Best security plugins for WordPress

Disabler

Down in the last 7 days:10#7,111

by saas4 months ago

Instead of installing a million plugins to disable features you don't want, why not use just ONE plugin?

WP Disable Site Health

Up in the last 7 days:11#7,150

by WP Academic7 years ago

License: GPLv2 or later Disables new Site Health screen from WP Dashboard

Give

Up in the last 7 days:64#7,327

by Nexcess1 year ago

Reduce donation spam with Cloudflare turnstile, a user-friendly, privacy-preserving alternative to CAPTCHA

Prevent Concurrent Logins

Down in the last 7 days:35#7,336

by Frankie Jarrett10 years ago

Prevents users from staying logged into the same account from multiple places.

BetterShield

Up in the last 7 days:2,437#7,343

by WPDeveloper4 days ago

Free WordPress security audit, thirty one-click fixes you can undo, 2FA, passkeys, login protection and an activity log. No account needed.

REST XML-RPC Data Checker

Down in the last 7 days:6#7,358

by Enrico Sorcinelli4 years ago

REST XML-RPC Data Checker allow to check JSON REST and XML-RPC API requests and grant access permissions.

Atlant Security

Up in the last 7 days:194#7,391

by Alex4 days ago

Enterprise-grade WordPress security: WAF, brute force protection, malware scanner, 2FA, honeypots, AI crawler control, and post-breach recovery.

Easy Basic Authentication

Up in the last 7 days:44#7,484

by Matteo Enna1 month ago

Secure your WordPress site with easy and effective basic authentication. Restrict access, monitor attempts, and enhance security.

.htaccess Site Access Control

Down in the last 7 days:37#7,529

by Miina Sikk10 years ago

Using the password protection will give you extra security layer of protection from brute force hacking attacks. Additionally, it's also an easy …

WP fail2ban Add-on for Contact Form 7

Down in the last 7 days:40#7,650

by invisnet2 years ago

WP fail2ban Integration with Contact Form 7 to log spam form submissions.

SX User Name Security

Down in the last 7 days:45#7,657

by Daniel Roch1 year ago

SX User Name Security prevents WordPress from showing your real Login everywhere. It ovverides the body_class function, User Nicename, Nickname and Di …

Media Vault

Down in the last 7 days:65#7,682

by Max GJ Panas12 years ago

Protect attachment files from direct access using powerful and flexible restrictions. Offer safe download links for any file in your uploads folder.

htaccess protect

Down in the last 7 days:1#7,685

by zoltanlaczko4 years ago

htaccess protect - Protect your wordpress login or admin pages with password.

SameSite Cookies

Up in the last 7 days:10#7,724

by Ayesh Karunaratne3 years ago

CSRF-protection for authentication cookies. When enabled, this plugin makes sure the "SameSite" flag is set in authentication cookies.

WebTotem Security

Down in the last 7 days:181#7,769

by WebTotem1 month ago

WebTotem is a SaaS which provides powerful tools for securing and monitoring your website in one place in easy and flexible way.

Atomic Edge Security

Up in the last 7 days:110#7,782

by shift81 month ago

WordPress firewall with cloud WAF rules, malware scanning, 2FA, vulnerability checks, IP blocking, and real-time security logs.

Plugin Security Scanner

Down in the last 7 days:25#7,883

by Glen Scott7 years ago

This plugin alerts you if any of your plugins have security vulnerabilities. It does this by utilising the WPScan Vulnerability Database once a day.

Protect Login

Up in the last 7 days:15#7,902

by Simon Kraft4 months ago

Add an additional layer of protection to your WordPress login and make sure bad actors have a hard time guessing your user's login credentials.

Security.txt Manager

Up in the last 7 days:62#7,919

by handyplugins2 months ago

Create and manage your security.txt from within WordPress. The easiest way to manage security policy.

Update Notifier

Up in the last 7 days:20#8,068

by Jon Cave16 years ago

Sends email notifications if a new version of WordPress available. Notifications about updates for plugins and themes can also be sent.

User Session Control

Up in the last 7 days:3#8,106

by Frankie Jarrett10 years ago

View and manage all active user sessions in a custom admin screen.

Block wp-login

Down in the last 7 days:38#8,394

by Olly Campion1 month ago

Blocks direct access to wp-login.php and replaces it with a secret login URL to reduce brute-force traffic on Apache servers.

LH HSTS

Down in the last 7 days:22#8,501

by shawfactor6 years ago

HSTS is HTTP Strict Transport Security, a means to enforce using SSL even if the user accesses the site through HTTP and not HTTPS.

Edit Lock

Down in the last 7 days:14#8,709

by doublejar4 years ago

Disable page editing on selected pages, to protect the pages from accidental or unwanted changes that might break your site.

Simple Password Protect

Up in the last 7 days:95#8,743

by Desk9 Design28 days ago

Protect your entire WordPress site with a simple password. GDPR-compliant with modal links for legal pages.

Whitelist IP For Limit Login Attempts

Down in the last 7 days:63#8,747

by Svetoslav Marinov10 years ago

This plugin allows you whitelist IP addresses so Limit Login Attempt plugin doesn't block them.

Auto SRI

Down in the last 7 days:96#8,788

by zfir7 months ago

Automatically adds Subresource Integrity (SRI) to external scripts/styles and safely excludes Google reCAPTCHA and Google Fonts.

Logout Clear Cookies

Up in the last 7 days:23#9,016

by Joel3 years ago

Clears all domain cookies on logout. Because leaving a trail of cookies is bad.

WP fail2ban Add-on for Gravity Forms

Down in the last 7 days:662#9,144

by invisnet2 years ago

WP fail2ban integration with Gravity Forms to log spam form submissions.

AI Scrape Protect

Up in the last 7 days:175#9,222

by Daan Verbaan1 month ago

Protect your website from AI scraping by adding opt-out instructions to your robots.txt file and including meta tags in the HTML ``.

CMS ADMINS Security Check Report

Up in the last 7 days:67#9,253

by Patrick Schlesinger17 days ago

Read-only security audit for WordPress: 62 checks including PHP2Shell, an A to F grade, and a checklist that records what you have fixed.

Rublon Multi-Factor Authentication (MFA)

Down in the last 7 days:36#9,326

by Rublon2 months ago

Instant account security with effortless multi-factor authentication via Mobile Push, Mobile Passcode (TOTP), WebAuthn/U2F Security Keys, and more.

Security Ninja For MainWP

Down in the last 7 days:12#9,327

by Lars Koudal12 days ago

See Security Ninja vulnerabilities and security test results in your MainWP dashboard.

Easy IP Blocker

Up in the last 7 days:87#9,332

by Carl Alberto6 months ago

Quickly block unwanted IPs in your WP site with CDN/proxy-aware IP detection

Blue Captcha

Up in the last 7 days:16#9,336

by jotis2 months ago

Blue Captcha is a powerful and highly customized WordPress plugin that effectively protects your WP blogs from spammers and unwanted persons.

Maestro Connector

Down in the last 7 days:49#9,359

by Bluehost3 years ago

Give trusted web professionals admin access to your WordPress account. Revoke anytime.

Teydea Login Security

Up in the last 7 days:107#9,361

by Teydea Studio10 days ago

Define and enforce password policies for your WordPress site with length, complexity, and expiration rules.

Comment Form CSRF Protection

Up in the last 7 days:8#9,363

by Ayesh Karunaratne3 years ago

Prevent Cross-Site Request Forgery attacks on your comments form.

Disable File Editor

Down in the last 7 days:290#9,383

by Nikunj Soni1 year ago

This plugin will disable file editing tool in your WordPress admin panel.

Host Header Injection Fix

Down in the last 7 days:17#9,400

by Jeff Starr5 days ago

Sets custom headers for WP notification emails. Also fixes a security issue with WP versions < 5.5.

WP Login Door

Up in the last 7 days:5#9,410

by toxnico1 year ago

Adds a secret URL key to access the login page and lets you disable XML-RPC, protecting against bruteforce attacks.

Security Header Generator

Down in the last 7 days:29#9,451

by Kevin Pirnie1 month ago

This plugin generates the proper security HTTP response headers to keep your site secured.

Hide WordPress Version

Up in the last 7 days:7#9,501

by Adam Harley (Kawauso)15 years ago

Removes your WordPress version from various places.

Trusona for WordPress

Up in the last 7 days:47#9,517

by Trusona3 months ago

FREE passwordless 2FA login for WordPress. Secure your admin account with one-click install.

Passwords Evolved

Down in the last 7 days:199#9,541

by Carl Alexander1 year ago

A reimagining of WordPress authentication using modern security practices.

WP Author Security

Down in the last 7 days:21#9,610

by mgm security partners GmbH3 years ago

Protect against user enumeration attacks on author pages and other places where valid user names can be obtained.

WP Logout Redirect

Up in the last 7 days:80#9,691

by HasinHayder10 months ago

A simple yet powerful plugin that redirects users to a custom URL after logout. Featuring a modern, accessible admin panel with dark mode support.

Control XML-RPC publishing

Down in the last 7 days:30#9,712

by Mark-k11 years ago

Control remote publishing with XML-RPC from the writing settings page.

Disable Registration Page

Down in the last 7 days:19#9,775

by Derick Payne8 years ago

Disable the default WordPress registration page without disabling user registration.

Checkout Shield for WooCommerce

Up in the last 7 days:1#9,892

by carticy2 months ago

Blocks scripted checkout attempts that never loaded your checkout page, including card testing bots that skip CAPTCHA. Classic and block checkout.