Best Security Plugins
The top Security plugins for WordPress & WooCommerce, ranked by active installs and rating. Listing data sourced from the WordPress.org plugin directory ↗.
23 plugins in Security
Sorted by popularityWordfence Security
by Mark Maunder
Firewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team. Make security a priority with Wordfence.
Really Simple Security
by Really Simple Plugins
Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate.
Limit Login Attempts Security
by WPChef
WordPress login security with brute force protection, Two-factor authentication (2FA/MFA), firewall, IP/country blocking, and login monitoring
Security Optimizer
by SiteGround
Secure your WordPress site from brute-force attacks, threats, malware, and bots. Free to use and easy to set up.
All-In-One Security (AIOS)
by David Anderson / Team Updraft
Protect your website investment with All-In-One Security (AIOS) – a comprehensive and easy to use security plugin designed especially for WordPress.
Kadence Security
by Nexcess
Harden your site security with Login Security, Two-Factor Authentication (2FA), Vulnerability Scanner, Firewall, and more. Formerly iThemes Security.
Sucuri Security
by Sucuri
The Sucuri WordPress Security plugin is a security toolset for security integrity monitoring, malware detection and security hardening.
Limit Login Attempts
by Automattic
Limit rate of login attempts, including by way of cookies, for each IP. Fully customizable.
Activity Log
by Elementor
This top rated Activity Log plugin helps you monitor & log all changes and actions on your WordPress site, so you can remain secure and organized.
Lockdown WP Admin
by Sean Fisher
Lockdown WP Admin conceals the administration and login screen from intruders. It can hide WordPress Admin (/wp-admin/) and and login (/wp-login.
Login by Auth0
by Auth0
Login by Auth0 provides improved username/password login, Passwordless login, Social login and Single Sign On for all your sites.
SSL Zen — SSL Certificate Installer & HTTPS Redirects
by SSL Zen - Free SSL/HTTPS
Helps install a free Let's Encrypt SSL certificate, redirects HTTP to HTTPS and forces SSL on all pages.
Jetpack VaultPress
by Automattic
(DEPRECATED: Please install "Jetpack VaultPress Backup" instead) Jetpack VaultPress offers real-time backups, one-click restores, and premiu …
Login for Google Apps
by Syed Balkhi
Simple secure login and user management through your Google Workspace for WordPress (using oAuth2 and MFA if enabled).
Password Strength Settings for WooCommerce
by Danny Santoro
Help secure your WooCommerce site by enforcing stronger passwords and taking additional control of your strength requirements.
Malcure Malware Shield — Removal, Repair, Monitor
by Malcure Web Security
Fast malware removal & security shield. Fix hacks, stop redirects, clean SEO spam. Real-time threat intelligence. No bloat.
Two Factor (2FA) Authentication via Email
by Sully
Enable one-click login with this WordPress Two-Factor Authentication (2FA) plugin, utilizing email for added security.
WP Fingerprint
by DanFoster
WP Fingerprint adds an additional layer of security to your WordPress website, working to check your plugins for signs of hack or exploit.
IP Geo Block
by tokkonopapa
It blocks spam posts, login attempts and malicious access to the back-end requested from the specific countries, and also prevents zero-day exploit.
WPScan
by ethicalhack3r
WPScan WordPress Security Scanner - Scans your system for security vulnerabilities listed in the WPScan Vulnerability Database.
Exploit Scanner
by Donncha O Caoimh (a11n)
Search the files and database of your WordPress install for signs that may indicate that it has fallen victim to malicious hackers.
SSL Mixed Content Fix
by Steve85b
A fix for mixed content! This Plugin creates protocol relative urls by removing http + https from links. Works in Front- and Backend!
Log cleaner for Solid Security
by Rocket Apps
Restores the ability to manually delete Solid Security logs from the database.