WordPress Security Plugins: Which One to Install

Install Wordfence Security. It is the one plugin that covers what most WordPress sites actually need in a single install: a web application firewall, a malware scanner that checks core, theme and plugin files against known signatures, and login protection with passkeys and two-factor authentication. It is free, it runs on 5+ million sites, and it is the right choice for most people.

Then add UpdraftPlus for backups. A firewall lowers the odds of a break-in; a backup is the only thing that undoes one. Two plugins, both free, and your site is in better shape than most of the internet.

If you would rather not run Wordfence, All-In-One Security (AIOS) does the same job well. Install one or the other, never both, because two firewalls on one site tend to fight each other.

Also read: the best WordPress anti-spam plugins for the comment and registration side of this.

Six security plugins to delete today

These six are no longer in the WordPress plugin directory. That matters more than any feature comparison, because a withdrawn plugin keeps running, keeps looking healthy in your dashboard, and will never prompt you to upgrade. It is a worse position than having no security plugin at all. If you find one of these in your plugin list, deactivate it and delete it.

• Ultimate Security Checker – closed 24 March 2025 over a security issue. Last version 4.2, tested only to WordPress 4.9.31. Check on WordPress.org

• Rename wp-login.php – closed 13 June 2022 over a security issue. Last version 2.6.0, tested only to WordPress 5.2.26. Deactivating it restores the standard wp-login.php address, so make a note of that before you remove it. Check on WordPress.org

• SmartFilter Security – closed 17 May 2022 for a guideline violation. Last version 1.8, tested only to WordPress 3.5.2. Check on WordPress.org

• 6Scan Security – closed 12 March 2020 for a guideline violation. Last version 3.0.6, tested only to WordPress 4.0.38. Check on WordPress.org

• WangGuard – closed permanently on 2 January 2019 at its author’s request. The wangguard.com API service it relied on is gone, so even an installed copy has nothing to check registrations against. Check on WordPress.org

• Centrora Security – closed 19 October 2018 for a guideline violation. Last version 7.4.9, tested only to WordPress 4.8.30. Check on WordPress.org

To audit the rest of your plugin list, open wordpress.org/plugins/ followed by each plugin’s slug. A red notice saying the plugin has been closed means remove it. A warning that it has not been tested with the latest three major releases of WordPress means start looking for a replacement.

Pick by what you need

1. Wordfence Security – best for most people

Wordfence is the most complete free security plugin in the directory and, at 5+ million active installations with a 4.7 out of 5 rating from 4,989 reviews, the most widely deployed. You install it, run the first scan, turn on two-factor authentication for your admin accounts, and you have covered the three attacks that actually reach small sites: credential stuffing, known plugin vulnerabilities and injected files.

What you get in the free version:

• Web application firewall with rule updates
• Malware and file-integrity scanning against core, theme and plugin files
• Login security including passkeys, two-factor authentication and CAPTCHA
• Live traffic monitoring
• IP, country and hostname blocking
• Multisite compatible

The trade-off: the scanner is thorough and it is not free of charge in CPU terms. On cheap shared hosting a full scan can be noticeable, so schedule it for a quiet hour rather than leaving it on the default.

One thing Wordfence does not do is make your site faster. It has no caching layer at all, and the Falcon Engine cache it shipped years ago is no longer part of the plugin. If you want faster page loads, that is a separate caching plugin’s job.

Get Wordfence Security on WordPress.org

2. All-In-One Security (AIOS)

Published by David Anderson and Team Updraft, and the strongest free alternative to Wordfence. It suits anyone who wants a long list of hardening switches to work through rather than one dashboard that decides for them, and it is noticeably lighter on scanning than Wordfence is.

You may remember it as All In One WP Security & Firewall. Same plugin, current name.

Key features:

• Account and login security, including brute-force protection
• File-system and database hardening
• Firewall rules and IP blocking
• Security scanner and change detection
• Comment spam prevention
• Backup and restore for .htaccess and wp-config.php

The trade-off: the sheer number of options is the point and also the risk. Some of the hardening settings can lock you out of your own admin if you enable them without reading, so change one thing at a time.

Get All-In-One Security on WordPress.org

3. NinjaFirewall (WP Edition)

A genuine web application firewall that happens to install like a plugin. It filters requests before they reach WordPress or any of your other plugins, which is a meaningfully stronger position than a firewall running inside WordPress itself. At 4.9 out of 5 across 220 reviews it carries the highest rating here.

Best for: a site that has already been attacked, or one where you run plugins you do not fully trust. Filtering ahead of PHP execution means a vulnerable plugin never sees the request.

Key features:

• Request filtering ahead of PHP execution
• Protection against code and SQL injection and brute-force scanners
• Multisite support
• Activity log and statistics
• Email alerts and event notifications

The trade-off: it expects more of you than Wordfence does. There is no friendly onboarding, and getting the most from it means understanding what you are filtering.

Get NinjaFirewall on WordPress.org

4. Kadence Security

If you came here looking for iThemes Security, this is where it went. The plugin is now published as Kadence Security by Nexcess, at 700,000+ active installations and 4.6 out of 5 from 3,990 reviews. Its focus has narrowed since the iThemes days: it is a login and credential security plugin now rather than a do-everything suite.

Best for: a site with several editors and authors, where the realistic risk is a weak password rather than a clever exploit.

Key features:

• Two-factor authentication
• Brute-force protection
• Password policies and enforcement
• User security monitoring

Its listing shows it tested to WordPress 7.0.4 rather than the latest release, which is well within normal maintenance and does not trigger the directory’s untested warning. If you want to restyle the login screen your users see as well as protect it, our roundup of custom login plugins for WordPress covers that side.

Get Kadence Security on WordPress.org

5. WP Activity Log

Formerly WP Security Audit Log, now published as WP Activity Log by Melapress, on 300,000+ sites. It keeps a record of what happened on your site: who logged in, who changed a user role, who edited which post, which login attempts failed.

Best for: any site more than one person can log into. An audit log will not stop an attack, but it is the difference between knowing what was changed and guessing.

It matters more than it used to for a newer reason as well. Once you connect an AI assistant to your site through an MCP server, every tool call runs under a real user account, and the log is the only place you can see what that account actually did. Our breakdown of which capabilities a WordPress MCP connection is granted explains what to restrict before you switch one on.

It records events such as:

• New users being created
• Role, password and profile changes
• Posts, pages and custom post types being created or edited
• Failed login attempts
• Logins and logouts

Get WP Activity Log on WordPress.org

6. Login Lockdown and Protection

A small, focused plugin that limits how many failed login attempts an IP range can make before it is blocked. It records the address and timestamp of every failed attempt, blocks the range once your threshold is crossed, and lets you unblock manually.

Best for: a site where you want that one job done and nothing else running. If you already have Wordfence or AIOS you do not need it, because both include brute-force protection.

Get Login Lockdown on WordPress.org

7. BulletProof Security

Built around .htaccess-level protection and rated 4.8 out of 5 across 674 reviews. That design makes it powerful on Apache hosting and largely beside the point on Nginx, so check which one your host runs before you install it.

Key features:

• .htaccess security and firewall rules
• Login security and monitoring
• Scheduled or manual database backups
• Front-end and back-end maintenance mode

The trade-off: the interface is dense and dated, and a bad .htaccess rule can take a site down hard. Worth it if you know your way around Apache, frustrating if you do not.

Get BulletProof Security on WordPress.org

8. UpdraftPlus – the one nobody should skip

Not a security plugin in the strict sense, and still the most important item on this page. UpdraftPlus is on 3+ million sites with a 4.8 out of 5 rating from 8,636 reviews, and the free version does everything a small site needs.

Key features:

• Manual or scheduled backups of files and database
• Backup to Dropbox, Google Drive, Amazon S3 and other remote storage
• One-click restore
• Selective component backup and restore
• Large sites split across multiple archives

Whatever else you take from this page: schedule a backup to somewhere that is not your web server, then restore it once to prove that you can. A backup you have never tested is a hope, not a plan. Our wider comparison of the best WordPress backup plugins covers the alternatives if UpdraftPlus does not suit your setup.

Get UpdraftPlus on WordPress.org

When it is worth paying

Free plugins handle prevention well. What they do not do is clean up after a successful attack, and that is the moment people discover the difference. If your site earns money, or if the thought of picking through infected PHP files at midnight fills you with dread, a paid service earns its money once.

MalCare scans your site from its own servers rather than yours, so the scan does not tax your hosting, and it will clean an infected site for you rather than handing you a list of suspicious files. It is the option to reach for when a site is already compromised and you want it fixed rather than diagnosed. Try MalCare (Affiliate link)

BlogVault handles the backup half of the same problem: off-site incremental backups, one-click restores and a staging site to test changes on before they touch the live one. Worth it for a shop or a client site where a failed restore is a real cost. Try BlogVault (Affiliate link)

One lighter free option worth knowing about: AntiVirus from pluginkollektiv scans your theme templates daily for injected code and emails you if something changes. It is tiny and it does one thing. Be aware that its listing shows it tested only to WordPress 6.9.7 and last updated some months ago, so check the listing before you rely on it. AntiVirus on WordPress.org

Frequently asked questions

Which WordPress security plugin should I install first?

Wordfence Security. It bundles a firewall, a malware scanner and login protection in the free version and covers the attacks that actually reach small sites. All-In-One Security (AIOS) is an equally good free alternative. Install one of them, not both, because two firewalls on the same site tend to conflict.

Does Wordfence speed up my site or cache pages?

No. Wordfence is a security plugin and has no caching layer. The Falcon Engine cache it shipped years ago was removed from the plugin, so if you want faster page loads, install a dedicated caching plugin alongside it.

What happens if I keep running a plugin that WordPress.org has closed?

It keeps working, and that is exactly the problem. A closed plugin is removed from the directory, so it stops receiving updates and your dashboard will never prompt you to upgrade it. Any vulnerability found in it after the closure date stays unpatched on your site indefinitely. Deactivate it, delete it, and replace it with a maintained alternative.

How do I check whether a security plugin I already use is still maintained?

Open wordpress.org/plugins/ followed by the plugin slug. A red notice saying the plugin has been closed means remove it. A warning that it has not been tested with the latest three major releases of WordPress means treat it as unmaintained and plan a replacement. A recent version and a recent update mean it is being looked after.

Do I still need backups if I have a firewall?

Yes. A firewall lowers the chance of a break-in but nothing prevents every one, and backups are what let you undo an infection, a bad update or a mistaken deletion. UpdraftPlus is the free backup plugin to start with, on 3+ million sites with a 4.8 out of 5 rating from 8,636 reviews.

The part no plugin does for you

Avoid admin as a username, change the default database prefix, keep WordPress and everything on it updated, and delete anything you are not using. An inactive plugin is still code sitting on your server, and a withdrawn one is still a liability whether it is switched on or not.

Check your active theme too. A free theme whose author has stopped patching it cannot be rescued by any plugin on this page, and a clean malware scan says nothing about whether the theme will survive the next PHP release.

WordPress.org’s own guide to hardening WordPress covers the server-level and configuration work that sits underneath all of this, and the rest of our plugin coverage is here.

Which plugins do you use to secure your WordPress site? Tell us in the comments.