Nimble Security protects a WordPress site from the login screen down to the files on disk, and it does all of it on your own server. There is no account to create, no cloud service to connect and no data leaving your site. The only outbound request the free version ever makes is to the official Word
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.6 and PHP 8.1.
SourceWordPress plugins · Nov 2, 2026
01 / Source details
Aboutthistool.
Nimble Security protects a WordPress site from the login screen down to the files on disk, and it does all of it on your own server.
There is no account to create, no cloud service to connect and no data leaving your site. The only outbound request the free version ever makes is to the official WordPress.org checksum API, and only when an integrity scan runs.
Everything listed below is in the free version. It is not a trial, nothing here is time-limited, and no engine is held back.
Stop attackers at the door
Brute-force lockouts with generic login errors, so an attacker cannot tell a wrong username from a wrong password.
Two-factor authentication with encrypted secrets, local QR enrolment, ten single-use recovery codes and replay protection.
Session control, Application Password auditing and revocation, and optional XML-RPC authentication protection.
Author-enumeration blocking.
Know when your files change
WordPress core verified against the official checksums.
SHA-256 baselines for plugins, themes, must-use plugins, drop-ins and selected configuration files.
Plugin and theme updates are recognised as maintenance, so a routine update does not turn into a false alarm.
Optional permission auditing reports paths writable by group or others and tightens them only when you ask. It never loosens a permission, never acts on its own and never touches anything outside the WordPress installation.
Know what your PHP is standing on
PHP is the one piece of software every request on your site passes through, and most security plugins never look at it. Nimble Security does.
Tells you whether the PHP branch your host runs still receives security fixes, and when that stops.
Tells you when a newer patch level was already released, and on what date it checked, so you can judge how old the answer is.
Flags runtime settings that give an attacker a head start: expose_php, which prints your exact PHP build in every response; display_errors; allow_url_include; and whether PHP can start shell commands.
On 21 October 2026 two unauthenticated remote code execution flaws were fixed in PHP, CVE-2026-109618 and CVE-2026-109619. Nimble Security does not protect you from that class of flaw. On Apache with mod_php it triggers before any application code runs, so nothing inside WordPress is in a position to stop it.
What it does is tell you whether the runtime underneath you is still being fixed at all, and show you the file changes and executable content that appeared while you were waiting for the patch.
Updating PHP closes the hole. Monitoring tells you what happened before you did.
Block bad requests
A web application firewall with Protect, Learning and Off modes.
Rate limiting, plus correct client-IP handling behind a proxy or CDN.
Optional Smart 404 blocking, disabled by default.
Find and contain what got in
A local malware scanner that streams files in the background and resumes after a timeout. Nothing is uploaded for analysis.
An inventory of installed components, ready to be matched against advisory data.
Incidents, encrypted quarantine and restore, plugin component containment, privileged-session containment and Emergency Lockdown.
Know where you stand
Security Score rates your posture out of 100 across hardening, identity, integrity, firewall, malware detection, software updates and recovery readiness. An open high or critical incident caps the score, so a site with an active serious problem cannot display a healthy number.
What it deliberately does not do
Nimble Security does not upload your files, does not phone home, does not write executable code anywhere and does not replace backups. It protects, detects and responds; recovery comes from a backup. That is why recovery readiness counts towards the score, because remediation is far safer when a verified restore point exists.
External services
Nimble Security relies on exactly one external service, and on nothing else.
WordPress.org Core Checksums API
What it is: the official checksum service operated by WordPress.org at https://api.wordpress.org/core/checksums/1.0/ . It returns the authoritative MD5 checksum set for a given WordPress release.
What it is used for: verifying that the WordPress core files on your server match the files that were published for your version. Without it, core integrity cannot be established, because the reference checksums only exist on WordPress.org.
What is sent, and when: the installed WordPress core version and the site locale, over HTTPS. Nothing else. The request is made only when a core integrity scan runs: manually when an administrator starts one, or on the daily schedule if an administrator has enabled automatic scans. Automatic scans are off by default. No request is made if integrity scanning is never used.
What is never sent: plugin or theme file contents, local file hashes, file paths, credentials, cookies, request bodies, user or customer data, security findings and quarantine payloads.
Terms of Service: https://wordpress.org/about/terms/
Nimble Security does not contact NimblePlugins, sends no telemetry and has no account, licence or activation requirement of any kind.
Privacy
Security events are minimized. Raw request bodies, cookies and credentials are not stored by the event engine, and network actors are represented with keyed hashes rather than raw IP addresses in Security events.
TOTP secrets are encrypted at rest and recovery codes are stored as one-way hashes in WordPress user metadata. Authentication secrets are never included in the WordPress personal-data export. The privacy eraser anonymizes Security event references and removes the per-user appearance preference; active 2FA material is retained while the account remains active because it is required for authentication.
Quarantine payloads stay local and are encrypted with AES-256-GCM. Operations receives aggregate technical status only, not file contents, raw IP addresses, credentials, request bodies or quarantine data.
See it in action
Screenshots & previews.
Overview: Security Score, open incidents and the state of every protection engine on one screen.The same Overview in light mode. Appearance is per-user, so it follows whoever is signed in.Easy Setup applies a recommended local protection profile without asking you to understand every switch first.Identity Protection: brute-force lockouts, two-factor enrolment, sessions and Application Passwords. Credentials and raw IP addresses never leave the site.Integrity Protection verifies WordPress core against the official checksums and keeps SHA-256 baselines for plugins, themes, must-use plugins and drop-ins.The firewall evaluates requests against local high-confidence rules, in Protect, Learning or Off mode.The malware scanner reads files locally and resumes after a timeout. File contents never leave the server.Vulnerability inventory: what is actually installed, so you can judge what is exposed.Diagnostics are read-only. They verify the runtime, storage and security boundaries without changing any configuration.Settings: every engine is configurable, and the defaults are safe on their own.
02 / Source details
Gettingstarted.
01Upload and activate Nimble Security.
02On a new installation, choose Start Easy Setup or Skip for now .
03Easy Setup can apply the recommended local protection profile and start the first checks automatically.
04Enroll administrator 2FA when prompted.
05Review Identity, Integrity, Firewall, Scanner and Recovery status from Nimble Security > Overview.
Easy Setup never requires a Nimble account or Threat Cloud connection and can be run again later from the Nimble Security menu.
If using Nimble Security Pro, install/upgrade Free first, then Pro.
03 / Source details
Frequently asked questions.
Do I need a licence key or an account?
No. Nimble Security is complete on its own. It contains no licence check, no account requirement and no time limit, and it does not contact NimblePlugins.
Does Free work without Pro?
Yes. Free owns the local identity, integrity, firewall, malware, vulnerability-inventory and manual response engines.
Does a changed plugin file mean malware?
No. Integrity findings are interpreted in context. Known WordPress maintenance can be correlated automatically; unexplained file changes are presented for review rather than being labelled malware by file type alone.
Why can wp-config.php still require review after WordPress is reinstalled?
WordPress normally preserves wp-config.php. Site-specific cron, proxy, database or debug configuration can therefore legitimately differ from a previous baseline. Nimble Security lets an administrator explicitly mark the current recognized configuration as intentional without storing its contents.
Does Nimble Security upload files for malware scanning?
No. The Free malware scanner runs locally.
Can Security delete malware automatically?
Free response is manual-first. Pro contains conservative recovery-gated automation, but destructive actions remain bounded by the Free enforcement and recovery contracts.
Does Nimble Security replace backups?
No. Security protects/detects/responds; backup provides recovery. Recovery readiness is intentionally part of Security Score because remediation is safer when a verified recovery point is available.
Website LLMs.txt and LLMs-Full.txt Generator is an LLMs.txt generator and llms-full.txt generator for WordPress. It helps site owners generate, manage, preview, validate, and serve AI discovery files from published public content. Use it to create structured /llms.txt and optional /llms-full.txt end
EngageDock AI is a customizable floating contact widget for WordPress websites that want more leads and faster visitor communication. It helps small businesses turn website traffic into calls, texts, emails, and callback requests from one clean contact panel. Key Features: Click-to-Call – One tap ca
Altify AI is an auto ALT text and AI ALT text plugin for WordPress images. It helps generate descriptive image ALT text for accessibility and image SEO. Use bulk image ALT text tools for your Media Library, generate featured image ALT text automatically, and scale WooCommerce image ALT updates with
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
