by
Steven Glogger
0 (0 reviews)
Vokull Security Center
Security monitoring and alerting: plugin, user, role and config changes, file integrity, passkeys, two-factor authentication and geo-aware logins.
Vokull Security Center ranks #68,248 among WordPress.org plugins with 0+ active installations, is #3,514 of 4,596 in the Security category, and was last updated Aug 28, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.2
v1.9.0
Current Version v1.9.0
Updated 3 weeks ago
Last Update on 28 Aug, 2026
Refreshed 7 hours ago
Last Refreshed on
#3,514 of 4,596 in Security
Actively maintained
Rank
#68,248
—
No change
Active Installs
0+
—
No change
KW Avg Position
42
144 better
Downloads
179
+2 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 10
0+
10+
48,508
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 10 more installs to reach 10+
Rank Changes
Current
#68,248
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.9.0
- Last Updated
- Aug 28, 2026
- Requires WP
- 6.5+
- Tested Up To
- 7.1.2
- PHP Version
- 8.1 or higher
- Author
- Steven Glogger
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,760
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,009
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security - Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#17
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#37
Frequently Asked Questions
Common questions about Vokull Security Center
An HTTPS site and a reasonably current browser. Nothing else: no service to sign up for, no key to configure, no traffic leaving your server. If the site is not on HTTPS the feature does not offer itself, because browsers refuse to create a passkey over a plain connection. A passkey is bound to your domain. On a subdomain multisite, one registered on a.example.com will not work on b.example.com.
A passkey, if the device allows it — it is the only second factor that cannot be typed into a fake login page. But there is no need to choose: an account can hold both, and either one gets you in. Whichever comes first also issues the recovery codes.
Use one of the ten recovery codes issued when you switched two-factor on. If those are gone too and the site has the e-mail fallback enabled, the sign-in screen can mail a one-time code to the address on your account. If everything is lost, any other administrator can reset your second factor from your profile screen — you then set it up again. The e-mail fallback is off by default on purpose. It means whoever can read that mailbox can finish the sign-in, which on many sites is the same person who controls the hosting account. Turn it on when losing a phone would otherwise mean losing the site; leave it off otherwise. Every code sent and every code used is written to the log.
No. They are non-interactive — there is nobody there to type a code — and an application password is already a separate credential you can revoke on its own. If an account has to be locked down completely, revoke its application passwords as well.
Yes, since 1.9.0, under Settings → Login & Location. An address gets three wrong passwords before it is locked out for fifteen minutes; after five lockouts it is held for twenty-four hours; an address that goes quiet for twenty-four hours is forgotten entirely. Every one of those numbers is yours to change. The lockout is checked before the password is verified, so a locked address does not even get a password hash computed for it. It applies to the login form, to XML-RPC and to application passwords alike — those are where most password guessing actually happens. This does not replace a firewall, a CDN rule or fail2ban, all of which act before the request reaches PHP and cost you nothing to run. It is what you have when none of those are available to you, and it is aimed at the volume rather than at a determined attacker. Failed attempts are still logged individually as login.failed, at Info and log-only. Set that event to "E-mail" only if you know the site is quiet — on a public site bots guess passwords around the clock, and an inbox that learns to ignore this plugin is worse than no alert at all. The lockouts themselves are separate events: login.lockout is logged, and login.lockout_extended is e-mailed, because an address that is still going after five lockouts is somebody trying rather than a bot passing through. An attempt made while an address is locked out is recorded as login.blocked_lockout instead of login.failed, so nothing is written twice.
No. An attacker using a VPN endpoint inside an allowed country resolves to that country and passes. There is no VPN or Tor detection. Treat this control as something that removes opportunistic foreign traffic, not as a boundary.
An individual IP that cannot be resolved is treated as not allowed and is blocked. But if the lookup subsystem as a whole is unavailable, blocking automatically falls back to monitor mode and raises a critical alert, so a deleted database file can never lock you out.
Almost always because the plugin was installed from a GitHub source archive rather than the release ZIP, so the bundled MaxMind reader library in vendor/ is missing. Downloading the database needs no library and succeeds; reading it does. Two-factor enrolment showing no QR code is the same cause. Reinstall from the release ZIP.
Country blocking is off until you arm it, and the settings screen refuses to arm it without a working database. If it does happen: the WPSEC_DISABLE_BLOCKING constant in wp-config.php disables blocking immediately, and the alert e-mail for every blocked login contains a single-use bypass link. The failed-login rate limit is on out of the box, so it is worth knowing what it will not do. It never applies to the local network, to an address on your always-allowed list, or to one holding a live bypass grant; the same WPSEC_DISABLE_BLOCKING constant stands it down; and the Status screen lists every address being held with a button to release them all. At worst an ordinary lockout is a fifteen-minute wait.
Not by default. Application passwords and XML-RPC authenticate through the same WordPress hook as an interactive login, so blocking them would silently break integrations hosted abroad. There is a setting to include them.
