Best security plugins for WordPress

No CAPTCHA reCAPTCHA

Down in the last 7 days:3#3,399

by Collins Agbonghama6 years ago

Protect WordPress login, registration, comment and BuddyPress registration forms with Google's No CAPTCHA reCAPTCHA.

RSFirewall!

Up in the last 7 days:7#3,462

by RSJoomla!7 days ago

Based on the success of the most popular firewall for Joomla!, RSFirewall! is now available to protect your WordPress website as well.

Simple Login Lockdown

Down in the last 7 days:6#3,523

by chrisguitarguy9 years ago

Simple Login Lockdown prevents brute force login attacks/attempts on your WordPress installation.

Limit Attempts by BestWebSoft

Down in the last 7 days:3#3,552

by bestwebsoft9 days ago

Protect your WordPress website from brute force attacks by limiting the number of failed login attempts. Improve security and stop bots.

Vigilant

Up in the last 7 days:62#3,576

by Fernando Tellado1 day ago

Premium WordPress Security - 100% FREE: Firewall, 2FA, Security Headers, Login and Malware Protection, File Monitor, Security Audit & more

WP Anti-Clickjack

Down in the last 7 days:7#3,623

by Andy Feliciotti27 days ago

Protect your WordPress site from clickjacking with X-Frame-Options and CSP frame-ancestors headers plus a frame breaking script.

Dam Spam

Up in the last 7 days:50#3,677

by Web Guy5 days ago

Spam protection for WordPress registration, login, comments, and contact forms.

BotBlocker Security

Down in the last 7 days:13#3,696

by Yevhen Leonidov2 days ago

Complete security platform for everyday: block bots, brute-force, viruses, spam, fake crawlers. WAF, 2FA, no-malware, proactive defense.

WP fail2ban Blocklist

Down in the last 7 days:4#3,729

by invisnet1 year ago

WP fail2ban Blocklist is a collaborative preemptive blocklist for WordPress.

Expire User Passwords

Up in the last 7 days:2#3,896

by Matt Miller5 days ago

Require certain users to change their passwords on a regular basis.

HSTS Ready

Down in the last 7 days:46#3,932

by manu2252 months ago

Enable easily HSTS on your website.

Protection Against DDoS

Down in the last 7 days:7#4,017

by WPChef6 years ago

Protects your login, xmlrpc and RSS feeds pages against DDoS attacks. Denies access to your site from certain countries via CloudFlare.

Advanced IP Blocker

Up in the last 7 days:33#4,056

by IniLerm5 days ago

A complete WordPress security firewall: blocks IPs, bots, countries & ASN. Includes an intelligent WAF, Threat Scoring, Geo-Challenge, and 2FA.

Staatic

Up in the last 7 days:1#4,074

by Team Staatic6 days ago

Use WordPress as your CMS, then publish a fast, lower-exposure static version of your site.

DefendWP Firewall

Up in the last 7 days:5#4,128

by revmakx1 year ago

Get instant protection against vulnerabilities disclosed by security companies.

WP Author Slug

Up in the last 7 days:6#4,156

by Konstantin Obenland2 months ago

Add a layer of security and prevent your login name from being shown in the author archive's URL.

Compromise Scanner for wp2shell

Down in the last 7 days:14#4,207

by eyesecurity3 months ago

Read-only forensic scanner for the WordPress core exploit chain CVE-2026-63030 / CVE-2026-60137 (wp2shell). Reports a scored verdict; changes nothing.

Lock Down Admin

Down in the last 7 days:20#4,271

by Fullestop7 years ago

Lock Down Admin plugin secure your WordPress admin panel. It locks the wp-admin url and if this plugin is activated then user can't login in the …

CrowdSec

Up in the last 7 days:23#4,303

by CrowdSec - lightweight and collaborative security engine10 months ago

This plugin blocks detected attackers or displays them a captcha to check they are not bots.

Smart User Slug Hider

Up in the last 7 days:1#4,320

by WP User Manager16 days ago

Hide usernames in Author Pages URLs to enhance Security

WP-WebAuthn

Down in the last 7 days:88#4,370

by Axton6 months ago

WP-WebAuthn enables passwordless login through FIDO2 and U2F devices like Passkey, FaceID or Windows Hello for your site.

Advanced Country Blocker

Down in the last 7 days:6#4,527

by brstefanovic9 months ago

An advanced security plugin that blocks website visitors by country, with additional features like blacklisting, logging blocked attempts, admin bypas …

WP Admin Basic Auth

#4,595

by Stocker_jp13 years ago

Enabling this plugin allows you to set up Basic authentication on your admin page using your WordPress user name and password.

Smart Passworded Pages

Down in the last 7 days:6#4,628

by Brian Layman9 years ago

Create central "Enter your password" page and the password entered determine which page the user sees next.

WebAuthn Provider for Two Factor

Up in the last 7 days:94#4,805

by Volodymyr Kolesnykov25 days ago

WebAuthn authentication provider for Two Factor plugin.

Content Security Policy Manager

Down in the last 7 days:4#4,847

by Patrick Sletvold4 years ago

Plugin for configuring Content Security Policy headers for your site. Allows different CSP headers for admin, logged inn frontend and regular visitors

No-Bot Registration

Down in the last 7 days:7#4,904

by Arnan de Gans10 months ago

Prevent bots from creating accounts by blacklisting domains and usernames and present people with a human friendly security question.

Simple Automatic Updates

Down in the last 7 days:10#4,999

by Jon Tejnung7 years ago

Activate automatic updates or weekly notifications for the site.

Virusdie

Down in the last 7 days:12#5,020

by Virusdie2 months ago

Malware scanning & removal, website hardening, patching vulnerabilities, real-time protection against online attacks, blacklist monitoring in a click!

Universal Honey Pot

Up in the last 7 days:13#5,089

by Ludwig You1 year ago

Universal Honey Pot is a powerful and user-friendly WordPress plugin that provides a plug-and-play solution for protecting your forms against unwanted …

Logbook

Up in the last 7 days:14#5,249

by Takayuki Miyauchi8 years ago

This plugin is for logging users' activities. You can check anytime who and what has changed.

Remove XML-RPC Methods

Up in the last 7 days:7#5,314

by Walter Ebert2 months ago

Remove all WordPress methods from the XML-RPC API to increase security.

Restrict Usernames Emails Characters

Down in the last 7 days:17#5,451

by Benaceur26 days ago

Restrict the usernames, email addresses, characters and symbols or email from specific domain names or language in registration ...

App for Cloudflare®

Down in the last 7 days:66#5,656

by digitalpoint27 days ago

All things Cloudflare (caching, flexible SSL, Turnstile, settings, rules, analytics, media in R2, image transforms [AVIF, WebP], secure admin area).

Keyring

Up in the last 7 days:6#5,711

by Beau Lebens3 years ago

An authentication framework that handles authorization/communication with most popular web services.

Banhammer

Down in the last 7 days:9#5,755

by Jeff Starr4 days ago

Monitor traffic and ban unwanted visitors. Block any user or IP address so they can't access your site.

Hide WP

Down in the last 7 days:32#5,788

by kursorA10 years ago

Hide WP

Proxy & VPN Blocker

Down in the last 7 days:40#5,818

by Proxy & VPN Blocker2 months ago

Block VPNs, proxies, Tor, and spam on WordPress. Strengthen security and stop fake users with smart IP blocking via proxycheck.io.

GD Security Headers

Down in the last 7 days:25#5,908

by Milan Petrovic6 months ago

Configure various security-related HTTP headers, including CSP, XSS, Referrer Policy and more.

Block IPs for Gravity Forms

Down in the last 7 days:9#5,911

by brightvesseldev1 month ago

Block IPs in your gravity forms

Disable WP Registration Page Spam

Down in the last 7 days:8#5,913

by Subodh Ghulaxe2 years ago

Disable default WordPress registration page, remove register link and stop registration spam, without disabling user registration.

NETSENSAI Shield

Down in the last 7 days:4#6,068

by Rafal Gierlicki2 months ago

Hardens and protects your site by locking down login, REST API, XML‑RPC, file editor, and applying HTTP security headers.

Password Strength for WooCommerce

Down in the last 7 days:6#6,089

by WP Zone2 years ago

Disables password strength enforcement in WooCommerce.

CloudGuard

Down in the last 7 days:33#6,262

by pipdig1 month ago

Use Cloudflare's free geolocation service to restrict access to your site's login page.

Injection Guard

Down in the last 7 days:2#6,330

by Fahad Mahmood9 days ago

Blocks malicious and unknown query-string requests, detects injection attempts, and audits user capabilities and sessions.

WebDefender Security

Down in the last 7 days:4#6,538

by CobWeb Security Ltd.9 months ago

PRO Security – Antivirus Scanner, 2-Layer Protection Hide Security, Brute Force Security & Antispam, Security Website and Security Hardening.

WP Helper Premium

Down in the last 7 days:21#6,588

by Mat Bao Corporation2 months ago

All-in-one WordPress toolkit: contact channels, SMTP, maintenance, AI, spam filter, WooCommerce — one plugin.

JetHost Total Care

Up in the last 7 days:46#6,742

by JetHost6 months ago

JetHost Total Care simplifies WordPress management by consolidating features like security, site enhancements and performance into a single plugin.

iControlWP

Down in the last 7 days:19#6,979

by Paul13 days ago

Manage all your WordPress sites in one place - updates, uptime, backups & security.

Subresource Integrity (SRI) Manager

Up in the last 7 days:19#7,083

by Meitar6 years ago

Adds Subresource Integrity (SRI) attributes to your page's elements for better protection against JavaScript DDoS attacks.