by
Forge12 Interactive GmbH
0 (0 reviews)
Forge12 Security – Firewall, Malware Scanner, 2FA & Login Security
Firewall, malware scanner, 2FA and login protection that keeps your visitors' data on your own server. No CDN, no tracking, made in Germany.
Forge12 Security ranks #20,149 among WordPress.org plugins with 60+ active installations, is #1,176 of 5,058 in the Security category, and was last updated Oct 27, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.4
v3.9.10
Current Version v3.9.10
Updated 1 week ago
Last Update on 27 Oct, 2026
Refreshed 1 week ago
Last Refreshed on
#1,176 of 5,058 in Security
Top 25% by installs
Downloads -45% this week
Actively maintained
Rank
#20,149
—
No change
Active Installs
60+
+200%
KW Avg Position
121.7
1.6 better
Downloads
1.2K
+17 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 70
60+
70+
3,687
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 5 more installs to reach 70+
Rank Changes
Current
#20,149
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 3.9.10
- Last Updated
- Oct 27, 2026
- Requires WP
- 6.2+
- Tested Up To
- 7.1.4
- PHP Version
- 8.1 or higher
- Author
- Forge12 Interactive GmbH
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#18
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#36
Frequently Asked Questions
Common questions about Forge12 Security – Firewall, Malware Scanner, 2FA & Login Security
Everything described on this page is free and stays free, without a trial period or a limit. Forge12 Security Pro is an add-on for sites that want problems fixed rather than reported: one-click repair of modified files and restore from quarantine, a firewall stage that runs before WordPress, same-day malware signatures and firewall rules, country blocking, a tamper-proof audit trail, Slack and Telegram alerts, and remote monitoring for many sites.
Yes. Pro extends this plugin and needs it installed and active. Removing Pro leaves this plugin and all of its settings as they were.
Yes. Forge12 Security operates at the PHP level and is compatible with all major caching plugins. Rate limiting and firewall checks happen before page caching kicks in.
No. If you forget the custom login URL, you can deactivate the plugin via FTP/file manager and the standard wp-login.php will work again. Password-protected post forms (action=postpass) continue to work normally.
By default, IP addresses are hashed using HMAC-SHA256 and never stored in plain text. Optionally, you can enable AES-256-CBC encrypted storage if you need to identify specific IPs. These options help minimize stored personal data; they do not guarantee GDPR compliance.
While possible, we recommend using only one comprehensive security plugin to avoid conflicts. If you need specific features from another plugin, you can disable overlapping modules in Forge12 Security.
Suspicious files are flagged with the detected signature name. You can review the file, move it to encrypted quarantine, or permanently delete it after a separate confirmation. Modified WordPress, plugin and theme files are compared with their published version; to replace one, reinstall or update it from the dashboard. Confirmed false positives can be ignored or excluded.
The honeypot adds an invisible form field to login and comment forms. Real users never see or fill it. Bots that automatically fill all form fields trigger the honeypot and are blocked. The field name rotates every 6 hours to prevent bot adaptation.
A small client is loaded on your login, registration and password reset forms. It watches how the form is filled in and leaves a token on it; on submission the plugin asks the SilentShield API what that token was worth, and you set the threshold below which a submission is refused. It replaced the Google reCAPTCHA integration in 3.3.44, because that one loaded Google’s script into the browser of everybody who opened your login page, handing Google their address and setting Google’s cookies for a form only your own staff ever use. SilentShield is Forge12’s own service and answers from a German host with no CDN in front of it, so the transfer is one you can put in a contract. What has not changed: it is still a third-party script in the visitor’s browser, and the visitor’s address still reaches somebody else. Like the check it replaced it fails open by default — an outage at the API must never be the reason nobody can log in — and a filter is there for sites that would rather be locked out than let a bot through.
No. The HIBP check uses k-Anonymity: only the first 5 characters of the SHA-1 hash of the password are sent to the API. The full password never leaves your server. Results are cached for 24 hours.
