Best security plugins for WordPress

Veilo

Up in the last 7 days:411#56,308

by adinax09262 months ago

Invisible spam protection for comments and forms — no CAPTCHA, ever shown to visitors.

Trust WP

Up in the last 7 days:6,760#56,361

by rrpathi5 years ago

Trust WP is a very light plugin that lets you easily and safely change wp-login.php to anything you want. It doesn’t literally rename or change files …

Shibisty Sharing Activity Detector

Up in the last 7 days:16,325#56,393

by Alexander Shibisty1 month ago

Tracks user sessions/requests, flags suspicious multi-device activity, and gives admins an interactive timeline, a full request log, and settings.

Qevix Shield

Up in the last 7 days:5,504#56,415

by qevixlabs1 month ago

WordPress security: login protection, 2FA, reCAPTCHA, malware scanning, firewall and an activity log. Every protection is off until you turn it on.

LogAction

Up in the last 7 days:12,328#56,448

by Sylvanus4 months ago

Track and log WordPress activities to monitor and improve your site's security and administrative tasks.

PermaLogger

Up in the last 7 days:11,195#56,463

by bitcoinapi6 months ago

Track all hookable actions in the WP-Admin area and log them to PermaLogger's external service for comprehensive activity monitoring.

Atomic Site Manager

Up in the last 7 days:12,664#56,483

by Oyorox2 months ago

Connect this site to your Atomic Site Manager dashboard for remote updates, backups, security, SEO, and site health monitoring.

Lock and Key

Up in the last 7 days:12,324#56,488

by shadowsplitter27 days ago

Phishing-resistant login with hardware security keys (Ledger, YubiKey, any FIDO2 key) for any user role, with optional password-free login.

AdminTrace Activity Logger

#56,523

by sigmarocks7 days ago

WordPress activity log and audit trail. See who changed content, users, plugins, themes, settings, and WooCommerce orders.

fepo CSP & Security Headers

#56,605

by fepo11 days ago

Scans your pages, builds one Content-Security-Policy and sends it with the other security headers. Nothing leaves your website.

Woptily

Down in the last 7 days:7,421#56,634

by J42 months ago

An all-in-one modular WordPress optimization toolkit for performance, security, backups, and site health.

Grumpy AI Gate

#56,701

by Lars Koudal6 months ago

Intercept and log AI-related HTTP from plugins/themes; optional AI Client blocking. All data stays on your server.

JuanMa JWT Auth Pro

#56,786

by JuanMa Garrido11 months ago

Modern JWT authentication with refresh tokens - built for SPAs and mobile apps with enterprise-grade security.

SQA Vulnerability Discovery Toolkit

Up in the last 7 days:4,674#56,802

by sqaconsulting5 years ago

This plugin was desgin based on NCSC Vulnerability Discovery Toolkit (https://www.ncsc.gov.uk/information/vulnerability-disclosure-toolkit)

NexiGuard

Down in the last 7 days:2,137#56,804

by Nexiby LLC2 months ago

Restrict website access by IP addresses, CIDR ranges, countries, and regions.

Smart Content Protection Tool

Up in the last 7 days:13,966#56,883

by inventorx2 years ago

A simple plugin to disable text selection and prevent image dragging on your WordPress site.

Majed Mini Tools

Up in the last 7 days:13,965#56,920

by Majed Bannani2 days ago

A modular toolkit for managing practical WordPress features from one dashboard, with translation-ready RTL support.

VESSOT Secure Portable Data

Up in the last 7 days:5,453#56,964

by jonvessot11 months ago

VESSOT Secure Portable Data - WordPress Plugin Zero visibility data storage with client-side encryption via the VESSOT platform.

Flavor 2FA

#57,059

by kuckovic8 months ago

Lightweight two-factor authentication that just works. Protect your WordPress site with authenticator apps or email codes in under 2 minutes.

Secure Dashboard Login Notifier

#57,072

by Shemon Islam1 year ago

Notify the main admin when any user logs in to the dashboard. Track logins, and securely manage users with logout/delete options.

HIFQA Fraud Detector for WooCommerce

Up in the last 7 days:5,726#57,077

by Dilruba Ummer28 days ago

Real-time fraud detection for WooCommerce. Local signal scoring works out of the box; AI and vector search layers are optional.

Brain 2FA

#57,108

by Braintum11 days ago

Add two-factor authentication and passwordless passkey sign-in to WordPress accounts.

NoDoss

Up in the last 7 days:13,717#57,115

by Edwin Bekedam2 months ago

Stop bots, pingbacks, protection againts brute force hacking, script jacking, Iframe XSS attacks, CSRF Proctection, Insecure requests,

LunarShield

Up in the last 7 days:3,398#57,119

by moonbaseoneit5 months ago

Security hardening utilities for WordPress, including rate limiting, uploads hardening, and admin security settings.

Zeshan Login 2FA

Up in the last 7 days:5,720#57,124

by zeshan4953 months ago

Add app-based two-factor authentication to your WordPress login. Scan a QR code, then enter a 6-digit code. Backup codes keep you from locking out.

Noventum Fake Order Protection

Up in the last 7 days:3,416#57,249

by noventum1 month ago

Protects WooCommerce checkout from fake orders, bots, and abuse with adaptive rate limiting and optional reCAPTCHA checks.

Clautron

Up in the last 7 days:13,067#57,332

by dudaster5 days ago

Get the feature. Not the plugin. Add exactly the WordPress capability you need: inspectable, secure, reversible.

Aegistha Security Checkup

Down in the last 7 days:3,495#57,349

by timbalabuch2 months ago

Your site's security, in plain English. See your real risks, honestly prioritized, and fix the safe ones in one click. No fear, no jargon.

VVertex Password Protect CPTs

#57,363

by Ahmad Raza2 months ago

Password protect individual posts, pages, and public custom post types with a simple per-content password field.

Fae Herald

Up in the last 7 days:9,123#57,366

by Frederik Rosendahl-Kaa2 months ago

Keep your WordPress site secure by monitoring plugin releases and spotting closed plugins.

Transaction Validation

Up in the last 7 days:12,235#57,406

by transactionvalidation6 months ago

Protect your WooCommerce store from fraudulent transactions with advanced fraud detection and validation services.

CubeMage Login Guard

#57,442

by CubeMage11 months ago

Integrates Cloudflare Turnstile, Limits Login Attempts, and Disables XML-RPC to protect WordPress forms.

Auditra

#57,451

by macronimous1 month ago

MCP server for WordPress plugin audits

Vigidomain

#57,453

by vigidomain3 months ago

Security monitoring and alert agent connected to Vigidomain server for your WordPress site.

Visualwebs AI Cloud Suite

Down in the last 7 days:727#57,519

by Visualwebs3 months ago

AI-powered chatbot, semantic search, and machine learning for WordPress with enterprise-grade security.

JAZ-X Code Inspection

#57,550

by jazxinnovation1 month ago

Inspect installed plugins and plugin ZIP files for potentially risky capabilities without executing their code.

AiutoComputerHelp HTTP Header Audit

#57,565

by aiutocomputerhelp29 days ago

Read-only audit of HTTP security headers and related same-site HTTPS behavior returned by your WordPress site.

Shieldome Security Scanner

#57,569

by nemanjashieldome3 days ago

Scan your WordPress site for OWASP Top 10 vulnerabilities directly from the wp-admin dashboard, powered by Shieldome.

Aystat Honeypot Admin

Up in the last 7 days:10,125#57,590

by stonemanhero1 month ago

A secure honeypot to trap bots and malicious actors by faking an admin login page.

Janric Simple Attack Monitor

Up in the last 7 days:7,480#57,603

by keithlunt4 months ago

Lightweight attack detection for WordPress. Logs brute force, XML-RPC abuse, SQL injection, XSS attempts and more. No bloat, no blocking — just data.

Permanent User Password

Up in the last 7 days:2,954#57,626

by Fahid Javid11 months ago

A light-weight WordPress plugin that empowers administrators to set permanent passwords for users on their websites.

Aardwolf Security Scanner

Up in the last 7 days:6,319#57,686

by aardwolfsec3 months ago

Free WordPress security scanner. Audit your site for vulnerabilities, weak settings and exposed files, with a clear fix for every issue found.

Traffic Origin Guard

Up in the last 7 days:6,317#57,698

by jasond7274 months ago

Protect your WordPress origin by requiring a secret request header and blocking direct access with Apache .htaccess rules.

UpdateProof

#57,918

by zerofrik26 days ago

Create a local WordPress safety snapshot, run preflight checks, review updates, and optionally compare screenshots before maintenance.

Upgrade Pilot

Down in the last 7 days:9,066#57,923

by Luke W18 days ago

PHP compatibility scan, per-plugin update freeze, and alerts when a plugin changes owner, goes abandoned, or is closed for security.

Angry Launch Guard

#57,941

by Nikiforos Bafas28 days ago

Pre-launch audit for agencies and freelancers. One click checks everything before you hand over a WordPress or WooCommerce site.

Notify.domains Domain Monitor

#57,963

by notifydomains1 month ago

Proactive protection for the domain your WordPress site runs on. Expiry, hijacking, and outages, in the dashboard.

Brightery Absolute Comment Blocker

Down in the last 7 days:9,062#57,975

by Brightery4 months ago

Completely disables all backend comment submissions (wp-comments-post.php, REST API, XML-RPC) to stop ghost comment spam.

Ace Login Block

Down in the last 7 days:6,769#57,987

by ShaneRounce18 days ago

Design your login page in the block editor, with passkeys, two-factor authentication and lockout protection built in.

Prunekit

Up in the last 7 days:4,348#58,039

by nimboo17 days ago

Switch off the parts of WordPress you don't use. Safe defaults, one-click recommended settings, nothing changes until you turn it on.