Best security plugins for WordPress

Lockora Security Audit

Down in the last 7 days:116#12,718

by Guido Schad1 month ago

Lockora Security Audit checks WordPress security posture, hardening, core integrity, vulnerabilities, and optional AI reports.

Integrity Checker

Down in the last 7 days:16#12,788

by Erik Torsner2 months ago

The WordPress Integrity Checker checks your WordPress installation by detecting modified files, permissions issues and other common problems. trnk

Protector

Up in the last 7 days:22#12,909

by Marcello Ruoppolo6 months ago

Protect your WordPress. The ultimate lightweight security suite. Block brute-force attacks, auto-repair infected core files, hide your login URL, set …

Specify a Vary

Up in the last 7 days:34#12,924

by lithiumsixteen8 years ago

This plugin fixes a "Vary: Accept-Encoding Header" message and boosts website performance.

WP Remove Generator Meta Tag

Up in the last 7 days:38#12,943

by meagan hanes10 years ago

This plugin is designed to insert a piece of code into your WordPress website, which will automatically remove the WordPress version from your header.

Value-Auth Two Factor and Access Control

Down in the last 7 days:137#13,010

by gmodigirock5 days ago

メールやSMSを利用した２段階認証や、IP制限等によるアクセス制御を導入するためのプラグインです。

Fleet Agent Site Manager

Up in the last 7 days:195#13,273

by Mosamlife7 days ago

Securely connects this site to a WPMgr dashboard, self-hosted or hosted, so backups, updates, security and speed all run from one screen.

ReportedIP Hive

Up in the last 7 days:577#13,339

by Patrick Schlesinger6 days ago

Firewall, limit login attempts, 2FA with passkeys and anti-spam for comments and forms without CAPTCHA. Optional IP blocklist. GDPR-first.

BruteGuard

Up in the last 7 days:1#13,378

by EverPress4 years ago

BruteGuard is a cloud powered brute force login protection that shields your site against botnet attacks.

No User Enumeration

Up in the last 7 days:14#13,413

by Carlos7 years ago

Stop user enumeration for security.

Disable AI for Security

Up in the last 7 days:100#13,416

by WPChef28 days ago

Turns off the WordPress AI connectors for security. Works instantly with no settings — AI is fully disabled for every user role.

Turn Off REST API

Up in the last 7 days:2#13,437

by ksym041 month ago

Disable the WordPress REST API for logged out visitors and lock down your /wp-json endpoints, with a per route allow list so you stay in control.

Lumturio WP Monitor

Down in the last 7 days:94#13,531

by lumturioteam4 years ago

Lumturio offers users and agencies powerful and reliable tools to monitor CMS security.

DM Confirm Email

Up in the last 7 days:11#13,551

by Michael12 years ago

Protect your wordpress site with spam registration. DM Confirm Email requires new users to confirm their email addresses.

Protect My Infos

Up in the last 7 days:79#13,598

by Yuga Web2 months ago

Protect sensitive information like emails and phone numbers from bots with advanced obfuscation techniques.

Mimi Captcha

Up in the last 7 days:55#13,636

by stevenjoezhang1 year ago

简洁的中文验证码插件。在 WordPress 登陆、注册或评论表单中加入验证码，支持字母、数字、中文和算术形式。 Adds Captcha Code anti-spam methods to WordPress forms. Supports numbers, alphabets and Chine …

A little more secure

Down in the last 7 days:27#13,649

by Palasthotel GmbH1 month ago

Stop bots from brute force hacking your wp-login.php

Unauthorised Login Redirect

Down in the last 7 days:112#13,721

by RS2 years ago

This plugin allows you to effectively hide your wp-login.php and wp-admin by requiring that you access it via a custom URL.

Mail And Content Protect

Down in the last 7 days:69#13,727

by bPlugins2 months ago

Protect emails, phone numbers, URLs, and content from spam and unauthorized access with a customizable Gutenberg block.

Admin username changer

Down in the last 7 days:154#13,780

by yoshitech14 years ago

Change your admin username to whatever you like. Improve your site security and make life difficult for the hackers.

Turn Admin Email Verification Off

Up in the last 7 days:386#13,843

by Arjan Olsder1 year ago

Turn Admin Email Verification Off stops WordPress from asking about e-mail verification every six months or so.

Disable jQuery Migrate

Down in the last 7 days:9#13,866

by ivanblagdan11 years ago

A simple plugin to disable loading of jquery-migrate on the frontend due to a XSS vulerability of jQuery Migrate 1.2.1.

AlmaWeb AI Visitor Analytics

Up in the last 7 days:24#13,910

by AlmaWeb23 days ago

Detect GPTBot, ClaudeBot, Gemini and 200+ AI crawlers. Track which AI bots scrape your content and block unwanted scrapers.

Admin Optimizer

Down in the last 7 days:798#13,941

by yipresser11 days ago

WordPress optimization plugin and all-in-one toolkit for performance, security, SEO, content, media, users, and site management.

Fail2WP

Down in the last 7 days:34#13,974

by joho6821 days ago

WordPress security plugin. Requires WordPress 6.2+ and PHP 7.4+.

Site Health Manager

Up in the last 7 days:7#13,982

by Rami Yushuvaev7 years ago

Control which status tests and what debug information appear in your Site Health screen.

Custom Role Creator (CRC)

Up in the last 7 days:64#14,166

by Ratul Hasan1 year ago

Custom Role Creator plugin allows you to add or change user roles and capabilities easily.

Agency Toolkit

Up in the last 7 days:83#14,199

by inspry14 days ago

Lightweight, modular client-site tools for agencies: security hardening, admin clean-up, notifications and maintenance settings.

HTTPS Image Fixer

Down in the last 7 days:13#14,212

by mitchbartlett8 years ago

Fixes insecure content messages that appear when loading images on an SSL secured website.

Melapress Role Editor

Down in the last 7 days:79#14,268

by Melapress10 days ago

The complete WordPress user roles plugin for everyone

Update History Panel

Up in the last 7 days:43#14,283

by crossandcrown7 months ago

Log WordPress core, theme, and plugin update history and display it on the Updates screen. A REST API endpoint is available for administrators.

Login Require Press

Down in the last 7 days:41#14,504

by Marat Nepomnyashy7 years ago

Easy way to require user login to view specific pages / posts.

Zamok

Up in the last 7 days:28#14,592

by Naiche1 month ago

Debloat, harden, optimize, and back up WordPress — one lean, free, open-source plugin. No tracking, no telemetry, no paid tier.

HT Security

Down in the last 7 days:37#14,638

by WPFastSec3 months ago

Complete Security Suite: Security Headers, CVE Detection, Core Integrity, Login Alerts, Plugin Update Management, Force Cron, and Maintenance Mode.

Password Change Reminder

Down in the last 7 days:16#14,691

by Ralf Albert13 years ago

Password Change Reminder helps to raise the security of your WordPress installation with little effort. It will remind the users to regularly change t …

AIO Tools (All in One Tools)

Down in the last 7 days:168#14,696

by Shost.vn2 days ago

Bộ công cụ All-in-One chuẩn doanh nghiệp giúp bảo mật đa lớp, tăng tốc độ tải trang, tối ưu SEO, SMTP và bứt phá doanh số WooCommerce.

Website Security Check

Up in the last 7 days:48#14,790

by John Darrel6 years ago

Website Security Check detects if your WordPress website has vulnerabilities and security flaws. You get a full report with the list of security issue …

Captcha Ajax

Up in the last 7 days:102#14,829

by Alessandro Lin1 month ago

Captcha with Ajax method for sending code. Logins, Contact forms, Comments, WooCommerce. Firewall and REST API.

Cleverhog Malware Scanner

Up in the last 7 days:255#14,851

by cleverhog1 month ago

Totally free malware scanner with no paid features: find infected files, backdoors, hacked core files, rogue admins and outdated software.

Spam Comment Remover

Down in the last 7 days:13#14,867

by Sahil Dadwal11 months ago

Automatically remove spam comments without Akismet. Universal spam detection that blocks junk, hidden links, fake names, gibberish, and automated subm …

AI Scraping Protector

Down in the last 7 days:80#14,919

by Debashish Mondal1 year ago

Protect your WordPress content from AI scraping bots with advanced detection, rate limiting, and security measures.

SecuSeek

Down in the last 7 days:59#14,983

by SecuSeek11 months ago

Professional web security scanning and vulnerability assessment plugin. Comprehensive security analysis, real-time threat detection, and detailed secu …

Admin SSL

Up in the last 7 days:72#14,993

by blenjee15 years ago

Admin SSL secures login page, admin area, posts, pages - whatever you want - using Private SSL.

Destino Access Audit

Up in the last 7 days:49#15,005

by destinoexterior1 month ago

Audit who has access to your site: Application Passwords, admin accounts, and connected remote management tools in one dashboard.

WP Shieldon

Up in the last 7 days:122#15,065

by Terry L.3 years ago

WP Shieldon is a WordPress security plugin based on Shieldon library, a Web Application Firewall (WAF) for PHP.

Country Block

Up in the last 7 days:63#15,092

by vpndeals2 months ago

Block or allow access by country using a local MaxMind GeoLite2 database, with IP, user role, and URL exceptions.

一介資男(Mxp.TW) 開發工具箱

Up in the last 7 days:1,205#15,194

by mxptoday

WordPress 開發與維運工具箱，整合外掛安裝、資料庫維護、搬站輔助、安全片段、站點管理與前端問題回報。

RegiVigil

Up in the last 7 days:135#15,269

by David Siemers2 months ago

Local protection against spam and fake WordPress and WooCommerce accounts with user scanning, whitelists, logs and scheduled reports.

Polar Mass Advanced IP Blocker

Up in the last 7 days:184#15,303

by polarmass1 year ago

Automatically block threats at the network level by forwarding Wordfence-detected IPs to Cloudflare.

BF Secret File Downloader

Up in the last 7 days:48#15,346

by BREADFISH1 month ago

Manage and provide download functionality for files in secure, auto-generated directories.