarketVistaAi1 month ago

WordPress hardening, local form and comment spam protection, recoverable spam review and configuration checks.

Visitor Sentinel

#50,090

by Valentin Constantinescu2 months ago

Monitors visitors, detects bots and attackers, plants honeypots, checks threat intel, and blocks malicious IPs in real time.

SiteCheck Pro AutoFix

Up in the last 7 days:11,043#50,109

by Ted Church | Founder & Lead Developer, SiteCheck Pro3 days ago

Automatically repair, verify, and optimize your WordPress website with SiteCheck Pro AutoFix.

RestArmor Security

Up in the last 7 days:2,490#50,152

by Md. Rakib Ullah9 months ago

Advanced security suite. Blocks REST API, disables XML-RPC, prevents user enumeration, and secures endpoints.

Uptime, SEO and Security monitors

Up in the last 7 days:4,565#50,155

by Chatra6 years ago

Downtime Happens. Get Notified! Uptime, SEO, and Vulnerability monitors for your website, totally free.

SteadyDevs Upkeep Check

Up in the last 7 days:16,387#50,166

by steadydevs2 days ago

Find plugins and themes that are closed on WordPress.org, abandoned, outdated or untested, check your PHP version's security support, and see wha …

SteadyScore

Up in the last 7 days:1,380#50,236

by steadypress4 months ago

Audit every installed plugin for reliability, security, and maintenance health. Get a single SteadyScore from 0 to 100 per plugin.

Trivla Account Security

Up in the last 7 days:7,382#50,284

by trivlasupport15 days ago

Log every sign-in, block repeated failures, review signups by country, and clean up WooCommerce customers who never order.

AiutoComputerHelp Live Request Monitor

#50,346

by aiutocomputerhelp11 days ago

Admin-only live WordPress request diagnostics with filters, behavioral indicators, and temporary capture. No blocking or permanent access log.

Lockora Login Shield

Up in the last 7 days:19,455#50,386

by Our Plugin5 months ago

Customize and secure your WordPress login page with custom branding, a custom login URL, and basic login protection.

Apaxon Core

#50,425

by Apaxon2 months ago

The foundation for every Apaxon plugin: licensing, shared settings, granular permissions and site checks.

404ops Activity Log

#50,432

by Steve White2 days ago

Audit log for WordPress: records events into a local table with filters, retention, CSV export, and a daily email digest.

SecondGate

#50,433

by SecondGateWP1 month ago

Passkeys, 2FA, brute-force protection, and country blocking, with real crawlers auto-verified and exempted. No account required, ever.

Yonka Admin Toolkit

Down in the last 7 days:358#50,509

by yonkaivanova2 months ago

All-in-one lightweight WordPress administration utility suite packed with 10 performance, security, SEO, and productivity modules.

Admin Login Monitor

#50,520

by Jack Fischer4 years ago

Email site administrators about all administrator logins.

Safe Headers Scanner

#50,528

by amir tohidlo1 year ago

Scan themes and plugins for potential header issues such as whitespace before/after PHP tags or direct output before headers.

MirSecure

Up in the last 7 days:17,704#50,553

by mirmehranarjmand4 months ago

MirSecure protects your WordPress REST API by allowing access only to authenticated users.

RB Cloak Media Files

Up in the last 7 days:7,478#50,609

by RoundBorders2 months ago

Replace media filenames with cryptographically secure random cloaks so files cannot be found by URL guessing or enumeration.

Klydexa Site Integrity Audit

#50,617

by klydexa3 days ago

Diagnose. Understand. Fix. Protect. Local-first health, security, compatibility, performance, database and plugin-conflict auditing for WordPress.

GeniousSonu Site Checkup

Up in the last 7 days:18,451#50,788

by SAHINUR19 days ago

Strengthen your WordPress security with an automated hardening checklist, vulnerability scanner, one-click safe fixes, and client audit reports.

Devch Passkey Login

Up in the last 7 days:18,636#50,983

by Devansh Chaudhary2 months ago

Passwordless passkey authentication (WebAuthn/FIDO2) for WordPress and WordPress Multisite.

Lockgate Exposure Scanner

Up in the last 7 days:17,214#51,018

by oddeveninfotech2 months ago

Scans the comments, profiles and posts already on your site and reports what an AI assistant would be handed if it read them. Read-only.

Vardalion Security

Up in the last 7 days:14,430#51,036

by vincewebdesign1 month ago

Behavioural WordPress security with threat scoring, brute-force protection, bot detection, automatic IP blocking, logging and recovery tools.

WebPayesh

Up in the last 7 days:14,419#51,079

by amin sanayie1 month ago

Smart website guardian for WordPress: health scores, uptime, images, performance, database and WooCommerce checks.

Genisoft Security Connector

Up in the last 7 days:1,656#51,114

by genisoftweb20 days ago

Secure read-only connector linking your WordPress site to the WP Security malware-scanning service for remote security audits.

HappyFenceNG Total Enterprise Security

Up in the last 7 days:5,346#51,142

by HappyWPress11 months ago

Next-generation enterprise security for WordPress with advanced threat protection, tiered licensing, and hardening features.

Jikida Security

#51,181

by jikida1 month ago

Malware scanner, firewall (WAF), login & brute-force protection, and file-integrity monitoring for WordPress. Blocks attacks, hardens your site, a …

HeadlessKey

Up in the last 7 days:5,816#51,325

by Hidayat Mahetar9 months ago

A complete authentication solution for Headless WordPress applications using JWT, supporting Registration, SSO, RBAC, and advanced Security features.

Activity Monitor Pro

#51,551

by Wole Akinloye9 months ago

Comprehensive activity monitoring, undo system, and AI-powered anomaly detection for WordPress.

Glimbyte SSL Guardian

Up in the last 7 days:4,699#51,650

by Glimbyte10 months ago

Complete SSL management plugin: force HTTPS, fix mixed content, monitor certificates, and enable HSTS. Easy setup in 5 minutes.

Headless Login Guard

Up in the last 7 days:4,701#51,672

by Andrew Wilkinson3 months ago

Forces login for backend access in headless WordPress setups while allowing GraphQL/REST API endpoints and essential paths.

JAT Shell Scanner

#51,827

by Jeremy Anderson4 days ago

Checks if your site is exposed to, or was hacked through, PHP2Shell (critical PHP bug) and wp2shell (WordPress bug). Optional fixes you can undo.

HealthSweep Site Monitor

Up in the last 7 days:12,042#51,866

by Ravi Khadka7 months ago

Advanced WordPress Site Health, performance, security, cleanup, snapshots, alerts, and local speed benchmarking for admins.

MID GeoShield Access Manager

Up in the last 7 days:16,356#51,872

by midexigner10 months ago

Easily block visitors from selected countries with geo-based restrictions and an admin settings page.

SEOmarketeer Bot Flagger

Up in the last 7 days:5,574#52,087

by seomarketeer1 month ago

Logs every request and tells you what it really is: a person, a search engine, an AI crawler, your own cache, or an attack.

Cloudbridge 2FA

Up in the last 7 days:15,521#52,104

by joho684 months ago

Uncomplicated 2FA plugin for WordPress with e-mail OTP and authenticator app support.

Patch Gap

Up in the last 7 days:16,486#52,281

by Luke W18 days ago

Find the plugins and themes nothing is updating: expired licenses, missing update sources, and premium plugins that silently stopped patching.

Ausculte

#52,334

by wpalab2 months ago

Instant health checkup for your WordPress site: security, performance and technical SEO checks, scored /100, with one-line fixes.

ActiLog Admin Event Monitor

#52,350

by Laxman Prajapati7 days ago

A lightweight activity log plugin that tracks user actions in WordPress. Monitor logins, content changes, plugin updates, and more.

Apta Shield

Up in the last 7 days:16,487#52,353

by Lorenzo Romero4 months ago

Premium WordPress security with WAF, brute force block, URL obfuscation, malware scanning, and core reinstallation.

WhoChanged

Up in the last 7 days:2,659#52,427

by Douple2 months ago

Know exactly who changed what in your WordPress admin — options, Customizer, plugins, users, menus, content and more.

Decionis Checkout Gate

Up in the last 7 days:11,284#52,517

by monosapien3 months ago

Protect WooCommerce checkout margin with a real-time, fail-open Decionis policy gate.

No Author Redirect

Up in the last 7 days:17,101#52,541

by keithws7 years ago

Stop redirects from URLs containing the author query parameter and user ID to permalinks with usernames to make it a little harder to iterate through …

MZ Easy Manage

#52,673

by OLERAJ7 months ago

Modern WordPress management: clone posts, manage custom fields, protect content, control uploads, manage MIME types, and export/import data.

Quick Integrity Scanner

#52,685

by Medium Interactive4 days ago

Read-only file integrity checks for WordPress core, plugins, uploads and admin accounts. Detection only. Never changes a file.

Riskora User Scanner

#52,719

by WPClinic1 month ago

Detect suspicious WordPress users using configurable risk signals and scoring.

w3v-xml-rpc-security

#52,763

by W3villa Technologies Pvt Ltd3 years ago

Securing site by disable XML-RPC by removing some methods.

StaticWeb Deploy

Up in the last 7 days:8,560#52,792

by StaticWeb.io4 days ago

Generate static sites for deployment as files or S3-compatible storage.