by
Nazmul Hasan Robin
0 (0 reviews)
NHR Secure – Security, Firewall, 2FA, Login Protection & Activity Log
WordPress security that stays out of the way: login protection, two-factor, firewall, hardening, a scanner and an activity log.
NHR Secure ranks #69,133 among WordPress.org plugins with 0+ active installations, is #1,407 of 1,659 in the Authentication category, and was last updated Oct 16, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.4
v2.3.0
Current Version v2.3.0
Updated 3 weeks ago
Last Update on 16 Oct, 2026
Refreshed 1 week ago
Last Refreshed on
#1,407 of 1,659 in Authentication
Actively maintained
Rank
#69,133
—
No change
Active Installs
0+
-100%
KW Avg Position
N/A
—
No change
Downloads
1.3K
+6 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 10
0+
10+
41,565
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 10 more installs to reach 10+
Rank Changes
Current
#69,133
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 2.3.0
- Last Updated
- Oct 16, 2026
- Requires WP
- 6.0+
- Tested Up To
- 7.1.4
- PHP Version
- 7.4 or higher
- Author
- Nazmul Hasan Robin
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
5M+ installs
#9
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
Loginizer
1M+ installs
#46
All-In-One Security (AIOS) – Security and Firewall
1M+ installs
#57
Maintenance
1M+ installs
#59
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
700K+ installs
#86
Frequently Asked Questions
Common questions about NHR Secure – Security, Firewall, 2FA, Login Protection & Activity Log
Add this line to wp-config.php, above the line that says "That's all, stop editing": define( 'NHRROB_SECURE_SAFE_MODE', true ); Safe mode pauses the moved login address, lockouts, the request filter, address and country rules and the two-factor step, and leaves your settings as they are. Sign in at wp-login.php, fix the setting, then remove the line. With WP-CLI you can also run wp nhrrob-secure safe-mode on, wp nhrrob-secure unlock --all, wp nhrrob-secure login-url reset or wp nhrrob-secure reset-2fa <user>.
Under Tools → Secure.
Limiting login attempts and generic sign-in errors are on. Everything that could lock you out or block a visitor (the moved login address, two-factor, the request filter, address and country rules, hardening switches) is off until you turn it on.
Your settings are kept, including a moved login address and your users' two-factor setup. Two things change on purpose: the old "advanced firewall" is replaced by a smaller request filter that starts in log-only mode, and country rules now apply to the sign-in page unless you choose the whole site. The audit table from 1.x is copied into the new activity log and removed. The settings screen moved to Tools → Secure.
Yes. It uses the standard time-based codes (TOTP) that Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden and others support. The QR code is drawn in your browser; the secret is never sent to an outside service.
They can sign in with one of their recovery codes. Otherwise an administrator can reset their two-factor under Tools → Secure → Users & Sessions, or with wp nhrrob-secure reset-2fa <user>.
A file that exists is handed out by the web server before WordPress loads, so a plugin cannot guard it from PHP. On Apache and LiteSpeed, switch on "Protect these files". On nginx, add the lines shown on the Hardening screen to your server configuration, or send them to your host.
It is off by default and starts in log-only mode. It looks at the address of a request, and only for visitors who are not signed in. Checking submitted forms is a separate switch that uses only the rules normal writing cannot trigger. Check the list of matches for about a week, allow anything that is yours, then switch it to Block.
Yes. Each site has its own settings, and Network Admin → Settings → Secure shows every site's score in one table and can copy one site's settings to all the others. Actions that change files or end everyone's sessions need a network administrator.
No. A passkey is the second step after the password, like a code from an authenticator app. It needs HTTPS. Recovery codes work when the passkey is not at hand.
