by
WordSec
5 (2 reviews)
WordSec – Malware Scanner & Removal, Web Application Firewall (WAF), and 2FA
WordPress security plugin with firewall, malware scanner, and login protection. Block attacks and scan for malware from one dashboard.
WordSec ranks #28,780 among WordPress.org plugins with 10+ active installations, is #1,834 of 5,058 in the Security category, a 5/5 rating from 2 reviews, and was last updated Sep 10, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.4
v1.1.2
Current Version v1.1.2
Updated 1 month ago
Last Update on 10 Sep, 2026
Refreshed 1 week ago
Last Refreshed on
#1,834 of 5,058 in Security
Top 50% by installs
Rank
#28,780
—
No change
Active Installs
10+
—
No change
KW Avg Position
68
0.5 worse
Downloads
904
+1 today
Support Resolved
0%
—
No change
Rating
100%
Review 5 out of 5
5
(2 reviews)
Next Milestone 20
10+
20+
5,607
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 2 more installs to reach 20+
Rank Changes
Current
#28,780
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
5.0
2 reviews
Overall
100%
5
2
(100%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.1.2
- Last Updated
- Sep 10, 2026
- Requires WP
- 6.9+
- Tested Up To
- 7.1.4
- PHP Version
- 7.4 or higher
- Author
- WordSec
Support & Rating
- Rating
- ★ ★ ★ ★ ★ 5
- Reviews
- 2
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#18
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#36
Frequently Asked Questions
Common questions about WordSec – Malware Scanner & Removal, Web Application Firewall (WAF), and 2FA
No. WordSec is built around minimal database queries, batch processing and smart caching so protection does not come at the cost of performance.
No. WordSec installs and runs as a fully functional free plugin with local protection: the web application firewall (your own custom rules plus the built-in preset rules), brute-force and login protection, two-factor authentication, hardening, geo-blocking configuration, the audit log and more all work without any key.
No, not to run. WordSec's core protection runs locally on your server, and with no license key it contacts no external WordSec service at all.
Yes. The security scanner examines your files, the database and scheduled tasks, and every finding can be quarantined with one click. A modified WordPress core, plugin or theme file can also be repaired straight from its original copy on WordPress.org, and the scan history keeps a record of everything that was found and changed.
Yes. Failed logins are rate limited with progressive lockout, so each further attempt from the same source waits longer. You can also add a honeypot field, rename the login URL, require a CAPTCHA on the login form, and restrict logins by IP, country or time of day.
Yes. Two factor authentication uses RFC 6238 TOTP codes from any standard authenticator app, and you choose which roles have to use it. For the case where a device is lost and nobody can get in, a WORDSEC_DISABLE_2FA constant in wp-config.php provides emergency access.
The built-in rule sets cover SQL injection, cross-site scripting, path traversal, and PHP and command injection. You can add your own rules with a multi-condition builder, run the firewall in learning mode before you enforce anything, and optionally enable Extended Protection so requests are inspected before WordPress loads.
You can, but it is not recommended. Two firewalls inspecting the same request, or two scanners walking the same files, cost you performance and produce duplicate alerts. WordSec is built to own site security end to end, so the usual path is to deactivate the others first.
WordPress 6.9+, PHP 7.4+, and MySQL 5.6+ / MariaDB 10.1+.
