| #1 | Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… | 100 | | 0 | 2k+ | | | No open findings |
| #2 | Site Lockdown Security | 100 | | 2 | 600 | | | Non-prefixed class |
| #3 | WEDOS | Protection & Cache Performance | 100 | | 1 | 400 | | | trademarked term |
| #4 | Login Lockdown & Protection | 94 | 5 | 15 | 100k+ | | | Non-prefixed global variable |
| #5 | BotBlocker Security – Complete security platform | 94 | 1 | 7 | 3k+ | | | Non-prefixed constant |
| #6 | Sucuri Security – Auditing, Malware Scanner and Security Hardening | 93 | 62 | 6 | 600k+ | | | Missing direct file access protection |
| #7 | Easy IP Blocker | 91 | 4 | 9 | 400 | | | Nonce verification recommended |
| #8 | Snitch | 87 | 5 | 19 | 800 | | | Nonce verification recommended |
| #9 | Hide My WP Ghost – Security & Firewall | 84 | 8 | 422 | 100k+ | | | Non-prefixed global variable |
| #10 | MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall | 83 | 39 | 26 | 100k+ | | | Missing direct file access protection |
| #11 | Forget Spam Comment | 67 | 5 | 10 | 9k+ | | | Input is not sanitized |
| #12 | BBQ Firewall – Fast & Powerful Firewall Security | 44 | 17 | 17 | 100k+ | | | Output is not escaped |
| #13 | Advanced IP Blocker | 42 | 91 | 0 | 2k+ | | | Exception output is not escaped |
| #14 | Atomic Edge Security – Firewall, Malware Scan and Login Security | 40 | 12 | 184 | 700 | | | Non-prefixed global variable |
| #15 | Injection Guard | 37 | 86 | 45 | 1k+ | | | Unsafe printing function |
| #16 | Security Optimizer – The All-In-One Protection Plugin | 35 | 39 | 87 | 1m+ | | | Input is not sanitized |
| #17 | Zero Spam for WordPress | 34 | 79 | 393 | 20k+ | | | Non-prefixed global variable |
| #18 | Security Safe | 34 | 193 | 164 | 700 | | | Missing Translators Comment |
| #19 | Security Ninja – WordPress Security & Firewall | 28 | 160 | 360 | 7k+ | | | Missing Translators Comment |
| #20 | Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention | 24 | 595 | 652 | 1m+ | | | Non-prefixed global variable |
| #21 | All-In-One Security (AIOS) – Security and Firewall | 24 | 552 | 1,228 | 1m+ | | | Non-prefixed global variable |
| #22 | Defender Security – Malware Scanner, Login Security & Firewall | 24 | 1,327 | 1,329 | 80k+ | | | Non-prefixed namespace |
| #23 | Patchstack – WordPress & Plugins Security | 24 | 104 | 478 | 60k+ | | | Missing nonce verification |
| #24 | Security Plugin, Firewall & Malware Scanner with Auto Removal | 24 | 1,081 | 808 | 40k+ | | | SQL query is not prepared |
| #25 | RSFirewall! | 24 | 563 | 521 | 4k+ | | | Output is not escaped |
| #26 | Anti-Malware Security and Brute-Force Firewall | 23 | 543 | 965 | 100k+ | | | Output is not escaped |
| #27 | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning | 23 | 1,202 | 239 | 30k+ | | | Missing Translators Comment |
| #28 | IP Geo Block | 23 | 399 | 589 | 8k+ | | | Output is not escaped |
| #29 | WebTotem Security | 23 | 1,091 | 213 | 800 | | | Text Domain Mismatch |
| #30 | NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall | 22 | 1,263 | 2,046 | 100k+ | | | Non-prefixed global variable |
| #31 | Wordfence Security – Firewall, Malware Scan, and Login Security | 21 | 1,893 | 3,292 | 5m+ | | | Output is not escaped |
| #32 | BulletProof Security | 0 | 5,048 | 4,949 | 20k+ | | | Output is not escaped |