Best security plugins for WordPress

Wonderful Secure Cleanup

Up in the last 7 days:85#20,041

by wonderfulplugins17 days ago

A simple way to clean and secure WordPress by disabling unnecessary features like comments, XML-RPC, and RSS feeds.

MailCheck.ai

Down in the last 7 days:239#20,043

by tompec2 years ago

Prevent disposable email addresses from registering or commenting on your site with MailCheck.ai.

Vulnerability Monitor for the EU Cyber Resilience Act

Up in the last 7 days:476#20,050

by Mecanik Dev Ltd4 months ago

EU Cyber Resilience Act readiness for WordPress: build a CycloneDX SBOM, monitor vulnerabilities and export the documents auditors require.

Content Guard Pro

Up in the last 7 days:266#20,139

by contentguardpro2 months ago

Scan your WordPress database for hidden SEO spam, pharma hacks, malicious scripts, iframes and spam links in posts and blocks.

Rate Limit Guard

Down in the last 7 days:42#20,173

by IP Stresser Guard1 year ago

This plugin safeguards your website from Layer 7 DDoS attacks and IP stressors by utilizing a rate limiting feature.

Locktura Security

#20,226

by Alain Lankers1 day ago

Protect WordPress with a local firewall, login security, 2FA, file checks, activity logs, and alerts. No account or license required.

IP Whitelist

Down in the last 7 days:43#20,460

by Awesoft29 days ago

Restrict the WordPress admin area and login page to trusted IP addresses and ranges (IPv4, IPv6 and CIDR).

Iron Security

Down in the last 7 days:296#20,516

by WpIron1 year ago

Hardening tool that blocks hackers and protect against: Brute Force Attacks, Exploits, Injections, Clickjacking and other important functionalities.

Bastora Security Audit

Down in the last 7 days:65#20,600

by Bastora1 day ago

62-Punkte-Sicherheits-Check mit Firewall, Schadcode-Scanner, URL-Reputation, Captcha, Schwarm-Schutz und Auto-Reparatur der WordPress-Kerndateien.

HTML Purified

Up in the last 7 days:301#20,623

by John Godley14 years ago

HTML Purified replaces the default comments filters with the more secure HTML Purifier.

Royal AI Firewall

Up in the last 7 days:544#20,647

by Royal Plugins1 month ago

See every AI agent on your site. Decide who gets your content — block, allow, or log-only for GPTBot, ClaudeBot, PerplexityBot, and 60+ others.

Proactive Security Suite

#20,836

by ITCS1 year ago

Welcome to the ProActive Security Suite Plugin Wiki Enhance your WordPress website's security with the ProActive Security Suite.

MoeSec Security

#20,838

by MoeSec2 months ago

MoeSec Security is a comprehensive plugin for Malware Scanning, Monitoring, Integrity, Security Hardening and Protection.

Prevent Password Reuse

Up in the last 7 days:311#20,843

by simonbbrown12 years ago

This plugin keeps records of your users hashed passwords in order to prevent them from reusing their current or a previous password

Zaygl IP blocker and anti-DDoS

Down in the last 7 days:116#20,889

by zoyakn3 months ago

Log visitor IPs, monitor traffic, and block IP addresses in WordPress with an easy and lightweight IP blocker.

MyNew Registration Lockdown

Down in the last 7 days:50#20,894

by mynewtechnologies2 months ago

Blocks unauthorized WordPress user creation at the shared insertion layer while preserving approved administrator and WP-CLI workflows.

Gauntlet Security

Down in the last 7 days:238#20,897

by Cornelius Bergen10 years ago

Performs a detailed security analysis of your WordPress installation. Provides specific instructions on how to make your site more secure.

Liveupx Security

Up in the last 7 days:9#20,908

by Liveupx3 months ago

Complete WordPress security — Firewall, 2FA, Malware Scanner, Vulnerability Scanner, Login Protection, Security Headers. 100% free.

WP jCryption Security

#20,920

by andreyk11 years ago

Prevents forms data against sniffing network traffic through encryption provided by jCryption javascript library.

XMLRPC Lockdown by AO Digital

Down in the last 7 days:845#20,949

by aodigitalau1 year ago

XMLRPC Lockdown by AO Digital is an advanced security plugin for WordPress. It blocks access to xmlrpc.php for all requests except those explicitly al …

Deny All Firewall

#20,964

by Olly Campion1 month ago

Stop unwanted requests before WordPress loads. Deny All Firewall uses .htaccess to allow genuine content and refuse everything else.

EDH Bad Bots

Up in the last 7 days:199#21,066

by EncodeDotHost5 months ago

A smart WordPress plugin that automatically blocks malicious bots and crawlers that ignore your site's robots.txt file.

SacksonWeb Data

#21,089

by ehops329 months ago

A comprehensive WordPress plugin that monitors security issues, performance issues, and WordPress settings that should be reviewed for potential impro …

Strict CSP

Up in the last 7 days:181#21,116

by Weston Ruter2 months ago

Enforces a Strict Content Security Policy on the frontend and login screen to help mitigate any XSS vulnerabilities.

Failed Login Firewall reporting

#21,119

by Anton Aleksandrov4 years ago

Report failed logins to centralized database and block IPs on firewall level!

Profiless

Down in the last 7 days:248#21,124

by firebird757 years ago

Profiless is a plugin that removes access to the profile page based on user role.

JTZL's Bot Maze

Up in the last 7 days:674#21,272

by jtzl2 months ago

AI bot protection through invisible trap link mazes — hidden links lure bots into a maze of fake content for detection and blocking.

Kreiswolke Maintenance Agent Toolkit

Down in the last 7 days:44#21,295

by KREISWOLKE1 month ago

The agent's toolkit for remote & safe WordPress maintenance: snapshots, updates, stack management, health checks, rollbacks, recovery, and hardening

SentraIP

Up in the last 7 days:379#21,303

by moveforwardltd1 month ago

Block unwanted traffic by country, known bots, custom User-Agents and spam-comment IPs, using fast offline MMDB lookups. No account required.

Globaliser

Up in the last 7 days:154#21,305

by Globaliser5 days ago

This plugin enables Globaliser Cloud's services for Globaliser clients' WordPress sites.

Access Defender

Up in the last 7 days:325#21,311

by Huzaifa Al Mesbah1 year ago

Advanced VPN & proxy blocker for WordPress. 99.9% accuracy, multi-API rotation, real-time monitoring. Protect against fraud & spam.

Botfaqtor Code

Down in the last 7 days:227#21,375

by botfaqtor1 year ago

Интеграция сервиса Botfaqtor для защиты сайта от ботов.

Secure Uploads

Up in the last 7 days:239#21,385

by njkuiper69 years ago

This plugin will put blank index.php in every sub-directory of your wp-content/uploads folder to prevent people from browsing the directories and stea …

Flex SSL

Up in the last 7 days:186#21,412

by Flex Plugins1 month ago

Force HTTPS, update site URLs, and add security headers. Supports reverse proxies, certificate checks, and lock-out recovery.

Clear Logout

Down in the last 7 days:32#21,422

by Ayesh Karunaratne3 years ago

A tiny WordPress plugin to clear all browser data related to the site upon logout (With Clear-Site-Data header).

Performance & Security

Up in the last 7 days:97#21,455

by JMR.codes18 days ago

A site manager's toolkit. Settings to modify WordPress and improve performance and security.

Traffic Jammer

Up in the last 7 days:339#21,473

by Carey1 year ago

Safeguard your site from malicious activity and unwanted visitors by effortlessly managing IP blocks through the dashboard or command line ingerface.

Secure XML-RPC

Down in the last 7 days:186#21,501

by Eric Mann12 years ago

More secure wrapper for the WordPress XML-RPC interface.

Files Fence

Down in the last 7 days:61#21,521

by aixeiger3 years ago

Detect if a wordpress core files are changed and if a unwanted file(s) are uploaded or created in wordpress folders different to wp-content

Pinny’s REST Lock

#21,533

by Pinny Fried1 month ago

Prevents public access to REST API user endpoints while allowing authorized roles.

Simple IP Logger

Down in the last 7 days:138#21,641

by ネトデジ編集部1 year ago

ページ単位でアクセスIPアドレスを記録する軽量プラグイン。アクセス傾向の監視、不要なIPのフィルタリング、広告トラフィックの検証に役立ちます。

2IZI SmartCaptcha for Yandex

Up in the last 7 days:493#21,804

by 2izi2 months ago

Yandex SmartCaptcha protection for WordPress, WooCommerce and Contact Form 7.

BaseCloud Shield

Up in the last 7 days:22#21,871

by BaseCloud2 months ago

Enterprise-grade Two-Factor Authentication (2FA) with support for Email, SendGrid API, Webhooks, WhatsApp, and SMS delivery.

WP Emails Encoder

Down in the last 7 days:36#21,971

by .fay10 years ago

Encode emails to avoid spams. Template to use [@encode@ email="ilove@gmail.com" display="Gmail Lover"]

Advanced Passkeys for Secure Login

Up in the last 7 days:484#22,039

by wppasskey1 month ago

Add secure passwordless passkey login with Face ID, Touch ID, Windows Hello, and hardware keys.

Did someone clone me?

Down in the last 7 days:239#22,050

by didsomeonecloneme2 years ago

Did someone clone me protects your website and visitors against phishing attacks. It will send you a notification when someone clones your website.

Admin Notify

Down in the last 7 days:540#22,096

by Eliyahna1 month ago

Short Description: Admin Notify sends email notifications when any user account is added, has their password changed, has their role changed, or is de …

Dolutech Blacklist Protect

Down in the last 7 days:305#22,102

by Lucas Catão Moraes1 year ago

Proteção avançada WordPress: blacklists automáticas, bloqueio por país (MaxMind), anti força bruta, reCAPTCHA e proteção XML-RPC.

SiteCare

Up in the last 7 days:124#22,109

by SiteCare4 days ago

Know the instant a plugin, theme or WordPress core has a known security hole - with a security score and clear fixes. Patch before attackers do.

Simply Change Author URL

Down in the last 7 days:99#22,111

by Devi4 years ago

Changes wordpress user slug for security, it prevents access to the usernames of registered users on your site.