Ultimate Security

Description

Automated bots probe WordPress logins and forms around the clock. Ultimate Security shuts that down — with two-factor authentication, brute-force lockouts, anti-spam CAPTCHA, a hidden login URL, session controls, vulnerability scanning and Cloudflare edge rules — all from a clean dashboard you do not need to be a security expert to run.

🎥 Watch a 2-minute intro:

🛡️ Lightweight. Privacy-first. No bloat.

Why Ultimate Security?

• It just works. Sensible defaults out of the box — turn it on, you are safer in minutes.
• Nothing is guessed. A guided setup scans your site first, shows you every change before it happens, and can undo all of it.
• Built for real attacks. Stops the automated login, brute-force and spam traffic that actually hits WordPress sites.
• Zero learning curve. Plain-English settings, and a Test Mode to preview rules before they go live.
• Privacy-respecting. No product-usage telemetry and no hidden phone-home tracking. Pro features are clearly labelled.

🚀 Guided setup in about 3 minutes

• Five short steps — tell us about the site, we run a quick automatic check, you pick one protection template, then review and apply.
• See every change before it happens. The wizard shows a full diff of what it will change.
• Undo all setup changes afterwards, without overwriting edits you made yourself.
• Seven templates to start from: basic, moderate, strict, agency, blog, membership and WooCommerce.
• An emergency access link is shown during setup — save it, and you can deactivate the plugin from a browser if you ever lock yourself out.

🔐 Two-Factor Authentication

• Email one-time codes — no app required, works for every user.
• Authenticator apps — TOTP and HOTP, compatible with Google Authenticator, Authy, Microsoft Authenticator and others, with QR-code enrolment.
• Per-user setup with role-based configuration — decide which roles use email codes and which use an authenticator app.
• Built-in rate limiting on code entry, with a configurable attempt limit and lockout.
• 2FA event logging you can switch on or off.
• Works with your login flow — WordPress, WooCommerce and Ultimate Member login forms, plus a setting for XML-RPC requests.

🚪 Login access control

• Custom login URL — move wp-login.php to a secret address so bots cannot find it, with a configurable post-login redirect.
• HTTP Basic Authentication — put a second password wall in front of wp-login.php and wp-admin, with no .htaccess editing. The password is stored hashed, repeated failures trigger a lockout, and you can allow trusted IP addresses straight through.
• Login page consent notice — display your own consent or policy text on the login form.

🔑 Password policies

• Enforce minimum length, mixed case, numbers and special characters, or start from a preset.
• Password expiry with advance warning, a grace period and email notification.
• Password history so old passwords cannot be recycled.
• Force a password change on first login.
• Refuse compromised passwords — checked against the Have I Been Pwned Pwned Passwords range API using k-anonymity, so the password itself never leaves your site.
• Optionally disable self-service password reset and point users at your own instructions instead.

🛑 Brute-force protection

• Limit failed login attempts and lock offenders out automatically.
• Progressive lockouts — repeat offenders get longer lockouts.
• Configurable retry-reset window, and a permanent block list for persistent offenders.
• One-time recovery link so a lockout never leaves you stranded.

👥 Session management

• Limit concurrent logins per user, and choose whether to block the new login or sign out the oldest session.
• Idle timeout for inactive sessions.
• Harden auth cookies with HttpOnly, Secure and SameSite flags.
• Bind a session to its IP address and/or browser to detect session hijacking.

🤖 Bot & spam protection

• Google reCAPTCHA v2 and v3 — including a v3 score threshold, IP and user-agent allowlists, a bypass for logged-in users, and a log of recent verifications.
• Cloudflare Turnstile — with theme, size, language and appearance options, deferred script loading, custom failure messages and its own log.
• Form coverage for both providers: WordPress login, registration, lost-password and comment forms, plus WooCommerce login, registration, lost-password and checkout forms.
• No-conflict mode and provider priority so two CAPTCHAs never render on the same form.
• Key verification — validate your site and secret keys from the settings page before going live.
• Outage handling — if the CAPTCHA provider is unreachable, your forms keep working.

🔎 Vulnerability scanning

• Scan WordPress core, plugins and themes for publicly known vulnerabilities.
• No API key required. The scanner uses the keyless WPVulnerability database by default.
• Optionally add a WPScan or Patchstack API key for additional coverage, with automatic failover between providers.
• Scheduled scans with email alerts, filtered by the severity you care about.
• Abandoned plugin detection — flags extensions that have not been updated in a long time.
• Scan history, comparison between runs, and an ignore list for findings you have accepted.
• Results surface where you already look: Site Health, the WordPress dashboard widget, the plugins list table and menu counters.

☁️ Cloudflare WAF rules

Connect your own Cloudflare account and manage edge rules from wp-admin:

• Allow good bots — keep verified search, monitoring, backup, SEO and social crawlers working.
• Block aggressive crawlers and sensitive WordPress paths.
• Block web hosts and TOR exit nodes.
• Challenge large cloud providers and selected countries.
• Challenge VPN traffic and requests to wp-login.php.
• Virtual patches — block requests exploiting known WordPress core CVEs at the edge until you can update.
• Preview the generated rule expressions before you deploy anything, review the live rules on your zone, and see request, threat and bandwidth analytics.

🧂 WordPress security keys (salts)

• Rotate the security keys and salts in wp-config.php on demand or on a schedule — daily, weekly, monthly, quarterly or twice a year.
• Advance notification before a scheduled rotation, so a forced re-login is never a surprise.
• Quiet hours, plus pause and skip-next controls.
• Rotation history with the ability to restore a previous set of keys.

🔄 Update Manager

• Set auto-update policy for WordPress core, plugins and themes, with per-plugin and per-theme overrides.
• Update windows and allowed days, plus freeze periods for the times you do not want anything changing.
• Delay updates by a set number of days to let others find the bugs first.
• Optional maintenance mode during updates, and detection of version-controlled installs.
• Email notifications and a daily digest.

📊 Monitoring, Security Score & logs

• Security Score — a scored posture with a per-check breakdown showing exactly what is holding the score down.
• Activity log — successful and failed logins, logouts, lockouts, 2FA events and password events, with a configurable retention period.
• Session log for session events and anomalies.
• Who’s online — see which users are active right now.
• WordPress core file integrity check — verify core files against the official WordPress.org checksums.
• Site Health integration — plugin, server, database, filesystem, theme and WordPress diagnostics added to the Site Health screen.
• Dashboard widget summarising failed logins, issues found, outdated plugins and your current score.

🧪 Test Mode

• Simulate your security rules without blocking anyone.
• Review a log of exactly what would have been blocked before you enforce it.
• Choose which roles are affected, and keep administrators excluded.
• An admin-bar indicator and dashboard notice make sure you never forget it is on.

🧰 Tools, migration & backup

• Migrate from Wordfence Login Security — preview what will be imported, run it, and roll it back if you change your mind.
• Export and import settings as JSON for staging-to-production moves or disaster recovery.
• Reset all settings back to defaults, and clear the plugin cache.
• Diagnostics — REST API status, cron status with a manual run trigger, and server status.
• Emergency deactivation URL — a secret link that switches the plugin off if you are locked out.

🧩 Works with what you already run

Ultimate Security detects and adapts to WooCommerce, Ultimate Member, popular page builders, form plugins, caching plugins and SEO plugins, and warns you when another security plugin is doing the same job.

⌨️ WP-CLI

wp ultimate-security template list
wp ultimate-security template apply <template> [--dry-run]
wp ultimate-security template undo
wp ultimate-security export [--file=<path>]
wp ultimate-security import <file> [--dry-run]
wp ultimate-security status

👉 Check Out »

🛠️ Recommended setups by use case

Different sites face different threats. Start with the profile that matches you, then layer on more from the documentation.

• Solo blogger / personal site — Enable Email 2FA on the admin account, set a 5-attempt login lockout with a 15-minute cooldown, set a custom login URL, and add Cloudflare Turnstile to the comment form.
• Small agency / multi-author site — Require authenticator-app 2FA per role for editor and above, enforce password length + history, cap concurrent logins per user, and enable Test Mode before tightening rules.
• WooCommerce store — Add reCAPTCHA or Turnstile to login, registration, lost-password and checkout forms, set a custom login URL, enable brute-force lockout, and run a vulnerability scan weekly.
• Membership / community site — Per-user 2FA enabled site-wide, strong password policy, session limits to block account sharing, and CAPTCHA on registration to keep bot signups out.

Every setup above uses only free features. See the full setup guides for step-by-step instructions.

📖 Security terms in plain English

New to WordPress security? Here is what the jargon means and why each one matters.

• Two-Factor Authentication (2FA) — A second proof of identity (a one-time code) on top of your password, so a stolen password alone cannot log in.
• Brute force — Automated tools that guess thousands of password combinations against your login form; lockouts cut them off after a few failures.
• CAPTCHA — A small puzzle or invisible check that confirms a real human is filling out a form, blocking most spam bots.
• Custom login URL — Moving your login page from the well-known /wp-login.php to a secret path so automated scanners cannot find it.
• Vulnerability scanning — Checking your installed plugins, themes and WordPress version against public databases of known security flaws, so you learn about a problem before an attacker uses it.
• Virtual patching — Blocking the specific requests that exploit a known flaw at the network edge, which buys you time when an update is not available yet.
• Salt rotation — Replacing the random secret keys in wp-config.php to invalidate stolen sessions and force re-login everywhere.
• Session control — Limiting how many places one account can be logged in at once and hardening the auth cookie.
• Test Mode — Previewing which requests a new rule would have blocked, before the rule starts blocking anything for real.

Each term links to deeper reading in the documentation.

📚 Learn more

• 🌐 Website — features, articles and more.
• 📘 Documentation — setup guides, troubleshooting, and how-tos.
• 🎥 YouTube channel — video walkthroughs and tutorials.

🎯 Featured guides

Short, focused reads that get most sites secure in under an hour. All link into the documentation.

• Set up Email 2FA for your admin account — the fastest single thing you can do to block account takeover.
• Add an authenticator app (TOTP/HOTP) for stronger 2FA — Google Authenticator, Authy, Microsoft Authenticator.
• Pick a safe custom login URL — what to choose, what to avoid, how to recover if you forget it.
• Add reCAPTCHA or Cloudflare Turnstile to your forms — including WooCommerce login, registration and checkout.
• Tune brute-force lockout without locking yourself out — sane attempt limits, lockout duration, allowlists.
• Run your first vulnerability scan — reading the results, and what to do about an abandoned plugin.
• Rotate WordPress security keys (salts) safely — when to rotate, what it logs everyone out of, and how to schedule it.

External Services

This plugin connects to the following third-party services, and only when you use the related feature:

Google reCAPTCHA

• When: reCAPTCHA protection is enabled. The reCAPTCHA script is then loaded in your visitors’ browsers on the protected forms.
• Data sent: the visitor’s reCAPTCHA response token, your site secret key, and the visitor’s IP address for verification.
• Endpoints: https://www.google.com/recaptcha/api.js (browser script, with a preconnect to https://www.gstatic.com) and https://www.google.com/recaptcha/api/siteverify (server-side verification).
• Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy

Cloudflare Turnstile

• When: Cloudflare Turnstile protection is enabled. The Turnstile script is then loaded in your visitors’ browsers on the protected forms.
• Data sent: the visitor’s Turnstile response token, your site secret key, and the visitor’s IP address for verification.
• Endpoints: https://challenges.cloudflare.com/turnstile/v0/api.js (browser script) and https://challenges.cloudflare.com/turnstile/v0/siteverify (server-side verification).
• Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.com/privacypolicy/

WPVulnerability

• When: the Vulnerability Scanner runs. This is the default vulnerability database and requires no API key.
• Data sent: your WordPress version and the slugs of your installed plugins and themes.
• Endpoint: https://www.wpvulnerability.net/
• Privacy: https://www.wpvulnerability.net/

WPScan

• When: the Vulnerability Scanner runs and you have configured a WPScan API key.
• Data sent: your WPScan API key, your WordPress version, and the slugs of your installed plugins and themes.
• Endpoint: https://wpscan.com/api/v3/
• Terms: https://wpscan.com/terms-of-service/ — Privacy: https://wpscan.com/privacy-policy/

Patchstack

• When: the Vulnerability Scanner runs and you have configured a Patchstack API key.
• Data sent: your Patchstack API key, your WordPress version, and the slugs of your installed plugins and themes.
• Endpoint: https://patchstack.com/database/api/v2/
• Terms: https://patchstack.com/terms-of-service/ — Privacy: https://patchstack.com/privacy-policy/

WordPress.org Plugin and Theme Information API

• When: the Vulnerability Scanner checks whether an extension has been abandoned, and when the Update Manager gathers update information.
• Data sent: the slugs of your installed plugins and themes (no user data).
• Endpoints: https://api.wordpress.org/plugins/info/1.2/ and https://api.wordpress.org/themes/info/1.2/
• Privacy: https://wordpress.org/about/privacy/

WordPress.org Core Version Check

• When: the Update Manager checks for available WordPress core updates.
• Data sent: a standard WordPress core version-check request (no user data).
• Endpoint: https://api.wordpress.org/core/version-check/1.7/
• Privacy: https://wordpress.org/about/privacy/

WordPress.org Core Checksums

• When: you run the WordPress core file-integrity check.
• Data sent: your WordPress version and locale, in order to retrieve the official file checksums for comparison.
• Endpoint: https://api.wordpress.org/core/checksums/1.0/
• Privacy: https://wordpress.org/about/privacy/

WordPress.org Secret-Key (Salt) API

• When: you rotate WordPress security keys and salts, on demand or on a schedule.
• Data sent: a request for randomly generated salt strings (no site or user data).
• Endpoint: https://api.wordpress.org/secret-key/1.1/salt/
• Privacy: https://wordpress.org/about/privacy/

Cloudflare API

• When: you connect Cloudflare or preview, deploy, remove or analyse WAF rules.
• Data sent: …