Software directory · 78 tools
Security plugins
Our picks
-
Sucuri Security
600,000+ active installs · Rated 4.2/5 · Updated October 14, 2026
A WordPress plugin for security monitoring, malware detection and hardening, including file integrity checks, activity audit logs and email alerts.
-
iThemes Security
700,000+ active installs · Rated 4.6/5 · Updated October 14, 2026
A security plugin, now branded Solid Security, that strengthens logins, offers two-factor authentication, scans for vulnerabilities, adds firewall rules and monitors file changes.
-
Wordfence Security
5M+ active installs · Rated 4.7/5 · Updated September 30, 2026
A security plugin with an endpoint firewall, malware scanner, login protection and two-factor authentication.
-
WP fail2ban
60,000+ active installs · Rated 4.2/5 · Updated October 20, 2026
A plugin that writes WordPress login and other security events to the system log in a format the fail2ban tool understands, so repeated attacks can be blocked at the server level.
-
All In One WP Security & Firewall
1M+ active installs · Rated 4.7/5 · Updated September 17, 2026
A security plugin offering login protection, firewall rules, user account hardening, file change detection and database security.
-
Jetpack
3M+ active installs · Rated 3.7/5 · Updated October 12, 2026
A multi-purpose suite from Automattic that bundles many site tools under one account.
-
SecuPress
40,000+ active installs · Rated 4.1/5 · Updated October 22, 2026
A security plugin that audits a site against a range of checks and applies protections such as firewall rules, login hardening and malware scanning.
-
BulletProof Security
20,000+ active installs · Rated 4.8/5 · Updated August 19, 2026
A security plugin that protects a site with firewall rules, login security, malware scanning, database backups and anti-spam tools.
-
VaultPress
10,000+ active installs · Rated 3.8/5 · Updated October 14, 2026
A backup and security service from the Jetpack family, offering real-time backups, one-click restores and malware scanning.
-
Google Authenticator (miniOrange)
10,000+ active installs · Rated 4.5/5 · Updated October 21, 2026
A plugin that adds a second login step for WordPress users, with methods such as authenticator apps, email or text codes, push notifications and passkeys, plus passwordless sign-in.
-
Security Ninja
7,000+ active installs · Rated 4.7/5 · Updated October 21, 2026
A WordPress security plugin that runs over fifty tests to find weak settings, adds a firewall, checks for vulnerabilities, scans core files and logs events.
-
Defender
80,000+ active installs · Rated 4.8/5 · Updated September 29, 2026
A security plugin from WPMU DEV offering malware scanning, IP blocking, audit logs, firewall rules, two-factor authentication and brute-force login protection.
-
Astra Web Security
A cloud-based website security service that provides a firewall against attacks such as SQL injection, cross-site scripting and malicious bots, along with malware scanning and cleanup.
-
Shield Security
30,000+ active installs · Rated 4.8/5 · Updated October 5, 2026
A WordPress security plugin that blocks malicious bots automatically, scans for problems, hardens login and guides you toward important issues with fewer alerts.
-
WebARX
A security service, now operating as Patchstack, focused on vulnerabilities in WordPress plugins and themes.
All Security plugins
-
Really Simple SSL
3M+ active installs · Rated 4.9/5 · Updated September 15, 2026
A security plugin, formerly Really Simple SSL, that moves a site to HTTPS in one click and adds core hardening features.
-
WPS Hide Login
2M+ active installs · Rated 4.8/5 · Updated August 13, 2026
Changes the login URL so wp-login.php and wp-admin are not reachable by default for logged-out visitors.
-
Disable Comments
1M+ active installs · Rated 4.7/5 · Updated October 25, 2026
A plugin for switching off comments across a WordPress site, either everywhere or only on chosen posts, pages or media.
-
SVG Support
1M+ active installs · Rated 4.8/5 · Updated July 25, 2026
SVG Support lets administrators upload SVG files to the media library.
-
Safe SVG
1M+ active installs · Rated 4.9/5 · Updated September 22, 2026
Safe SVG allows SVG uploads and sanitises each file on upload to strip scripts and unsafe markup.
-
Security Optimizer
1M+ active installs · Rated 4.5/5 · Updated October 14, 2026
Security Optimizer is SiteGround's free security plugin.
-
MainWP Child
700,000+ active installs · Rated 5.0/5 · Updated October 13, 2026
MainWP Child is the site-side plugin that links a WordPress site to a self-hosted MainWP Dashboard.
-
User Role Editor
700,000+ active installs · Rated 4.5/5 · Updated September 25, 2026
A plugin that lets administrators change WordPress roles and capabilities by ticking boxes and saving.
-
Members
300,000+ active installs · Rated 4.9/5 · Updated October 25, 2026
A role and capability plugin that offers a simple interface for editing, creating, cloning and deleting WordPress roles.
-
Password Protected
300,000+ active installs · Rated 4.4/5 · Updated July 30, 2026
Password Protected locks an entire WordPress site behind one shared password, with a login screen for visitors.
-
Simple History
300,000+ active installs · Rated 4.9/5 · Updated October 17, 2026
Simple History records site activity such as logins, post edits, plugin and user changes in an admin log, and can send email reports and alerts.
-
WP Activity Log
300,000+ active installs · Rated 4.7/5 · Updated October 20, 2026
Records user and site activity such as logins, content edits, plugin and theme changes, and WooCommerce or LearnDash events in a searchable audit log.
-
Advanced Google reCAPTCHA
200,000+ active installs · Rated 4.8/5 · Updated October 6, 2026
Adds Google reCAPTCHA to the WordPress login, registration, password reset and comment forms, and to WooCommerce, BuddyPress and Easy Digital Downloads forms.
-
Cloudflare
200,000+ active installs · Rated 3.5/5 · Updated October 5, 2026
Official Cloudflare plugin that connects a WordPress site to a Cloudflare zone.
-
Health Check & Troubleshooting
200,000+ active installs · Rated 3.6/5 · Updated July 25, 2024
Runs site health checks, shows debug data, and provides a troubleshooting mode that disables plugins and the theme for only the admin's session.
-
Simple CAPTCHA with Cloudflare Turnstile
200,000+ active installs · Rated 4.6/5 · Updated September 29, 2026
Simple CAPTCHA with Cloudflare Turnstile adds the Cloudflare Turnstile challenge to the WordPress login form, registration, comments and common form plugins such as Contact Form 7 and Gravity Forms.
-
HTTPS redirection
100,000+ active installs · Rated 4.2/5 · Updated October 12, 2026
A plugin, also listed as Easy HTTPS Redirection, that automatically sends visitors from HTTP pages to their secure HTTPS versions.
-
PublishPress Capabilities
100,000+ active installs · Rated 4.7/5 · Updated October 14, 2026
A user role editor for creating, editing and duplicating WordPress roles and controlling every capability without code.
-
SSL Insecure Content Fixer
100,000+ active installs · Rated 4.8/5 · Updated September 6, 2026
A plugin that cleans up insecure content and mixed-content warnings on WordPress sites running over HTTPS.
-
Two Factor
100,000+ active installs · Rated 4.8/5 · Updated September 28, 2026
Two Factor adds a second login step using time-based codes from an authenticator app, codes sent by email, or backup codes.
-
Headers Security Advanced & HSTS WP
90,000+ active installs · Rated 4.8/5 · Updated September 4, 2026
Sends HTTP security headers such as HSTS, Content-Security-Policy, X-Frame-Options and Permissions-Policy from WordPress, and can write matching rules to Apache or LiteSpeed config files.
-
Temporary Login Without Password
90,000+ active installs · Rated 5.0/5 · Updated October 1, 2026
Temporary Login Without Password creates a login link for a chosen WordPress role that expires after a set time, so a developer or support agent can sign in without the site owner's password.
-
BlogVault
80,000+ active installs · Rated 4.6/5 · Updated September 17, 2026
A plugin connecting WordPress to the BlogVault service, which makes automatic incremental backups of files and database and stores them offsite.
-
hCaptcha for WP
70,000+ active installs · Rated 4.6/5 · Updated October 5, 2026
Adds hCaptcha challenges to WordPress logins, comments, registration and many form plugins, with a migration wizard for sites moving off reCAPTCHA or Turnstile.
-
Titan Anti-Spam & Security
50,000+ active installs · Rated 4.5/5 · Updated October 22, 2026
A security plugin that combines comment spam blocking with login protection and basic site hardening, managed from one dashboard.
-
Age Gate
40,000+ active installs · Rated 4.6/5 · Updated September 12, 2026
Age Gate asks visitors to confirm their age before they see the whole site or selected content.
-
HTTP Headers
40,000+ active installs · Rated 4.3/5 · Updated October 16, 2026
Lets site owners set HTTP response headers such as Content-Security-Policy, CORS, Cache-Control and Permissions-Policy from the admin screen.
-
WP SVG Images
30,000+ active installs · Rated 5.0/5 · Updated August 20, 2026
Adds SVG uploads to the WordPress Media Library.
-
WPFront User Role Editor
30,000+ active installs · Rated 4.5/5 · Updated August 19, 2026
A plugin for managing WordPress user roles, letting administrators create, edit, rename, clone and delete roles and adjust their capabilities.
-
Database Manager - WP Adminer
20,000+ active installs · Rated 5.0/5 · Updated March 30, 2026
Database Manager - WP Adminer runs the Adminer database tool inside the WordPress dashboard, under Tools.
-
Stop Spammers
20,000+ active installs · Rated 4.4/5 · Updated July 18, 2026
An anti-spam plugin, now named Stop Spammers Classic, that blocked spam registrations, comments and logins on WordPress sites.
-
Two Factor Authentication
20,000+ active installs · Rated 4.4/5 · Updated August 13, 2026
A plugin that adds two-factor login for WordPress and WooCommerce, supporting one-time passcode apps such as Google Authenticator and Authy.
-
Zero Spam for WordPress
20,000+ active installs · Rated 4.1/5 · Updated October 23, 2026
A plugin that blocks spam and malicious visitors without captchas or moderation queues, using its own detection plus Stop Forum Spam and Project Honeypot reputation data.
-
ClickCease - Click Fraud Protection
10,000+ active installs · Rated 3.0/5 · Updated May 7, 2026
Connector for the ClickCease (CHEQ) bot and click fraud service.
-
Login With Ajax
10,000+ active installs · Rated 4.6/5 · Updated May 24, 2026
A plugin that adds AJAX-powered login, registration and password reset forms that work without page reloads.
-
One Click SSL
10,000+ active installs · Rated 4.9/5 · Updated June 19, 2026
A plugin that switches a WordPress site to HTTPS with a single click after checking that the server supports SSL.
-
Password Strength Settings for WooCommerce
10,000+ active installs · Rated 4.5/5 · Updated October 11, 2023
Adds a password strength requirement setting to the WooCommerce account settings, with five levels from no requirement to strong passwords only.
-
YOP Poll
10,000+ active installs · Rated 4.4/5 · Updated October 5, 2026
A polling plugin for running polls on a WordPress site, with single or multiple choice questions, an option for voters to add their own answers and scheduled start and end dates.
-
WPForce Logout
8,000+ active installs · Rated 4.8/5 · Updated June 10, 2026
WPForce Logout signs out all users, or selected users, from the WordPress admin, and shows who is online and each user's last login.
-
OOPSpam
6,000+ active installs · Rated 4.9/5 · Updated October 23, 2026
A plugin connecting WordPress forms and comments to the oopspam filtering service, which checks submissions in the background instead of using captchas.
-
Enable Abilities for MCP
5,000+ active installs · Rated 5.0/5 · Updated October 16, 2026
Connects AI assistants such as Claude and ChatGPT to WordPress through the MCP protocol.
-
Duo Two-Factor Authentication
3,000+ active installs · Rated 3.7/5 · Updated June 6, 2025
A plugin connecting WordPress logins to the Duo Security service, so administrators or all users must approve sign-ins through a second factor such as a phone prompt.
-
WP OAuth Server - CE
3,000+ active installs · Rated 3.8/5 · Updated September 24, 2026
OAuth 2.0 provider for WordPress that lets external apps and sites sign users in with their WordPress accounts.
-
Blacklist Manager
2,000+ active installs · Rated 3.6/5 · Updated October 22, 2026
Anti-fraud and spam blocker for WooCommerce and WordPress forms.
-
Login Page Styler
2,000+ active installs · Rated 4.3/5 · Updated March 8, 2026
A plugin that restyles and secures the WordPress login page.
-
Easy Cloudflare Turnstile
1,000+ active installs · Rated 4.0/5 · Updated June 3, 2026
A plugin from WPPOOL that adds Cloudflare Turnstile, a privacy-friendly captcha alternative, to WordPress forms.
-
Agent Abilities for MCP
700+ active installs · Rated 4.8/5 · Updated October 16, 2026
Turns a WordPress site into an MCP server so AI clients such as Claude, ChatGPT and Cursor can work on it as a chosen WordPress user.
-
Rublon Two-Factor Authentication
400+ active installs · Rated 4.2/5 · Updated August 13, 2026
A multi-factor authentication plugin that adds a second login step through mobile push, time-based passcodes or security keys such as WebAuthn.
-
Spam Master
200+ active installs · Rated 4.2/5 · Updated August 20, 2026
A plugin that acts as a spam firewall, checking visitors against real-time block lists to stop spam bots, brute force logins and fake registrations.
-
SSL Secure Seal for WooCommerce
70+ active installs · Rated 4.0/5 · Updated November 11, 2017
A plugin that displays an SSL secure seal or custom trust badge on WooCommerce pages, especially near the checkout payment button.
-
Kount Fraud Prevention
20+ active installs · Rated 3.0/5 · Updated August 31, 2026
Connects WooCommerce checkout to Kount's fraud screening service, so orders can be scored and approved, reviewed or declined.
-
Verve SSL
10+ active installs · Rated 4.0/5 · Updated June 21, 2019
A plugin that forces HTTPS for the WordPress login page and admin area, then switches back to plain HTTP after logging out.
-
Blacklist Manager Premium
Paid add-on to Blacklist Manager for WooCommerce anti-fraud.
-
Defender Pro
Defender Pro is WPMU DEV's security plugin.
-
Fraud Prevention For WooCommerce and EDD (Premium)
Fraud Prevention For WooCommerce and EDD blocks checkout orders that match blacklist rules, such as customer email, disposable email domains, IP address, postcode and shipping zone.
-
Gravity Forms Akismet Add-On
Adds Akismet spam checking to Gravity Forms.
-
Gravity Forms reCAPTCHA Add-On
Protects Gravity Forms with Google reCAPTCHA.
-
PublishPress Capabilities Pro
PublishPress Capabilities Pro is the commercial edition of the PublishPress Capabilities role editor.
-
Rename wp-login.php
Moves the WordPress login page to a custom URL slug by intercepting requests, without editing core files or adding rewrite rules.
-
Stop Spam Comments
Blocks comment spam from bots that do not run JavaScript, with no captcha or question for the visitor.
-
WP Activity Log Premium
A paid activity log for WordPress that records user, content, plugin and core changes with who, when and from which IP.
-
WPFront User Role Editor Personal Pro
Paid add-on version of WPFront User Role Editor.
-
reCaptcha for WooCommerce
Adds Google reCAPTCHA v2 or v3, Cloudflare Turnstile or hCaptcha to WooCommerce login, registration, lost password, checkout and pay-for-order forms, for both classic and block checkout.