Best Security WordPress Plugins
137 indexed plugins
Plugins
137
Active Installs
27m+
Average Score
47
Audited
122
Best Scored
| Rank | Plugin | Score | Errors | Warnings | Installs | Updated | Top Issue |
|---|---|---|---|---|---|---|---|
| #1 | Login Security Captcha | 100 | 0 | 10k+ | No open findings | ||
| #2 | Stop XML-RPC Attacks | 100 | 1 | 6k+ | Non Prefixed Class Found | ||
| #3 | BotBlocker Security – Firewall & Bot Protection | 99 | 5 | 3k+ | Non Prefixed Constant Found | ||
| #4 | Protect Uploads | 99 | 2 | 1 | 40k+ | missing direct file access protection | |
| #5 | Stop User Enumeration | 99 | 1 | 1 | 50k+ | Dynamic Hookname Found | |
| #6 | WPMasterToolKit (WPMTK) – All in one plugin | 99 | 1 | 4 | 4k+ | trademarked term | |
| #7 | Manage XML-RPC | 98 | 3 | 1 | 6k+ | file system operations is writable | |
| #8 | Prevent XSS Vulnerability | 98 | 10 | 1 | 6k+ | Missing Arg Domain | |
| #9 | Safe SVG | 98 | 7 | 4 | 1m+ | Missing Arg Domain | |
| #10 | WP Author Slug | 96 | 16 | 6 | 2k+ | Text Domain Mismatch | |
| #11 | WPVulnerability | 96 | 4 | 10k+ | trademarked term | ||
| #12 | MilesWeb Tools | 95 | 4 | 49 | 10k+ | Non Prefixed Variable Found | |
| #13 | Malcure Malware Shield — Removal, Repair, Monitor | 95 | 75 | 6 | 10k+ | wp function not compatible with requires wp | |
| #14 | Stop Spammers Classic | 94 | 185 | 1 | 30k+ | wp function not compatible with requires wp | |
| #15 | Sucuri Security – Auditing, Malware Scanner and Security Hardening | 94 | 52 | 5 | 600k+ | missing direct file access protection | |
| #16 | XO Security | 94 | 5 | 3 | 30k+ | wp function not compatible with requires wp | |
| #17 | Restricted Site Access | 91 | 14 | 11 | 10k+ | Missing Arg Domain | |
| #18 | Password Strength Settings for WooCommerce | 89 | 17 | 6 | 10k+ | Missing Arg Domain | |
| #19 | WP Admin Basic Auth | 87 | 5 | 6 | 2k+ | Input Not Sanitized | |
| #20 | AntiSpam for Contact Form 7 | 86 | 14 | 8 | 10k+ | Text Domain Mismatch | |
| #21 | WP Ghost (Hide My WP Ghost) – Security & Firewall | 85 | 6 | 373 | 100k+ | Non Prefixed Variable Found | |
| #22 | HSTS Ready | 85 | 3 | 11 | 3k+ | Input Not Validated | |
| #23 | Salt Shaker | 85 | 15 | 13 | 6k+ | Interpolated Not Prepared | |
| #24 | Simple Automatic Updates | 85 | 18 | 1 | 2k+ | Missing Translators Comment | |
| #25 | WP Fail2Ban Redux | 82 | 1 | 10 | 7k+ | trademarked term | |
| #26 | Hostinger Tools | 81 | 14 | 22 | 3m+ | wp function not compatible with requires wp | |
| #27 | Smart Passworded Pages | 80 | 11 | 8 | 2k+ | wp function not compatible with requires wp | |
| #28 | Melapress File Monitor | 80 | 16 | 90 | 6k+ | Non Prefixed Variable Found | |
| #29 | OpenID Connect Generic Client | 73 | 9 | 59 | 10k+ | Non Prefixed Hookname Found | |
| #30 | Simple Login Captcha | 70 | 20 | 19 | 10k+ | date date | |
| #31 | Simple Login Lockdown | 69 | 13 | 6 | 4k+ | Output Not Escaped | |
| #32 | Content Security Policy Manager | 68 | 19 | 2 | 2k+ | Output Not Escaped | |
| #33 | Protection Against DDoS | 68 | 22 | 5 | 3k+ | Output Not Escaped | |
| #34 | Forget Spam Comment | 67 | 5 | 10 | 9k+ | Input Not Sanitized | |
| #35 | WP Anti-Clickjack | 66 | 4 | 42 | 4k+ | Recommended | |
| #36 | Inactive Logout | 64 | 30 | 71 | 10k+ | Non Prefixed Variable Found | |
| #37 | Meta Generator and Version Info Remover | 52 | 20 | 28 | 10k+ | Non Prefixed Function Found | |
| #38 | TrustedSite | 50 | 29 | 14 | 20k+ | Output Not Escaped | |
| #39 | LWS Hide Login | 45 | 5 | 58 | 20k+ | Missing Unslash | |
| #40 | BBQ Firewall – Fast & Powerful Firewall Security | 44 | 17 | 17 | 100k+ | Output Not Escaped | |
| #41 | User Role Editor | 43 | 117 | 145 | 700k+ | Output Not Escaped | |
| #42 | Lock Down Admin | 42 | 30 | 20 | 3k+ | Unsafe Printing Function | |
| #43 | Login No Captcha reCAPTCHA | 42 | 45 | 24 | 60k+ | Unsafe Printing Function | |
| #44 | Two Factor | 42 | 18 | 70 | 100k+ | Recommended | |
| #45 | WP Fingerprint | 42 | 34 | 47 | 9k+ | Direct Query | |
| #46 | Google Authenticator | 41 | 39 | 65 | 20k+ | Output Not Escaped | |
| #47 | Lockdown WP Admin | 41 | 20 | 50 | 10k+ | Missing Unslash | |
| #48 | Log cleaner for Solid Security | 41 | 65 | 47 | 8k+ | Text Domain Mismatch | |
| #49 | Advanced Country Blocker | 40 | 23 | 77 | 2k+ | Exception Not Escaped | |
| #50 | Limit Login Attempts | 40 | 81 | 38 | 300k+ | Output Not Escaped |
