Firewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team. Make security a priority with Wordfence.
- Installs
- 5+ million
- Rating
- 4.7 (5K)
- Updated
- 31 days ago
Security Plugin, Firewall & Malware Scanner with Auto Removal
Protect WordPress from malware, hackers, brute-force attacks & suspicious traffic. Includes firewall, login security, 2FA & vulnerability checks.
- Active installs
- 40,000+
- #882 of 1,000
- Downloads, all time
- 3.1M
- 3,097,683
- Downloads, 30 days
- 66.8K
- 28.2K in the last 7
- Rating
- 4.8 / 5
- 397 reviews
- Last updated
- 4 days ago
- Oct 27, 2026
- Version
- 2.191
- 312 releases
Upkeep and compatibility
| Last updated | October 27, 2026Updated in the last 3 months |
|---|---|
| Tested up to | WordPress 7.1.4Covers WordPress 7.1.4, the current release |
| Needs WordPress | 5.0 or newer |
| Needs PHP | 7.2 or newer |
| First published | August 24, 2016 |
| Support, last two months | 32 of 40 threads resolved (80%) |
Reviews
4.8 / 5 from 397 reviews
| 5 stars | 366 |
|---|---|
| 4 stars | 6 |
| 3 stars | 3 |
| 2 stars | 3 |
| 1 star | 19 |
Downloads, last 30 days
What the author says it does
Brute force, Login security & Two Factor Auth (2FA). Limit login. Malware & Vulnerabilities scan. FireWall. Enterprise ready security plugin.
SECURITY PLUGIN BY CLEANTALK (SPBCT)
We focus on eliminating the most common security threats for WordPress. At the same time, we strive to ensure that site performance remains unaffected. To achieve this, each release goes through automated and expert-driven testing pipelines. We also verify performance using Google PageSpeed Insights and GTMetrix. Typically, we release a new version twice a month to keep features up to date and protection strong.
SECURITY FEATURES
- Limit Login Attempts and rate limits for logins.
- Two Factor Authentication (2FA)
- Custom wp-login URL (wp-login.php)
- Hide Login Default Login Page
- Disable or Stop User Enumeration
- Brute force protection for WordPress accounts and passwords
- Security Protection for WordPress login form
- Security FireWall by IP, Networks, or Countries
- Web Application Firewall (WAF)
- Real-time traffic monitor (Visitors per pages, IPs, Countires and hits counts per page)
- Malware scanner with auto-cure function
- Daily auto malware scan
- Vulnerabilities scanner among installed plugins and themes
- Security weekly reports to email
- Notifications of login events to your website
FREE TRIAL THEN $9 PER YEAR
The opening of the plugin's own description. The full text, installation notes and changelog are on its WordPress.org page.
Questions the author answers
Why are they attacking me?
Hackers want to get access to your website and use it to get backlinks from your site to improve their site’s PageRank or redirect your visitors to malicious sites or use your website to send spam and viruses or other attacks.These attacks can damage your reputation with readers and commentators if you fail to tackle it.
How to test the security service?
Please use the wrong username or password to log-in to your WP admin panel to see how the Security Plugin works. Then you may log-in with your correct account name and see the logs for the last actions in the settings or our plugin. Also, Audit Log will display the last visited URL’s of the current user.
Is the plugin compatible with WordPress MultiUser (WPMU or WordPress network)?
Yes, the plugin is compatible with WordPress MultiUser.
How to control security activities on your website?
Go to your CleanTalk account->Log. Use filters to sort data for analyses.
Security logs provide you to receive and keep information for 45 days. You have the following possibilities:
1. Time period for all records you want to see.
• Website for which you want to see security records. Leave the field empty to see security records for all websites.
• Choose an event you want to see:
Is it possible to set custom email for notification?
Yes, it is possible. Go to your CleanTalk account->Change email https://cleantalk.org/my/change-email
Why do you need an access key?
Access Key allows you to keep statistics up to 45 days in the cloud and different additional settings and has more possibilities to sort the data and analyses. Our plugin evolves to Cloud Technology and all its logs are transferred to Cloud. Cloud Service takes data processing and data storage and allows to reduce your webserver load.
Latest changelog entry
- Fix. FSW. Restriction of access to FSW, edits for wpms, restriction for file actions (#762)
- Fix. 2FA. Flow updates. (#761)
- Fix. Settings. Links updated.
- Fix. Cure. Fixed cure regex errors before writing file contents.
- Fix. Scanner. Cure. Skip cure stage if option is currently disabled in settings.
- Fix. Scanner. Now manual scan starts correctly even if automatic scan option is disabled.
- Fix. Code. Optimizing the parsing of approved hashes https://app.doboard.com/1/task/57727
Screenshots
Firewall log tab. The log includes detailed info about each of visitor that reached the site and his firewall check status. Also show… 
Critical Updates tab. Critical Updates interface. 
File System Watcher tab. File System Watcher interface. 
Malware scanner tab. Here you can scan all WordPress files for malicious and suspicious code and see the result.
Tagged
Plugins that share its tags
WordPress login security with brute force protection, Two-factor authentication (2FA/MFA), firewall, IP/country blocking, and login monitoring
- Installs
- 1+ million
- Rating
- 4.8 (1.5K)
- Updated
- 38 days ago
#51 by installs
Security Optimizer – The All-In-One Protection Plugin
Secure your WordPress site from brute-force attacks, threats, malware, and bots. Free to use and easy to set up.
- Installs
- 1+ million
- Rating
- 4.5 (157)
- Updated
- 17 days ago
The Sucuri WordPress Security plugin is a security toolset for security integrity monitoring, malware detection and security hardening.
- Installs
- 600,000+
- Rating
- 4.2 (386)
- Updated
- 17 days ago
A true Web Application Firewall to protect and secure WordPress.
- Installs
- 100,000+
- Rating
- 4.9 (220)
- Updated
- 25 days ago
#401 by installs
Hide My WP Ghost – Security & Firewall
Hide My WP Ghost is a WordPress security plugin that hides WP paths and protects your site with Path Security, Firewall, Brute Force Protection, 2FA
- Installs
- 100,000+
- Rating
- 4.5 (373)
- Updated
- 1 day ago
Where this page's numbers come from
Read from the WordPress.org plugin API on , when WordPress 7.1.4 was the current release. WordPress.org rounds active installs into buckets. These are the directory's figures, not my verdict, and I haven't tested this plugin.