Security
Hardening, firewalls, login protection, scanning, 2FA.
263 plugins with two or more releases. Show all 1,148
Small WordPress plugin to disable the recovery password workflow.
Spam and bot user detection plugin for WordPress and WooCommerce that helps you identify, manage, and remove suspicious user accounts while protecting legitimate users.
Fixes GravityForms plugin so it is CSP compliant.
A custom WordPress plugin to allow you to use a password to protect your site, sections of your site, or partial content.
A WordPress plugin that hides the default WordPress login page with a custom URL while preserving SAML authentication functionality.
Minimal WordPress security plugin: blocks REST API user enumeration, hides server metadata, and protects wp-login.php against brute force attacks.
WordPress security plugin: login lockouts, two-factor (TOTP) authentication, core hardening, an activity log with email alerts, and file integrity checks. Works with Cloudflare. Free, no account, by Jeremy Anderson Tech.
Cerrojo Security Toolkit provides focused WordPress security posture diagnostics and seven reversible security tools: five under Hardening, plus dedicated Security headers and REST API tools. It reports evidence, not a guarantee of…
Secure WordPress uploads using CypherScan's presigned upload and malware scanning workflow.
Locks WordPress URL changes by blocking programmatic updates to site URLs, permalinks, slugs, and taxonomies.
Protect sensitive data in your ACF fields using encryption 🔐
A module for the sim-plugin
Acts as a bridge between HivePress and the free Cloudflare Turnstile plugin
Tracks all WordPress activity such as posts, meta, options, users, taxonomy, comments, plugins, themes and more.
Complete CAPTCHA solution for WordPress — reCAPTCHA v2/v3, Cloudflare Turnstile, hCaptcha & Altcha. Protects WooCommerce, BuddyPress, bbPress & 10+ form builders.
Enforce SSL URLs using WordPress filters and permanent redirects. No configuration required.
ClassicPress Integrity Checker
A plugin that logs, blocks and rewrites outbound HTTP requests from your WordPress site. Updates for this specific plugin are served from this Github repo and not wordpress.org.
Zero-config WordPress hardening: blocks user enumeration, rate-limits password resets, genericizes login errors. Installable from wp-admin, runs as mu-plugin (MIT)
Crain core WordPress plugins and shared code.
Pretty Secure Secret Transmissions. WordPress plugin to share encrypted expiring posts. This plugin is inspired by the great onetimesecret.com though it does not share any codebase
Email 2FA for WordPress login - a 6-digit one-time code by email, no app or SMS. Works with Wordfence, custom login pages, and multisite.
Content Freeze Out is a WordPress plugin that lets an administrator temporarily freeze content changes during maintenance windows, launches, and migrations.
itineris-prevent-wp-user-enumeration
Killer Pads is a plugin like security pads for "prevention is better than cure". It activates the default configuration of security and operational efficiency to WordPress websites.