| #1 | Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… | 100 | | 1 | 1k+ | | | mismatched plugin name |
| #2 | miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) | 99 | | 6 | 10k+ | | | Non-prefixed constant |
| #3 | Trusona for WordPress | 97 | 2 | 8 | 500 | | | Non-prefixed constant |
| #4 | WebAuthn Provider for Two Factor | 91 | 6 | 14 | 1k+ | | | Missing Arg Domain |
| #5 | Two Factor (2FA) Authentication via Email | 61 | 12 | 27 | 9k+ | | | Request data is not unslashed |
| #6 | Two Factor | 42 | 18 | 70 | 100k+ | | | Nonce verification recommended |
| #7 | Advanced IP Blocker | 40 | 94 | 56 | 2k+ | | | Exception output is not escaped |
| #8 | Atomic Edge Security – Firewall, Malware Scan and Login Security | 40 | 12 | 184 | 700 | | | Non-prefixed global variable |
| #9 | Two Factor Authentication | 35 | 108 | 139 | 20k+ | | | Output is not escaped |
| #10 | OTP Login & Register Woocommerce | 34 | 148 | 202 | 1k+ | | | Missing nonce verification |
| #11 | WP 2-step verification | 32 | 154 | 65 | 1k+ | | | Output is not escaped |
| #12 | Rublon Multi-Factor Authentication (MFA) | 30 | 216 | 160 | 500 | | | Output is not escaped |
| #13 | WP Hide & Security Enhancer | 27 | 124 | 375 | 50k+ | | | Input is not sanitized |
| #14 | Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention | 25 | 617 | 614 | 1m+ | | | Unsafe printing function |
| #15 | WP 2FA – Two-factor authentication for WordPress | 25 | 255 | 717 | 100k+ | | | Non-prefixed global variable |
| #16 | Wordfence Login Security | 25 | 248 | 418 | 60k+ | | | Output is not escaped |
| #17 | Login & Register Forms – Popup, Slider, Profile & WooCommerce | 25 | 183 | 521 | 40k+ | | | Non-prefixed global variable |
| #18 | Security Plugin, Firewall & Malware Scanner with Auto Removal | 23 | 1,204 | 789 | 40k+ | | | Output is not escaped |
| #19 | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning | 23 | 1,118 | 202 | 30k+ | | | Missing Translators Comment |
| #20 | Login With Ajax – Fast Logins, 2FA, Redirects | 23 | 623 | 520 | 10k+ | | | Output is not escaped |
| #21 | Wordfence Security – Firewall, Malware Scan, and Login Security | 21 | 1,592 | 2,973 | 5m+ | | | Output is not escaped |
| #22 | Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) | 19 | 536 | 379 | 3m+ | | | Missing Translators Comment |
