#904 by installs
NinjaScanner – Virus & Malware scan
A lightweight, fast and powerful virus scanner for WordPress.
- Installs
- 40,000+
- Rating
- 4.0 (36)
- Updated
- 3 months ago
NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall
A true Web Application Firewall to protect and secure WordPress.
- Active installs
- 100,000+
- #345 of 1,000
- Downloads, all time
- 3.7M
- 3,712,084
- Downloads, 30 days
- 98K
- 8.8K in the last 7
- Rating
- 4.9 / 5
- 220 reviews
- Last updated
- 25 days ago
- Oct 6, 2026
- Version
- 4.9.2
- 33 releases
Upkeep and compatibility
| Last updated | October 6, 2026Updated in the last 3 months |
|---|---|
| Tested up to | WordPress 7.1.4Covers WordPress 7.1.4, the current release |
| Needs WordPress | 4.9 or newer |
| Needs PHP | 7.1 or newer |
| First published | March 30, 2013 |
| Support, last two months | 3 of 8 threads resolved (38%) |
Reviews
4.9 / 5 from 220 reviews
| 5 stars | 210 |
|---|---|
| 4 stars | 2 |
| 3 stars | 1 |
| 2 stars | 1 |
| 1 star | 6 |
Downloads, last 30 days
What the author says it does
A true Web Application Firewall
NinjaFirewall (WP Edition) is a true Web Application Firewall. Although it can be installed and configured just like a plugin, it is a stand-alone firewall that stands in front of WordPress.
It allows any blog administrator to benefit from very advanced and powerful security features that usually aren’t available at the WordPress level, but only in security applications such as the Apache ModSecurity module or the PHP Suhosin extension.
NinjaFirewall requires at least PHP 7.1, MySQLi extension and is only compatible with Unix-like OS (Linux, BSD). It is not compatible with Microsoft Windows.
NinjaFirewall can hook, scan, sanitise or reject any HTTP/HTTPS request sent to a PHP script before it reaches WordPress or any of its plugins. All scripts located inside the blog installation directories and sub-directories will be protected, including those that aren’t part of the WordPress package. Even encoded PHP scripts, hackers shell scripts and backdoors will be filtered by NinjaFirewall.
Powerful filtering engine
The opening of the plugin's own description. The full text, installation notes and changelog are on its WordPress.org page.
Questions the author answers
Why is NinjaFirewall different from other security plugins for WordPress ?
NinjaFirewall stands between the attacker and WordPress. It can filter requests before they reach your blog and any of its plugins. This is how it works :
Visitor -> HTTP server -> PHP -> NinjaFirewall #1 -> WordPress -> NinjaFirewall #2 -> Plugins & Themes -> WordPress exit -> NinjaFirewall #3
And this is how all WordPress plugins work :
Visitor > HTTP server > PHP > WordPress > Plugins -> WordPress exit
How powerful is NinjaFirewall?
NinjaFirewall includes a very powerful filtering engine which can detect Web Application Firewall evasion techniques and obfuscation tactics used by hackers, as well as support and decode a large set of encodings. See our blog for a full description: An introduction to NinjaFirewall 3.0 filtering engine.
Do I need root privileges to install NinjaFirewall ?
NinjaFirewall does not require any root privilege and is fully compatible with shared hosting accounts. You can install it from your WordPress admin console, just like a regular plugin.
Does it work with Nginx ?
NinjaFirewall works with Nginx and others Unix-based HTTP servers (Apache, LiteSpeed etc). Its installer will detect it.
Do I need to alter my PHP scripts ?
You do not need to make any modifications to your scripts. NinjaFirewall hooks all requests before they reach your scripts. It will even work with encoded scripts (ionCube, ZendGuard, SourceGuardian etc).
I moved my wp-config.php file to another directory. Will it work with NinjaFirewall ?
NinjaFirewall will look for the wp-config.php script in the current folder or, if it cannot find it, in the parent folder.
Latest changelog entry
- Fixed bugs related to the login protection, the user ennumeration REST API hook and the firewall statistics file.
- WP+ Edition (Premium): Updated IP location databases.
Screenshots
Overview page. 
Statistics and benchmarks page. 
Options page. 
Policies pages 1/3: NinjaFirewall has a large list of powerful and unique policies that you can tweak accordingly to your needs.
Tagged
Plugins that share its tags
Firewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team. Make security a priority with Wordfence.
- Installs
- 5+ million
- Rating
- 4.7 (5K)
- Updated
- 31 days ago
The Sucuri WordPress Security plugin is a security toolset for security integrity monitoring, malware detection and security hardening.
- Installs
- 600,000+
- Rating
- 4.2 (386)
- Updated
- 17 days ago
#522 by installs
Defender Security – Malware Scanner, Login Security & Firewall
WordPress security plugin with malware scanner, IP blocking, audit logs, antivirus scans, firewall, 2FA, brute force login security, and more.
- Installs
- 80,000+
- Rating
- 4.8 (334)
- Updated
- 32 days ago
#882 by installs
Security Plugin, Firewall & Malware Scanner with Auto Removal
Protect WordPress from malware, hackers, brute-force attacks & suspicious traffic. Includes firewall, login security, 2FA & vulnerability checks.
- Installs
- 40,000+
- Rating
- 4.8 (397)
- Updated
- 4 days ago
WordPress login security with brute force protection, Two-factor authentication (2FA/MFA), firewall, IP/country blocking, and login monitoring
- Installs
- 1+ million
- Rating
- 4.8 (1.5K)
- Updated
- 38 days ago
Where this page's numbers come from
Read from the WordPress.org plugin API on , when WordPress 7.1.4 was the current release. WordPress.org rounds active installs into buckets. These are the directory's figures, not my verdict, and I haven't tested this plugin.