Most Installed Security WordPress Plugins
172 indexed plugins
Plugins
172
Active Installs
27m+
Average Score
50
Audited
162
Most Installed
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #51 | BulletProof Security | 0 | 5,048 | 4,949 | 20k+ | Output is not escaped | ||
| #52 | Google Authenticator | 41 | 39 | 65 | 20k+ | Output is not escaped | ||
| #53 | My Private Site | 31 | 425 | 190 | 20k+ | Text Domain Mismatch | ||
| #54 | LWS Hide Login | 45 | 5 | 58 | 20k+ | Request data is not unslashed | ||
| #55 | MainWP Dashboard: Self-hosted WordPress Management for Agencies | 31 | 95 | 317 | 20k+ | Interpolated SQL is not prepared | ||
| #56 | TrustedSite | 50 | 29 | 14 | 20k+ | Output is not escaped | ||
| #57 | WPS Cleaner | 30 | 430 | 491 | 20k+ | Output is not escaped | ||
| #58 | Zero Spam for WordPress | 34 | 79 | 393 | 20k+ | Non-prefixed global variable | ||
| #59 | Login by Auth0 | 37 | 307 | 82 | 10k+ | Text Domain Mismatch | ||
| #60 | Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms | 22 | 493 | 295 | 10k+ | Text Domain Mismatch | ||
| #61 | AntiSpam for Contact Form 7 | 86 | 14 | 8 | 10k+ | Text Domain Mismatch | ||
| #62 | OpenID Connect Generic Client | 73 | 9 | 59 | 10k+ | Non-prefixed hook name | ||
| #63 | Forget Spam Comment | 67 | 5 | 10 | 10k+ | Input is not sanitized | ||
| #64 | The GDPR Framework By Data443 | 23 | 1,287 | 517 | 10k+ | Short PHP open tag found | ||
| #65 | Inactive Logout | 64 | 30 | 71 | 10k+ | Non-prefixed global variable | ||
| #66 | Lockdown WP Admin | 41 | 20 | 50 | 10k+ | Request data is not unslashed | ||
| #67 | Login Security Captcha | 100 | 0 | 10k+ | No open findings | |||
| #68 | Login With Ajax – Fast Logins, 2FA, Redirects | 23 | 623 | 520 | 10k+ | Output is not escaped | ||
| #69 | LWS Tools | 31 | 104 | 134 | 10k+ | Request data is not unslashed | ||
| #70 | Meta Generator and Version Info Remover | 52 | 20 | 28 | 10k+ | Non-prefixed function | ||
| #71 | MilesWeb Tools | 95 | 4 | 49 | 10k+ | Non-prefixed global variable | ||
| #72 | Nexter Extension – Security, Performance, Code Snippets & Site Toolkit | 25 | 198 | 710 | 10k+ | Nonce verification recommended | ||
| #73 | Plugin Check (PCP) | 0 | 128 | 132 | 10k+ | Exception output is not escaped | ||
| #74 | Restricted Site Access | 91 | 14 | 11 | 10k+ | Missing Arg Domain | ||
| #75 | Simple Login Captcha | 70 | 20 | 19 | 10k+ | date date | ||
| #76 | Jetpack VaultPress | 28 | 71 | 362 | 10k+ | Missing nonce verification | ||
| #77 | Password Strength Settings for WooCommerce | 89 | 17 | 6 | 10k+ | Missing Arg Domain | ||
| #78 | Malcure Malware Shield — Removal, Repair, Monitor | 95 | 75 | 6 | 10k+ | wp function not compatible with requires wp | ||
| #79 | WPVulnerability | 96 | 4 | 10k+ | trademarked term | |||
| #80 | Brozzme DB Prefix & Tools Addons | 35 | 24 | 42 | 9k+ | Request data is not unslashed | ||
| #81 | IP Geo Block | 23 | 399 | 589 | 9k+ | Output is not escaped | ||
| #82 | WP Fingerprint | 42 | 34 | 47 | 9k+ | Direct Query | ||
| #83 | ReCaptcha Integration for WordPress | 37 | 60 | 66 | 9k+ | Output is not escaped | ||
| #84 | Exploit Scanner | 37 | 25 | 130 | 8k+ | Non-prefixed global variable | ||
| #85 | Log cleaner for Solid Security | 41 | 65 | 47 | 8k+ | Text Domain Mismatch | ||
| #86 | WPScan – WordPress Security Scanner | 21 | 527 | 265 | 8k+ | Text Domain Mismatch | ||
| #87 | Security Ninja – WordPress Security & Firewall | 29 | 149 | 347 | 7k+ | Direct Query | ||
| #88 | WP EXtra – One Click Optimize | 33 | 414 | 101 | 7k+ | Missing Arg Domain | ||
| #89 | WP Fail2Ban Redux | 82 | 1 | 10 | 7k+ | trademarked term | ||
| #90 | OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) | 27 | 271 | 568 | 6k+ | Request data is not unslashed | ||
| #91 | Prevent XSS Vulnerability | 98 | 10 | 1 | 6k+ | Missing Arg Domain | ||
| #92 | Salt Shaker | 85 | 15 | 13 | 6k+ | Interpolated SQL is not prepared | ||
| #93 | SP Move Login | 26 | 881 | 215 | 6k+ | Text Domain Mismatch | ||
| #94 | SMNTCS Disable REST API User Endpoints | 35 | 8 | 0 | 6k+ | Hidden files included | ||
| #95 | Stop XML-RPC Attacks | 100 | 1 | 6k+ | Non-prefixed class | |||
| #96 | Melapress File Monitor | 80 | 16 | 90 | 6k+ | Non-prefixed global variable | ||
| #97 | Manage XML-RPC | 98 | 3 | 1 | 5k+ | file system operations is writable | ||
| #98 | Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms | 24 | 563 | 548 | 4k+ | Text Domain Mismatch | ||
| #99 | No CAPTCHA reCAPTCHA | 40 | 112 | 26 | 4k+ | Text Domain Mismatch | ||
| #100 | RSFirewall! | 24 | 563 | 521 | 4k+ | Output is not escaped |
