by
open24
5 (1 reviews)
Open24 Security
Security hardening for WordPress and WooCommerce: lock down the REST API and login, limit admin accounts, get alerts and detect modified files.
Open24 Security ranks #31,387 among WordPress.org plugins with 10+ active installations, is #662 of 1,659 in the Authentication category, a 5/5 rating from 1 reviews, and was last updated Oct 23, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1
v1.3.0
Current Version v1.3.0
Updated 2 weeks ago
Last Update on 23 Oct, 2026
Refreshed 1 week ago
Last Refreshed on
#662 of 1,659 in Authentication
Top 50% by installs
Downloads +72.7% this week
Actively maintained
Rank
#31,387
—
No change
Active Installs
10+
—
No change
KW Avg Position
86
1 worse
Downloads
483
+3 today
Support Resolved
0%
—
No change
Rating
100%
Review 5 out of 5
5
(1 reviews)
Next Milestone 20
10+
20+
8,214
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 2 more installs to reach 20+
Rank Changes
Current
#31,387
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
5.0
1 reviews
Overall
100%
5
1
(100%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.3.0
- Last Updated
- Oct 23, 2026
- Requires WP
- 5.5+
- Tested Up To
- 7.1
- PHP Version
- 7.4 or higher
- Author
- open24
Support & Rating
- Rating
- ★ ★ ★ ★ ★ 5
- Reviews
- 1
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
5M+ installs
#9
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
Loginizer
1M+ installs
#46
All-In-One Security (AIOS) – Security and Firewall
1M+ installs
#57
Maintenance
1M+ installs
#59
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
700K+ installs
#86
Frequently Asked Questions
Common questions about Open24 Security
Every option is off by default. The ones that need the most care are the custom login URL and the REST API restrictions, because some themes and plugins rely on those endpoints. Enable them one at a time and check your site afterwards.
Rename or delete the open24-security folder in /wp-content/plugins/ over FTP or your hosting file manager. The plugin will be deactivated and wp-login.php will work again.
Yes. The WooCommerce options only appear when WooCommerce is active.
Only the optional features listed under External services in the Description, and only once you turn them on. I turned on the IP restriction and now I cannot sign in Add define('O24S_DISABLE_IP_RESTRICTION', true); to wp-config.php, sign in, fix the list and remove the line. The plugin refuses to turn the restriction on if the IP you are saving from is not in the list, but your IP can change afterwards.
They run once a day through WP-Cron, not on page loads. On a typical store the core and plugin checks take a few seconds.
Each one changes how the site behaves, and some (the IP restriction, blocking plugin installs, enforcing the Content-Security-Policy) can get in the way of your own work. Turn on what fits the site and test after each change. I am behind Cloudflare and every visitor looks like the same IP Under Login, set "Visitor IP read from" to the header your proxy sets. The screen shows the IP the plugin currently sees for you, so you can confirm the setting is right. Leave it on the direct connection unless there really is a proxy in front of the site: those headers are sent by the client, so trusting them without a proxy lets an attacker send a different IP on every login attempt and never get locked out.
Ask your hosting to update PHP. A flaw in PHP is not fixed by updating WordPress, themes or plugins, and the plugin cannot update PHP for you. Most hosts let you pick the PHP version from their control panel. If your server uses PHP from a Linux distribution package (Debian, Ubuntu, Red Hat), the fix may have been applied without changing the version number: the screen says so when it detects one, and your distribution's security advisory has the final word.
Because that is where WordPress stores the security keys and salts, as PHP constants. Changing them is what invalidates every session cookie. See the Description for details on how the file is written safely.
