by
WP Ultimate Security
0 (0 reviews)
Ultimate Security – Vulnerability Scanner, 2FA, and Login Protection
Complete WordPress security — 2FA, brute-force blocking, CAPTCHA, Cloudflare WAF rules, vulnerability scanning and guided 3-minute setup.
Ultimate Security ranks #31,763 among WordPress.org plugins with 10+ active installations, is #1,709 of 4,566 in the Security category, and was last updated Sep 15, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.2
v1.0.29
Current Version v1.0.29
Updated 1 week ago
Last Update on 15 Sep, 2026
Refreshed 9 hours ago
Last Refreshed on
#1,709 of 4,566 in Security
Top 50% by installs
Downloads -75% this week
Actively maintained
Rank
#31,763
+1108 this week
Active Installs
10+
-33.3%
KW Avg Position
104.5
18.5 worse
Downloads
3.5K
+4 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 20
10+
20+
18,501
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 6 more installs to reach 20+
Rank Changes
Current
#31,763
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.0.29
- Last Updated
- Sep 15, 2026
- Requires WP
- 5.6+
- Tested Up To
- 7.1.2
- PHP Version
- 7.1 or higher
- Author
- WP Ultimate Security
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,760
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,009
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security - Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#17
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#37
Frequently Asked Questions
Common questions about Ultimate Security – Vulnerability Scanner, 2FA, and Login Protection
It is built to stay lightweight — security checks run on login and form submission, not on every page view. Vulnerability scans run on a schedule in the background, not during visitor requests.
No. The setup wizard scans your site, recommends settings, and shows you every change before it is applied — and you can undo all of it. Every setting is in plain English.
Use the emergency deactivation URL the setup wizard showed you — open it in a browser and the plugin switches itself off. If you did not save it, deactivate the plugin manually: over FTP/SFTP rename the folder /wp-content/plugins/ultimate-security, or over SSH run wp plugin deactivate ultimate-security. Then log in and reconfigure.
Add define( 'ULTIMATE_SECURITY_DISABLE_CAPTCHA', true ); to wp-config.php to switch off both reCAPTCHA and Turnstile, or ULTIMATE_SECURITY_DISABLE_TURNSTILE / ULTIMATE_SECURITY_DISABLE_RECAPTCHA for one provider. This fully disables rendering and verification so you can log in. Then re-enter your Site Key and Secret Key in the plugin settings and remove the constant. Site Health and an admin notice tell you when a stored key has been rejected by the provider or has become unreadable after a salt change. The constant requires server access, so it is never a public bypass. Over SSH, wp ultimate-security unlock --all clears login lockouts, wp ultimate-security captcha off switches CAPTCHA off on every form, wp ultimate-security 2fa disable <user> removes a user's two-factor methods and wp ultimate-security login-url reset restores wp-login.php. A used login-recovery link also lets that address through the login CAPTCHA for 15 minutes.
Usually not for Cloudflare: requests arriving from Cloudflare's published ranges are recognised and the real visitor address is used. For any other proxy or load balancer, add its address under Brute-force protection → Trusted proxies (hosts can set the ULTIMATE_SECURITY_TRUSTED_PROXIES constant instead). Until you do, every visitor looks like the proxy, so the plugin suspends site-wide IP lockouts to avoid locking everyone out, and Site Health shows a critical notice telling you what to add.
No. The scanner works out of the box using the keyless WPVulnerability database. WPScan and Patchstack API keys are optional and only add extra coverage.
Yes. Both reCAPTCHA and Cloudflare Turnstile can protect WooCommerce login, registration, lost-password and checkout forms, and there is a WooCommerce setup template in the wizard.
Only for the WAF Rules section. Those rules are deployed to your own Cloudflare zone, so they need a Cloudflare account and an API token. Every other feature works without one.
Yes. Login lockouts, two-factor sign-in sessions and similar short-lived state are stored as WordPress transients, so with a persistent object cache they live in that cache instead of the database. Give the cache enough memory that it does not evict entries early, or a lockout can end sooner than configured.
The plugin activates and runs on Multisite, and its uninstall routine is network-aware. It has not been tested as extensively on Multisite as on single-site installs, so validate on a staging network first and configure settings per site.
