Block spam comments, defend against login attacks, strengthen site security. Anti-spam, brute-force protection & two-factor authentication built in.
- Installs
- 50,000+
- Rating
- 4.5 (370)
- Updated
- 3 days ago
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
Harden your site security with Login Security, Two-Factor Authentication (2FA), Vulnerability Scanner, Firewall, and more. Formerly iThemes Security.
- Active installs
- 700,000+
- #88 of 1,000
- Downloads, all time
- 40.2M
- 40,201,673
- Downloads, 30 days
- 683.5K
- 59K in the last 7
- Rating
- 4.6 / 5
- 3,992 reviews
- Last updated
- 17 days ago
- Oct 14, 2026
- Version
- 10.0.6
- 98 releases
Upkeep and compatibility
| Last updated | October 14, 2026Updated in the last 3 months |
|---|---|
| Tested up to | WordPress 7.1.4Covers WordPress 7.1.4, the current release |
| Needs WordPress | 6.5 or newer |
| Needs PHP | 7.4 or newer |
| First published | October 23, 2010 |
| Support, last two months | 3 of 12 threads resolved (25%) |
Reviews
4.6 / 5 from 3,992 reviews
| 5 stars | 3,419 |
|---|---|
| 4 stars | 177 |
| 3 stars | 46 |
| 2 stars | 61 |
| 1 star | 289 |
Downloads, last 30 days
What the author says it does
Reduce your WordPress website’s risk to nearly zero with Kadence Security
Formerly iThemes Security. Looking for iThemes? Learn more here.
On average, 30,000 websites are hacked every day.* Cyberattacks in the US increased by 57% in 2022.** Bad actors who want to hack your site, steal your data, and cripple your business are a 24/7/365 threat.
You need a proactive, strategic approach to WordPress website security that protects your site from brute force attacks, malware infections, and other cyber threats.
Kadence Security shields your site from cyberattacks and prevents security vulnerabilities. It automatically locks out bad users identified by our Brute Force Protection Network that is nearly 1 million sites strong and leverages your own blacklist. It secures and protects your most commonly attacked part of your WordPress website – user login authentication.
With Patchstack integration (Pro) protects your site before you even have a chance to address vulnerabilities and before a plugin or theme vendor or developer can even issue a patch.
That’s 24/7/365 always-on truly Kadence Security.
🌐 Secure your Website in Minutes
The opening of the plugin's own description. The full text, installation notes and changelog are on its WordPress.org page.
Questions the author answers
Why does Kadence Security require the latest WordPress version? Can’t I use a slightly older version?
- One of the best security practices for a WordPress site owner is keeping software up to date. Because of this, we only test this plugin on the latest stable version of WordPress and will only guarantee it works in the latest version.
Will this plugin completely stop all attacks on my site?
- No. Kadence Security is designed to help improve the security of your WordPress installation from many common attack methods, but it cannot prevent every possible attack. Nothing replaces diligence and good practice. This plugin makes it a little easier for you to apply both.
Is this plugin only for new WordPress installs or can I use it on existing sites, too?
- While Kadence Security can be installed on either a new or existing site, we strongly recommend making a complete backup of your existing site before applying any features included in this plugin.
Will this plugin work on all servers and hosts?
- Kadence Security requires Apache or LiteSpeed and mod_rewrite or NGINX to work.
What changes does this plugin make that can break my site?
- Kadence Security makes significant changes to your database and other site files which can be problematic for existing WordPress sites. Again, we strongly recommended making a complete backup of your site before using this plugin. While problems are rare, most support requests involve the failure to make a proper backup before installation.
Latest changelog entry
- Bug Fix: Prevented wp-config.php and .htaccess from being left empty after a server crash or a failed file update.
- Bug Fix: Resolved an error that broke the Firewall settings tab when IP Detection was set to “Unconfigured”.
- Bug Fix: Resolved an issue where modals and popovers in the admin UI rendered without their styles.
Screenshots
Customized onboarding configures your security settings to your needs 
Real-Time Security Dashboard 
WordPress Login Security with Two Factor Authentication 
Firewall rules, Block Bad Bots, and Ban User Agents with Lockouts
Tagged
Plugins that share its tags
Firewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team. Make security a priority with Wordfence.
- Installs
- 5+ million
- Rating
- 4.7 (5K)
- Updated
- 31 days ago
#57 by installs
All-In-One Security (AIOS) – Security and Firewall
Protect your WordPress site with All-In-One Security (AIOS): easy-to-use login security, a powerful firewall, and much more.
- Installs
- 1+ million
- Rating
- 4.7 (1.7K)
- Updated
- 1 day ago
The Sucuri WordPress Security plugin is a security toolset for security integrity monitoring, malware detection and security hardening.
- Installs
- 600,000+
- Rating
- 4.2 (386)
- Updated
- 17 days ago
A true Web Application Firewall to protect and secure WordPress.
- Installs
- 100,000+
- Rating
- 4.9 (220)
- Updated
- 25 days ago
#356 by installs
Jetpack Protect
Free daily vulnerability scans & WordPress security, powered by WPScan (an Automattic brand) and its 60,000+ vulnerability database. No setup needed!
- Installs
- 100,000+
- Rating
- 4.6 (123)
- Updated
- 3 months ago
Where this page's numbers come from
Read from the WordPress.org plugin API on , when WordPress 7.1.4 was the current release. WordPress.org rounds active installs into buckets. These are the directory's figures, not my verdict, and I haven't tested this plugin.