by Fernando Tellado 5 (24 reviews)

Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…

Name: Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…
Rating: 5.0 (24 reviews)
Author: Fernando Tellado

Premium WordPress Security - 100% FREE: Firewall, 2FA, Security Headers, Login and Malware Protection, File Monitor, Security Audit & more

Vigilant ranks #3,667 among WordPress.org plugins with 3,000+ active installations, is #134 of 1,659 in the Authentication category, a 5/5 rating from 24 reviews, and was last updated Oct 26, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v3.0.9 Current Version v3.0.9

Updated 6 days ago Last Update on 26 Oct, 2026

Refreshed 2 days ago Last Refreshed on

#134 of 1,659 in Authentication Top 5% by installs Downloads -11.4% this week Actively maintained

View on WordPress.org

Rank

#3,667

— No change

Active Installs

3K+

-21%

KW Avg Position

7.4

— No change

Downloads

58K

+28 today

Support Resolved

100%

— No change

Rating

100%

Review 5 out of 5

5 (24 reviews)

Next Milestone 4K

Total Progress 97.6%

3K+ 4K+

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 24 more installs to reach 4K+

Rank Changes

Current #3,667

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

5.0

24 reviews

Overall 100%

24 (100%)

0 (0%)

Support Threads Overview

Resolved

Unresolved

Total Threads

Resolved

Unresolved

100%

Resolution Rate

Security History

Source: WPVulnerability

No known vulnerabilities on record for Vigilant. Checked 2 months ago.

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 3.0.9
Last Updated: Oct 26, 2026
Requires WP: 6.2+
Tested Up To: 7.1.4
PHP Version: 7.4 or higher
Author: Fernando Tellado

Support & Rating

Rating: ★ ★ ★ ★ ★ 5
Reviews: 24
Support Threads: 22
Resolved: 100%

Keywords

2FA firewall malware scanner security

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,015

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

All-In-One Security (AIOS) – Security and Firewall

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites

700K+ installs

#86

View all Authentication plugins

TL;DR

AI summary of the plugin's readme

This plugin is for WordPress site owners who want enterprise-level security without paying for premium tiers. It solves the problem of fragmented, paywalled security tools by bundling firewall, two-factor authentication, login protection, file monitoring, and activity logging into one free suite.

Firewall against SQL injection, XSS
Email-based two-factor authentication
Limit login attempts with lockouts
Security headers (CSP, HSTS)
File integrity monitoring
Activity log with CSV export
Custom login URL
REST API access control

Frequently Asked Questions

Common questions about Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…

No. Vigilant is optimized for performance. The firewall uses efficient pattern matching, database queries are cached with transients, and .htaccess rules execute at server level before PHP even loads.

Vigilant applies its default settings: all modules on, with balanced values for most sites. On Apache and LiteSpeed that writes two blocks to .htaccess, and it writes one block of constants to wp-config.php. If wp-config.php already defines DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS, FORCE_SSL_ADMIN, FORCE_SSL_LOGIN, DISABLE_WP_CRON, WP_DEBUG, WP_DEBUG_LOG, WP_DEBUG_DISPLAY or SCRIPT_DEBUG, Vigilant comments that line out, marks it and sets the value from its own settings in WP Hardening. If you rely on one of them, check that tab after activating. Your lines come back when you deactivate. Vigilant keeps no copy of those two files. If you want one, make it before activating.

Vigilant removes its Protection and Security Headers blocks from .htaccess, removes its constants from wp-config.php, brings back the lines it had commented out there and clears its scheduled tasks. Two things to know: Switch Under Attack mode off first. Its .htaccess block is removed when the mode ends, not on deactivation. If you delete the plugin folder by FTP instead of deactivating, nothing is reverted: remove the blocks between the Vigilante markers by hand.

Vigilant supports two 2FA methods. With the authenticator app (TOTP), you scan a QR code in your profile to link an app like Google Authenticator or Authy, then enter a 6-digit code from the app on every login. With email codes, you receive a one-time code via email after entering your password. If enabled by the site administrator, you can mark your device as trusted to skip 2FA for 30 days.

When you set up TOTP, Vigilant generates 10 backup codes. You can use any of them as a one-time replacement for the authenticator code. If you run out of backup codes, an administrator can reset your TOTP from the plugin settings.

Check your spam folder first. You can click "Resend code" on the verification form. Codes expire after 10 minutes by default. If issues persist, an administrator can temporarily disable 2FA from the plugin settings.

Yes. Go to Login Security > Two-Factor Authentication and change the verification method. If notifications are enabled, affected users will receive an email explaining the new method and how to set it up.

By default, 2FA is enforced for administrators and editors. You can customize which roles require 2FA in the Login Security settings, and exclude specific users individually.

Access your site via FTP/SFTP and either rename the plugin folder to disable it temporarily, or delete the vigilante_login_attempts table rows for your IP address in the database.

The firewall is configured to allow normal WordPress operations, including the block editor, REST API, and popular page builders. If you experience issues, you can whitelist specific IPs or adjust rate limiting thresholds. Block Bad Bots also stops SEO crawlers (Ahrefs, Semrush, Majestic, Screaming Frog) and command line clients (curl, wget, python-requests). To let one of them through, add its name to the User-Agent Whitelist.