Best security plugins for WordPress

OrioleOne Compliance Assessment

Up in the last 7 days:6,460#66,319

by OrioleOne1 month ago

A benchmark-driven compliance assessment plugin for Cisco IOS XE configurations.

BrenWP Client Safe Mode

Up in the last 7 days:1,765#66,351

by Brendigo10 months ago

Per-user Safe Mode plus role-based client restrictions for safer troubleshooting and cleaner client handoff.

Flex Website Security

Down in the last 7 days:10,878#66,364

by Flex Plugins1 month ago

Practical WordPress hardening: login limits, XML-RPC, headers, enumeration protection, and more.

HIPAA Compliance Helper for Contact Form 7

Down in the last 7 days:6,103#66,379

by mjplugins261 month ago

Adds technical safeguards to Contact Form 7 for sites that collect protected health information (PHI).

Geotrixe Content Protector & Image Watermarker

Up in the last 7 days:1,764#66,407

by geotrixe11 months ago

Protect your WordPress content by disabling right-click, text selection, copy/paste shortcuts, and image dragging. Includes image watermarking.

Brightery File Lockdown

#66,437

by Brightery2 months ago

Locks down code-changing capabilities and restricts WordPress uploads to approved media types.

Nubivio Security Headers, security.txt & NIS2 Compliance for Healthcare

Down in the last 7 days:5,353#66,487

by nubivio4 days ago

Security headers, security.txt, a PHP2Shell runtime check and an optional CRA, GDPR and NIS2 scanner for healthcare WordPress sites.

Weio Site Check

Up in the last 7 days:155#66,516

by weioai1 month ago

Checks HTTPS, SSL expiry, mixed content, core files, PHP in uploads, spam and cloaking signs and WooCommerce checkout, and explains each fix.

NueM8 Safety Pass

#66,533

by Kevin NueM81 day ago

A central health dashboard for WordPress site owners. Instant diagnostic overview of core files, PHP, backups, and your top priority step.

Xerotact SHIELD-X Security

Down in the last 7 days:5,358#66,536

by xerotact14 days ago

Shared-hosting security with WAF logging, opt-in enforcement, malware scanning, login protection, hardening, backups, and audit tools.

StackFirefly

Down in the last 7 days:423#66,556

by StackFirefly1 month ago

Monitor errors, cron, email and performance. Connect ChatGPT, Claude or Codex through MCP to investigate issues.

Arva SEO

Up in the last 7 days:1,619#66,594

by arvaseo7 days ago

PageSpeed fixes you switch on one at a time, a free security scan of your files, and a connection to Arva SEO for health, content and SEO titles.

CYRN Vulnerability Monitor

Up in the last 7 days:6,355#66,595

by cyrn26 days ago

Know when your WordPress core, plugins or themes have a known vulnerability, and fix it in one click. CYRN itself never changes your site.

ExtensionLifeCheck

Down in the last 7 days:15,682#66,620

by themifyx3 months ago

Scan your installed plugins for abandonment risk and discover actively maintained WordPress.org alternatives.

Aftersweep

#66,628

by timaub3 days ago

For after your cleanup of a hacked site: a read-only list of what still looks wrong, and of what the plugin did not look at.

TMS Core Essentials

Down in the last 7 days:6,031#66,655

by entumas1 month ago

Core utilities and shared essentials for TMS WordPress projects.

Relvato

Down in the last 7 days:3,819#66,663

by relvato17 days ago

After every WordPress, plugin, theme or WooCommerce update, Relvato automatically re-tests key pages, checkout, forms, security and speed.

XO Magic Box Light

#66,689

by xodesignworks2 months ago

Speed up, clean up and harden WordPress from one admin. 67 modules instead of a dozen plugins. No telemetry, no external calls, no account.

MisticGate

#66,690

by MistiCuantum3 days ago

MisticGate puts a gate in front of your login page without changing its URL. Without the gate only you know, reaching the login page is very hard.

Semple Sites Deploy

#66,719

by Trize Inc.28 days ago

Turn WordPress into blazing-fast, unhackable static sites. 1-click export to clean ZIP or deploy globally to the Semple edge network.

Rubix Notify

Down in the last 7 days:10,940#66,732

by Vincent Vu2 months ago

Send WordPress login notifications to ntfy when users sign in.

ATV Web Security

#66,737

by atvsoftwarelabs4 days ago

Block persistent changes on a compromised WordPress site — with optional AI-assisted false-positive filtering.

Useful Snippets

Up in the last 7 days:5,677#66,755

by Janos Moga4 years ago

Switch on and off code snippets on your site.

COMPACTO Secure Login Master

#66,855

by Ralph Gonzalez8 months ago

Short Description: Hide wp-login.php and wp-admin, replace with a custom login URL for stronger security.

nnax Web Essentials

Down in the last 7 days:2,969#66,863

by nnaxitloesungen18 days ago

nnax Web Essentials is the free host plugin for shared administration, security, and base features of nnax Web.

CoreMaintain

#66,882

by iflairwebtechnologies11 days ago

CoreMaintain helps you keep your WordPress website fast, clean, and secure from one centralized dashboard.

SLB-Impact Sentinel

#66,917

by spartanlogicbuilders2 months ago

Monitor WordPress plugins for updates, scan changelogs for risk keywords, and get email alerts before a bad update affects your site.

Dragon Activity Log

Up in the last 7 days:6,055#66,925

by Dragon Core1 month ago

A tamper-evident activity log for WordPress. See who changed what, when, and from where, with field-level before/after detail.

Defendium Checker

#66,930

by defendium2 years ago

Defendium is a powerful spam checker plugin for WordPress, integrating with the Defendium API to scrutinize incoming comments for spam.

NoobPress

Down in the last 7 days:9,727#66,956

by Cyrille2 years ago

NoobPress is a plugin here to help beginner user by providing some basic feature any user should have.

Login Security

#66,981

by Christian Zimpel16 days ago

Move your login to a custom URL. wp-login.php and wp-admin answer logged-out visitors with a clean 404 page.

Stoutwall

#66,987

by Pitol4 days ago

Lightweight WordPress hardening with simple switches: limit login attempts, security headers, block PHP in uploads, disable XML-RPC and more.

Rooted Dev Studio Security Toolkit

Up in the last 7 days:2,059#67,013

by bigdawgdad21852 months ago

Practical WordPress hardening, two-factor authentication, login protection, file monitoring, and transparent security checks.

Usama Simple 2FA Authenticator

Up in the last 7 days:3,276#67,025

by usamashahadat11 months ago

A simple, secure 2FA plugin that adds a verification screen after login, requiring a code from your authenticator app.

Clearfy Safe

Up in the last 7 days:6,439#67,036

by techcriterion4 months ago

Safe, conflict-free WordPress optimization: transliteration, performance, security and editor control in one plugin.

CacheSafe for WooCommerce

Down in the last 7 days:11,610#67,055

by Cobalt Branch Labs10 days ago

Check WooCommerce cart caching and session isolation. Investigate cache-related cart problems with controlled scans and sanitized reports.

Loqwall 2FA

Down in the last 7 days:13,404#67,061

by mohamedelaaouam993 months ago

Lightweight Two-Factor Authentication with Email OTP and Authenticator App support. No bloat, no external services.

Defen.so Connector

#67,071

by defenso2 months ago

Firewall, malware & file-change scanner, brute-force protection, rate limiting, plus free uptime + SSL monitoring — one-click connect, no API key.

KUMITATE HOSHU

#67,129

by MOTOKI12 days ago

Security and upkeep with sensible defaults: login limits, two-factor login, hardening, plain-words checks, backups and updates with a backup first.

Dimitridedou

Up in the last 7 days:2,450#67,195

by Dimitris Dedousis1 month ago

Two-factor authentication (2FA) via email using one-time passwords (OTP).

EZDIGI Tool

Down in the last 7 days:15,586#67,198

by EZDIGI4 days ago

All-in-one management toolkit for WordPress: site security, bot blocker, crawler, image optimizer, variation fixer, affiliate manager, live streaming …

Janric Shield

Down in the last 7 days:11,707#67,234

by keithlunt3 months ago

Learns how your admins actually log in, then flags anything that doesn't match — protecting your site without relying on blocklists.

KlyroAudit

#67,258

by Kirtikumar Solanki4 days ago

Diagnose WordPress site health with checks for performance, SEO, security, WordPress configuration, database health, broken links, and accessibility.

Bastion

Down in the last 7 days:5,957#67,273

by Harsene2 years ago

Bastion is a plugin here to help beginner user by providing some basic feature.

Secure Role-Restricted Draft Previews

Down in the last 7 days:4,786#67,320

by Pixy Puala1 year ago

Generate secure, expiring preview URLs for drafts with role/user restrictions. Compatible with FSE, Block Themes, and Classic Themes.

GRUH Log Activity

#67,388

by insideseo1 month ago

Know who changed what on your site, and get warned the moment your header, footer or templates lose their styling.

Authyo OTP for Ninja Forms

#67,409

by Konceptwise Digital Media Pvt Ltd1 month ago

Add OTP verification (Email, SMS, WhatsApp, Voice Call) to Ninja Forms to prevent spam and fake submissions.

Aegis User Guard

#67,454

by Ahnaf0071 month ago

WordPress identity policies for password rules, login lockouts, two-factor authentication, IP controls, and Administrator oversight.

DominoGuard Security

#67,478

by Dominopress1 month ago

Ultra-lightweight WordPress security plugin. Offering robust WAF, 2FA, Malware Scanners, Magic Links, Activity Log & Emergency Recovery Toolkit.

Block Account Create Login by Country GRC

Down in the last 7 days:8#67,482

by Robert G.3 months ago

Blocks unauthorized role logins from restricted countries using local MaxMind databases with automatic daily mirror updates and a manual download butt …