| #1 | Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… | 100 | | 0 | 2k+ | | | No open findings |
| #2 | miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) | 99 | | 5 | 10k+ | | | Non-prefixed constant |
| #3 | Trusona for WordPress | 97 | 2 | 8 | 400 | | | Non-prefixed constant |
| #4 | WebAuthn Provider for Two Factor | 91 | 6 | 14 | 1k+ | | | Missing Arg Domain |
| #5 | Two Factor (2FA) Authentication via Email | 73 | 8 | 19 | 9k+ | | | Missing Translators Comment |
| #6 | Two Factor | 42 | 18 | 70 | 100k+ | | | Nonce verification recommended |
| #7 | Advanced IP Blocker | 42 | 91 | 0 | 2k+ | | | Exception output is not escaped |
| #8 | Atomic Edge Security – Firewall, Malware Scan and Login Security | 40 | 12 | 184 | 700 | | | Non-prefixed global variable |
| #9 | Two Factor Authentication | 35 | 108 | 139 | 20k+ | | | Output is not escaped |
| #10 | WP 2-step verification | 32 | 154 | 65 | 1k+ | | | Output is not escaped |
| #11 | Rublon Multi-Factor Authentication (MFA) | 30 | 216 | 160 | 400 | | | Output is not escaped |
| #12 | OTP Login & Register Woocommerce | 27 | 120 | 354 | 1k+ | | | Non-prefixed global variable |
| #13 | WP Hide & Security Enhancer | 26 | 137 | 478 | 50k+ | | | Input is not sanitized |
| #14 | WP 2FA – Two-factor authentication for WordPress | 25 | 255 | 717 | 100k+ | | | Non-prefixed global variable |
| #15 | Wordfence Login Security | 25 | 248 | 418 | 60k+ | | | Output is not escaped |
| #16 | Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention | 24 | 587 | 672 | 1m+ | | | Non-prefixed global variable |
| #17 | Security Plugin, Firewall & Malware Scanner with Auto Removal | 24 | 1,081 | 808 | 40k+ | | | SQL query is not prepared |
| #18 | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning | 23 | 1,202 | 244 | 30k+ | | | Missing Translators Comment |
| #19 | Login With Ajax – Fast Logins, 2FA, Redirects | 23 | 623 | 520 | 10k+ | | | Output is not escaped |
| #20 | Wordfence Security – Firewall, Malware Scan, and Login Security | 21 | 1,893 | 3,292 | 5m+ | | | Output is not escaped |
| #21 | Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) | 19 | 530 | 375 | 3m+ | | | Missing Translators Comment |
