by
PixelGravitas
5 (1 reviews)
SecureLite Security – Firewall, Malware Scanner & Attack Simulation
Free firewall, malware scanner, limit login attempts, 2FA and hide login, plus an attack simulation that proves each protection works.
SecureLite Security ranks #32,839 among WordPress.org plugins with 10+ active installations, is #1,834 of 5,058 in the Security category, a 5/5 rating from 1 reviews, and was last updated Oct 30, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.4
v0.2.31
Current Version v0.2.31
Updated 1 week ago
Last Update on 30 Oct, 2026
Refreshed 1 week ago
Last Refreshed on
#1,834 of 5,058 in Security
Top 50% by installs
Downloads -47% this week
Actively maintained
Rank
#32,839
—
No change
Active Installs
10+
—
No change
KW Avg Position
125
—
No change
Downloads
722
+1 today
Support Resolved
0%
—
No change
Rating
100%
Review 5 out of 5
5
(1 reviews)
Next Milestone 20
10+
20+
9,666
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 2 more installs to reach 20+
Rank Changes
Current
#32,839
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
5.0
1 reviews
Overall
100%
5
1
(100%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Support Threads Overview
Resolved
Unresolved
1
Total Threads
0
Resolved
1
Unresolved
0%
Resolution Rate
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 0.2.31
- Last Updated
- Oct 30, 2026
- Requires WP
- 6.2+
- Tested Up To
- 7.1.4
- PHP Version
- 7.4 or higher
- Author
- PixelGravitas
Support & Rating
- Rating
- ★ ★ ★ ★ ★ 5
- Reviews
- 1
- Support Threads
- 1
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#18
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#36
Frequently Asked Questions
Common questions about SecureLite Security – Firewall, Malware Scanner & Attack Simulation
The core protection is what you would expect from a good free security plugin: a firewall, a malware scanner, brute force protection, two-factor authentication and hide login. What is different is how you know it works. Attack Simulation runs fifteen real attacks against your own site, confirms that real requests reach the protections it tested, and shows, check by check, what was blocked, what is switched off and what failed, with one-click fixes. It runs inside WordPress, so it is safe on a live site and leaves nothing behind. It is also deliberately quiet and private: no account or licence key, no upgrade nags, nothing about your site sent anywhere, and safeguards so you can't lock yourself out. What it does not do: there is no live threat-intelligence feed (its signatures are updated with each release), and a PHP plugin cannot stop a large DDoS attack. For that, put Cloudflare or your host's firewall in front of the site. SecureLite works alongside both.
Any one of these works without logging in: Wait. Login pauses for 15 minutes by default, then opens again. An address that keeps getting locked waits longer, up to 24 hours. The lockout message shows how long is left. Trust your address. Add this line to wp-config.php, above the line that says "That's all, stop editing!", using your own IP address: define( 'SECURELITE_ALLOW_IP', '203.0.113.45' ); If the site runs on your own computer (localhost, XAMPP, Local), your browser reaches it as ::1 or 127.0.0.1, not your internet address, so list those too, separated by commas: define( 'SECURELITE_ALLOW_IP', '203.0.113.45, ::1, 127.0.0.1' ); Switch SecureLite off. Rename the wp-content/plugins/securelite-security folder to securelite-security-off using FTP or your host's file manager. The normal login page returns immediately. With SSH access, run wp plugin deactivate securelite-security. To be ready before it happens, use Add my IP to wp-config.php under Settings > Login protection. Your own address is then never locked out. Forgot your hidden login address? It was emailed to the site administrator when you set it. Otherwise, option 3 restores the normal login page. Lost the phone with your authenticator app? See the next question.
Go to Users > Profile and scroll to SecureLite Two-Factor. Scan the QR code with an authenticator app (Google Authenticator, Microsoft Authenticator, Authy, 2FAS) by pointing your phone at the screen, type the 6-digit code it shows, tick the box and click Update Profile. If you cannot scan, open "Can't scan?" and type the key into the app instead. The QR code is drawn by the plugin on your own server; your key is never sent anywhere. SecureLite does not send codes by SMS or email. Your app makes a new code every 30 seconds, even offline, and each code signs you in once. When two-factor turns on you get ten recovery codes, shown only once. Copy, download or print them and keep them somewhere other than your phone. If you lose your phone, type any one of them in the Authentication code box on the login page. Each works once, and you can make a new set from your profile at any time. Lost your phone and your recovery codes? Any of these gets you back in: Another administrator opens Users, edits your account and ticks "Turn off two-factor authentication for this account". Switch SecureLite off by renaming the wp-content/plugins/securelite-security folder over FTP or your host's file manager. Sign in with your password, rename it back, and set up two-factor again. With SSH access, run wp user meta delete <your-username> securelite_totp_enabled.
Yes — that is what it is built for. Since 0.2.17 no attack and no login is sent over the network. Each attack is handed to SecureLite's own firewall, lockout and upload rules inside WordPress, as data held in memory, and the result is what those rules would do with it. Your host's firewall, your CDN and other security plugins never see a test, so there is nothing for them to ban your server's address for, and nobody is emailed an alert. The brute-force test runs SecureLite's real lockout from a reserved test address (192.0.2.x) that no real visitor can have, never yours, and removes its own counters before it finishes — even if you close the tab. Test events never reach your security log or the daily summary. The only requests the simulation makes are ordinary ones: one normal page request to confirm real traffic reaches SecureLite's protections, and file requests that check your server's configuration — whether PHP can run in uploads, and, only if the file exists on disk, whether .git or a version-revealing readme.html can be downloaded. Every report says what it covers: SecureLite's own protections and the path real requests take to reach them. If a CDN or proxy such as Cloudflare sits in front of your site, the report names it, but its own firewall is not part of the test.
Two-factor cannot be switched on until you have proved it works, and it issues ten single-use recovery codes when you do. Changing your login URL is tested before the change is kept, and switches itself back off if the new address does not answer. Lockouts are the remaining case, the same as with any plugin that limits login attempts — and there are three ways back in. Lockouts expire on their own after the window you set (15 minutes by default). Adding your IP under Settings > Trusted IPs exempts you in advance. And if you are already locked out and cannot reach the settings screen, add this to wp-config.php: define( 'SECURELITE_ALLOW_IP', '203.0.113.45' ); You can also rename the wp-content/plugins/securelite-security folder over FTP, or run wp plugin deactivate securelite-security. Better still, set it up before you need it: under Settings > Login protection, Add my IP to wp-config.php writes that line for you, checking the result and putting the original back if anything goes wrong. If the file is locked by your host, it tells you why and gives you the exact line to paste. All three ways back in are also on the Support screen and emailed to you once, the first time you save with login protection on.
Yes — turn on Behind a proxy/CDN and the Cloudflare preset under Settings > General. Without them every visitor arrives from a Cloudflare address, so a lockout aimed at one attacker would lock out everyone sharing that edge. The settings screen tells you when it sees Cloudflare traffic with proxy mode off, and shows which address SecureLite believes you are connecting from. That address is then trusted immediately, with every protection still active for everyone else. File access alone is enough — you never need database access to recover. One case is deliberately not a lockout at all. If someone attacks your account from many addresses, your username gets locked — but entering the correct password still lets you in and clears it. Knowing your login name is not enough to keep you out of your own site.
Everything goes back. Outside its own database SecureLite only adds lines to wp-config.php — DISALLOW_FILE_EDIT and, if you asked for it, your trusted-IP line — and deactivating hands them back, while activating again restores them. Your settings, trusted IPs and security log survive deactivation untouched, because deactivating a plugin is how people troubleshoot. Deleting the plugin removes all of it: the wp-config.php lines above, both database tables, every setting, the two-factor secrets and recovery codes, and the scheduled jobs. It only ever removes its own work — a DISALLOW_FILE_EDIT line that was already in your wp-config.php is put back the way you had it, and one that another plugin manages is never touched.
The firewall inspects the request before WordPress renders anything and adds well under a millisecond in normal use. Scanning is scheduled, budgeted and never runs during a page load. Logged-in administrators are never filtered or rate limited.
It blocks from the moment it is installed, with safety nets for the people who run the site: administrators are never filtered, editors and authors saving content are not checked against attack patterns, and logged-in users are never rate limited. If something legitimate is ever caught, the dashboard shows exactly which rule matched and on which parameter, and the watch-only switch lets that traffic through while you look into it.
It turns away spam from bots without sending your comments anywhere: a bot that posts without loading your comment form, or fills in a box people never see, is refused, and one person can post only a few comments an hour (and one address 20, whoever posts them). It does not judge what a person writes by hand; for that, keep comment moderation on or use a service that reviews comment content. Comments from logged-in users are never checked. When SecureLite is not sure a comment came from a person, Smart protection checks the browser instead of refusing it.
