by
atvsoftwarelabs
0 (0 reviews)
ATV Web Security
Remove a compromised website's ability to make persistent changes while keeping it fully readable to visitors.
ATV Web Security ranks #50,914 among WordPress.org plugins with 0+ active installations, is #3,940 of 4,969 in the Security category, and was last updated Oct 22, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.3
v1.0.38
Current Version v1.0.38
Updated 1 day ago
Last Update on 22 Oct, 2026
Refreshed 11 hours ago
Last Refreshed on
#3,940 of 4,969 in Security
Actively maintained
Rank
#50,914
—
No change
Active Installs
0+
—
No change
KW Avg Position
53
—
No change
Downloads
119
+4 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 10
0+
10+
19,312
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 5 more installs to reach 10+
Rank Changes
Current
#50,914
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.0.38
- Last Updated
- Oct 22, 2026
- Requires WP
- 6.0+
- Tested Up To
- 7.1.3
- PHP Version
- 8.0 or higher
- Author
- atvsoftwarelabs
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,762
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,018
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security - Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#17
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#34
WP Super Cache
1M+ installs
#37
Frequently Asked Questions
Common questions about ATV Web Security
Yes. The site remains fully readable and functional for browsing. Only persistent changes are blocked.
Users (including administrators) can browse, read and perform allowed writes. Plugin, theme, core updates, file and database changes that are not explicitly allowlisted are blocked. Turn protection OFF to build, update or modify anything.
Use the Dashboard tab and follow the strong-disable form, or use one of the emergency recovery methods described in docs/RECOVERY.md.
The master password (8-64 letters, digits and symbols) is accepted, and so is your WordPress account password as a fallback — so a site that never configured a master password is never locked out.
When enabled, administrators are asked for a six-digit code sent to their email address after their password is accepted. The code field appears on the login form itself, so no page refresh is needed and every step stays on one screen. A code is valid for 10 minutes, can be resent once a minute (five codes per quarter hour), and the account locks for 15 minutes after five wrong entries.
The login stays blocked on purpose rather than silently downgrading to password-only. Recover from the shell with wp atvws otp disable (or re-enter the master password on an already-unlocked session).
Either factor alone satisfies the check. An account covered by a registered passkey skips the emailed code, and the passkey is hardware-bound so it survives cookie clearing and cannot be copied. Use the two-factor email code when a browser cannot do WebAuthn.
The device token is bound to the browser profile: clearing cookies or switching browsers unlinks it, and a copied cookie could be replayed. A passkey is bound to the device's secure hardware, so it survives cookie clearing and cannot be copied. If you can only pick one, pick the passkey; keep the token as the fallback for browsers that cannot do WebAuthn. Enforcement is off until you turn it on, and no account is ever blocked without a registered passkey.
It reports cryptomining findings without touching anything: script tags naming mining services or pools are removed from rendered pages, WordPress's HTTP API is refused for pool domains, a filesystem scan flags native executables and miner configuration markers, and a database scan looks for injected script blocks. Every result is surfaced on the Miners tab for you to review and act on.
It measures locally, with no third-party call: a release older than two years is flagged as unmaintained, a plugin or theme still on disk but no longer listed in the wordpress.org API is flagged as closed, and the local modification time of the plugin directory cross-checks both. An online feed lookup exists but is opt-in and requires your own API key — nothing phones home about the site by default.
