by
SecondGateWP
0 (0 reviews)
SecondGate
Passkeys, 2FA, brute-force protection, and country blocking, with real crawlers auto-verified and exempted. No account required, ever.
SecondGate ranks #61,149 among WordPress.org plugins with 0+ active installations, is #3,855 of 5,058 in the Security category, and was last updated Oct 7, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.4
v1.1.9
Current Version v1.1.9
Updated 1 month ago
Last Update on 07 Oct, 2026
Refreshed 1 week ago
Last Refreshed on
#3,855 of 5,058 in Security
Rank
#61,149
—
No change
Active Installs
0+
-100%
KW Avg Position
128.5
0.2 worse
Downloads
347
+1 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 10
0+
10+
33,581
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 8 more installs to reach 10+
Rank Changes
Current
#61,149
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.1.9
- Last Updated
- Oct 07, 2026
- Requires WP
- 6.0+
- Tested Up To
- 7.1.4
- PHP Version
- 7.2 or higher
- Author
- SecondGateWP
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#18
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#36
Frequently Asked Questions
Common questions about SecondGate
Yes, if you turn on "Cache-proof blocking" (Settings, IP Block, Advanced). Without it, SecondGate switches page caching off while any blocking is active, because a cache would otherwise hand blocked visitors a saved copy. With it, a small gate runs before WordPress and before your cache, so blocked visitors are refused and everyone else still gets the cached page. It adds two lines to wp-config.php, a few to .htaccess (site root and wp-content/cache) and a folder at wp-content/secondgate-gate/, tests every change with a live request, and removes everything when switched off or uninstalled. LiteSpeed, Varnish and Nginx server caches are supported too (LiteSpeed automatically; Varnish/Nginx with a config snippet the plugin generates). Page caching done on someone else's servers (Cloudflare "Cache Everything", or a managed host's own cache) answers before your site is involved, so no plugin can gate it: the settings panel tells you if it detects one.
The features listed above are free, permanently, with no artificial limitation. A separate paid product, SecondGate Pro, exists as its own standalone plugin sold independently. It is never required for this plugin to work, and nothing in this plugin is disabled, nagged, or time-limited to push you toward it.
No. Nothing in this plugin requires an account, an API key, or any third-party sign-up.
By default this plugin only trusts your server's real connecting IP address (REMOTE_ADDR), which a visitor cannot forge. If you're behind a proxy or CDN that rewrites the visitor's real IP into a header, you can explicitly enable and select that header in Advanced settings. It's off by default, since trusting the wrong header by default is a well-documented vulnerability class in software that does IP-based blocking. Even when enabled, the header is only believed on requests that actually arrive from your proxy. For Cloudflare this is automatic (Cloudflare's published IP ranges are built in), so someone connecting straight to your server can't fake their location. For other proxies you can list your proxy's addresses; addresses on your private network are always accepted. X-Forwarded-For is read from the right-hand end, the part your own proxy added, so a visitor can't slip a fake address in at the start. The settings page shows whether the page you're looking at came through a trusted proxy.
No. Blocking only affects visitors from blocked sources viewing the site. Real search crawlers (Googlebot, Bingbot, and others) are automatically exempt from every blocking mechanism in this plugin, verified via reverse+forward DNS rather than trusting a user-agent string that anyone could fake, so a country rule that would normally apply is designed not to catch a genuine crawler.
Use one of the backup codes generated when you first set up two-factor authentication, then set up 2FA again on your new device.
No. This plugin covers authentication (passkeys, 2FA, brute-force protection) and geo-blocking. It is not a web application firewall and does not scan for malware.
The optional cache-proof blocking supports Multisite: only network admins can switch it on, and each site keeps its own blocking rules. The rest of the plugin is built and tested against standard single-site WordPress installs and hasn't been fully tested on Multisite yet.
