Best Firewall & Site Security plugins for WordPress
Plugins that provide broad WordPress security controls, including firewalls, login protection, malware or file monitoring, vulnerability hardening, and security auditing.
Read from 131,237 plugin records - figures refreshed 3 hours ago
205
Plugins classified here
Out of the plugins that have been through the classifier so far
22.7M
Combined active installs
Summed across the published bands, so read it as an order of magnitude
4.53
Average rating
Across the 186 here that carry a rating at all
Sub-categories
Also under Security
The other sub-categories the model built under the same parent.
The plugins
Plugins in Firewall & Site Security
Ranked by active installs; plugins in the same published band share a rank. Each page has a maintenance check and the alternatives.
#1
Wordfence Security – Firewall, Malware Scan, and Login Security
wordfence #2Jetpack – AI Agents & MCP, Security, Backup & Analytics
jetpack #2Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
really-simple-ssl #4WPS Hide Login
wps-hide-login #5All-In-One Security (AIOS) – Security and Firewall
all-in-one-wp-security-and-firewall #5Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security
limit-login-attempts-reloaded #5Loginizer
loginizer #5Safe SVG
safe-svg #5Security Optimizer – The All-In-One Protection Plugin
sg-security #10Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
better-wp-security #11SiteGuard WP Plugin
siteguard #11Sucuri Security – Auditing, Malware Scanner and Security Hardening
sucuri-scanner #13Disable XML-RPC
disable-xml-rpc #13Limit Login Attempts
limit-login-attempts #15BBQ Firewall – Fast & Powerful Firewall Security
block-bad-queries #15CloudSecure WP Security
cloudsecure-wp-security #15Disable XML-RPC-API
disable-xml-rpc-api #15Anti-Malware Security and Brute-Force Firewall
gotmls #15Hide My WP Ghost – Security & Firewall
hide-my-wp #15Jetpack Protect
jetpack-protect #15Login Lockdown & Protection
login-lockdown #15MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall
malcare-security #15NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall
ninjafirewall #15Patchstack – WordPress & Plugins Security
patchstack #15WPS Limit Login
wps-limit-login #26Headers Security Advanced & HSTS WP
headers-security-advanced-hsts-wp #27Defender Security – Malware Scanner, Login Security & Firewall
defender-security #28Disable XML-RPC Pingback
disable-xml-rpc-pingback #28Stop User Enumeration
stop-user-enumeration #28WP fail2ban – Advanced Security
wp-fail2ban #31Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter
anti-spam #31Login No Captcha reCAPTCHA
login-recaptcha #31WP Hide & Security Enhancer
wp-hide-security-enhancer #34HTTP Headers
http-headers #34NinjaScanner – Virus & Malware scan
ninjascanner #34SecuPress with Simple SSL – Simple and Performant Security
secupress #34Security Plugin, Firewall & Malware Scanner with Auto Removal
security-malware-firewall #38AntiVirus
antivirus #38Blackhole for Bad Bots
blackhole-bad-bots #38Disable WP REST API
disable-wp-rest-api #38IP2Location Country Blocker
ip2location-country-blocker #38Protect Uploads
protect-uploads #38Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning
wp-simple-firewall #44iQ Block Country
iq-block-country #44LWS Hide Login
lws-hide-login #44Spider Blocker
spiderblocker #47ClickCease Click Fraud Protection
clickcease-click-fraud-protection #47IP Location Block
ip-location-block #47Lockdown WP Admin
lockdown-wp-admin #47Meta Generator and Version Info Remover
meta-generator-and-version-info-remover #47MilesWeb Tools
milesweb-tools #47Protect WP Admin
protect-wp-admin #47Quttera ThreatSign – Web Malware Scanner for WordPress
quttera-web-malware-scanner #47Simple Login Captcha
simple-login-captcha #47TrustedSite
trustedsite #47WP Limit Login Attempts
wp-limit-login-attempts #47Malcure Malware Shield — Removal, Repair, Monitor
wp-malware-removal #47JWT Authentication for WP REST APIs
wp-rest-api-authentication #47WP Hardening (discontinued)
wp-security-hardening #47WPVulnerability
wpvulnerability #61Brozzme DB Prefix & Tools Addons
brozzme-db-prefix-change #61WP Fingerprint
wp-fingerprint #63Exploit Scanner
exploit-scanner #63Login IP & Country Restriction
login-ip-country-restriction #63SMNTCS Disable REST API User Endpoints
smntcs-disable-rest-api-user-endpoints #63WP-Ban
wp-ban #63WPScan – WordPress Security Scanner
wpscan #68Booter – Bots & Crawlers Manager
booter-bots-crawlers-manager #68DoLogin Security
dologin #68IP Geo Block
ip-geo-block #68Remove & Disable XML-RPC Pingback
remove-xmlrpc-pingback-ping #68Salt Shaker
salt-shaker #68Security Ninja – WordPress Security & Firewall
security-ninja #68WP Fail2Ban Redux
wp-fail2ban-redux #75HTTP Auth
http-auth #75Password Policy Manager
password-policy-manager #75Prevent XSS Vulnerability
prevent-xss-vulnerability #75SP Move Login
sf-move-login #75Stop XML-RPC Attacks
stop-xml-rpc-attacks #80Enable CORS
enable-cors #80Manage XML-RPC
manage-xml-rpc #80Melapress File Monitor
website-file-changes-monitor #83Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms
limit-attempts #83Login Security Solution
login-security-solution #83RSFirewall!
rsfirewall #83Simple Login Lockdown
simple-login-lockdown #83Fraud Prevention For WooCommerce and EDD
woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers #88Advanced IP Blocker
advanced-ip-blocker #88BotBlocker Security – Complete security platform
botblocker-security #88DefendWP Firewall
defend-wp-firewall #88Melapress Login Security
melapress-login-security #88Protection Against DDoS
protection-against-ddos #88Security Headers
security-headers #88Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…
vigilante #88WP Anti-Clickjack
wp-anti-clickjack #88WPEPP – Essential Security, Password Protect & Login Page Customizer
wp-edit-password-protected #88WP fail2ban Blocklist
wpf2b-addon-blocklist #98Admin login URL Change
admin-login-url-change #98Advanced Country Blocker
advanced-country-blocker #98Compromise Scanner for wp2shell
compromise-scanner-for-wp2shell #98CrowdSec
crowdsec #98Content Security Policy Manager
csp-manager #98Lock Down Admin
fullestop-lock-down-admin #98HTACCESS IP Blocker
htaccess-ip-blocker #98IP Ban
simple-ip-ban #98Smart User Slug Hider
smart-user-slug-hider #98Virusdie | One-click website security
virusdie #98WP Admin Basic Auth
wp-admin-basic-auth #109Banhammer – Monitor Site Traffic, Block Bad Users and Bots
banhammer #109Lord of the Files: Enhanced Upload Security
blob-mimes #109CloudGuard
cloudguard #109Country Access Blocker
country-access-blocker #109WebDefender Security – Protection & AntiSpam
cwis-antivirus-malware-detected #109FraudLabs Pro for WooCommerce
fraudlabs-pro-for-woocommerce #109GD Security Headers
gd-security-headers #109Geo Blocker – Control Site Access by Region and IP
geo-blocker #109Injection Guard
injection-guard #109JetHost Total Care – Security & Enhancements
jethost-total-care #109NETSENSAI Shield
netsensai-shield #109Password bcrypt
password-bcrypt #109Proxy & VPN Blocker
proxy-vpn-blocker #109Remove Meta Generators
remove-meta-generators #109REST API Toolbox
rest-api-toolbox #109HTTP Security Header
security-header #109Simple Disable XML-RPC
simple-disable-xml-rpc #109SiteLock Security – WP Hardening, Login Security & Malware Scans
sitelock #109Remove XML-RPC Methods
wee-remove-xmlrpc-methods #128Bot Traffic Shield – Block Bad Bots and Stop AI Bots Crawlers
bot-traffic-shield #128SKP WP Admin Login Captcha
sk-wp-admin-login-captcha #130Analytics Spam Blocker
analytics-spam-blocker #130Easy Basic Authentication – Add basic auth to site or admin area
easy-basic-authentication #130Emergency password reset
emergency-password-reset #130Security Headers
firstpage-sg-security-headers #130Site Lockdown Security
folder-auditor #135Atlant Security
atlant-security #135Atomic Edge Security – Firewall, Malware Scan and Login Security
atomic-edge-security #135Protect Login
protect-login #135Security.txt Manager
security-txt-manager #135Snitch
snitch #135WebTotem Security
wt-security #141Block wp-login
block-wp-login #141Security Safe
security-safe #143Auto SRI
auto-sri #143Block Referer Spam
block-referer-spam #143CHEQ Essentials
cheq-essentials-go-to-market-security #143CloudFilt Bot & Spam Protection
cloudfilt-codes #143Hide WP Admin Login
hide-wp-admin-login #143Login Armor
login-armor #149Checkout Shield for WooCommerce – Stop Fake Orders, Spam Bots & Card Testing
carticy-checkout-shield-for-woocommerce #149Easy IP Blocker
easy-ip-blocker #149Honeypot Toolkit
honeypot-toolkit #149Htaccess by BestWebSoft – WordPress Website Access Control Plugin
htaccess #149Kaya Login Captcha
kaya-login-captcha #149Passwords Evolved
passwords-evolved #149CMS ADMINS Security Check Report
security-check-report #149Security Header Generator
security-header-generator #149Security Ninja For MainWP
security-ninja-for-mainwp #158Anti Fake Orders & IP Blocker
anti-fake-orders-ip-blocker #158Apocalypse Meow
apocalypse-meow #158BitFire Security – Firewall, Malware Scanner, Bot Blocker, Login Protection
bitfire #158Captchinoo, admin login page protection with Google recaptcha
captchinoo-captcha-for-login-form-protection #158Generate Security.txt
generate-security-txt #158IP & Country Blocker Lite
ip-blocker-lite #158No Weak Passwords
no-weak-passwords #158Rename Plugins Folder
rename-plugins-folder #158Weborado Helper
weborado-helper #158WEDOS | Protection & Cache Performance
wgpwpp #168Basic Security: Prevent Cross Site Scripting
basic-security #168CSP Friendly Security
csp-antsst #168Fraud and Scam Detection For WooCommerce
fraud-and-scam-detection-for-woocommerce #168Integrity Checker
integrity-checker #168Lockora Security Audit
lockora-security-audit #168Login Security with Telegram Alerts
login-security-with-telegram-alerts #168Mythic Cerberus
mythic-cerberus #168No unsafe-inline
no-unsafe-inline #168DFX Random User IDs
random-user-ids #168REST API Guard
rest-api-guard #168Security Hardener
security-hardener #168Speedx – Disable Login Verification Required Emails for Wordfence
speedx-disable-login-verification-required-emails-for-wordfence #168VPN Guard – Block VPN, Proxy, Bots & Anonymous Visitors
vpn-guard #168reCaptcha by WebDesignBy
webdesignby-recaptcha #168eDarpan: Website Protection
wordpress-protection #168Protector – Malware Removal, Firewall & Core Repair
wp-admin-protect #168wsecure lite
wsecure #185A little more secure
a-little-more-secure #185Agency Toolkit
agency-toolkit #185AIO Tools (All in One Tools)
aio-tools #185Aipatch Security Scanner
aipatch-security-scanner #185Deactivate XML-RPC Service
deactivate-xml-rpc-service #185Disable AI for Security
disable-ai-for-security #185Fail2WP
fail2wp #185HT Security
ht-security #185NutsForPress Login Watchdog
nutsforpress-login-watchdog #185OOPVulns: Vulnerability Scanner
oopvulns-vulnerability-scanner #185SecuSeek – Web Security Scanner & Vulnerability Assessment
secuseek #185Supervisor
supervisor #185Turn Off REST API
turn-off-rest-api #185Virus Finder
virus-finder #185Country Block – Ultimate Geo-Blocker, IP Ban & Login Security
vpndeals-country-block #185Interaktiv Security Scanner
vulnerability-monitor-for-wordfence-intelligence
Capped
Showing the 200 most installed of 205 classified here.
This grouping does not exist anywhere else
The directory sorts plugins by tags their authors typed. This is what a model reading each plugin produced instead - and the method page says how consistent that is.