Stop hackers and bots from getting into your WordPress site. Ultimate Security adds two-factor login, blocks password-guessing attacks, stops spam bots and warns you about plugins with known security holes. A setup wizard picks the right settings for your kind of site, so you don’t have to understan
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 5.6 and PHP 7.1.
SourceWordPress plugins · Nov 13, 2026
01 / Source details
Aboutthistool.
Stop hackers and bots from getting into your WordPress site. Ultimate Security adds two-factor login, blocks password-guessing attacks, stops spam bots and warns you about plugins with known security holes. A setup wizard picks the right settings for your kind of site, so you don’t have to understand every option. And because a security plugin should never break your site, every change can be previewed, tried in Test Mode and undone.
It is also built for the age of AI. Check your site for hidden prompt injection aimed at AI agents. See which AI crawlers and AI bots, like GPTBot and ClaudeBot, read your pages, and block AI scrapers with ready-made Cloudflare rules. Connect ChatGPT, Claude or Cursor with read-only access, through a sign-in you approve or the official WordPress MCP Adapter.
Why site owners choose it
Free, with no account needed. Install it and it works. No sign-up and no usage tracking.
Set up in about 3 minutes. The wizard asks what kind of site you run, checks it, and shows every change before applying it. You can undo it all later.
Try before you enforce. Test Mode shows what would have been blocked, without blocking anyone.
Undo any change. Recent changes lists your last ten saves; undo one in a click. Turn on “Protect my changes” and a sensitive change that breaks your login page or site is undone for you.
You can’t lock yourself out for good. The wizard gives you an emergency link that switches the plugin off from any browser, and one click adds your own address to the “always allow” lists.
Act fast after a break-in. Emergency Lockdown stops every plugin, theme and WordPress change for a set time while you clean up, and you get an email when any account is given administrator powers.
Ready for AI. Find text written to trick AI agents (prompt injection), see which AI bots crawl your site, and let AI apps read your security status without letting them change anything.
Protect your login
Two-factor login. After the password, users confirm with a code sent by email or shown in an authenticator app (Google Authenticator, Authy, Microsoft Authenticator and similar). Choose which user roles need it. Works on the WordPress, WooCommerce and Ultimate Member login forms. See at a glance on the Users screen who has two-factor on. Changing two-factor settings asks for a code first, and you are warned by email if someone keeps failing your two-factor check, because that means they know your password.
Lock out anyone who gets the password wrong too many times. Repeat offenders wait longer each time.
Permanently block addresses you never want to see again.
An administrator can send a locked-out user a 15-minute recovery link, or let users ask for an unlock link by email.
Works behind Cloudflare automatically. Site Health tells you if your host’s setup needs one extra step.
Hide your login page. Move wp-login.php to a private address so bots can’t find it.
Stronger passwords.
Set rules for length, letters, numbers and symbols, or pick a ready-made preset.
Stop people reusing old passwords, and ask for a new one on first login or after a set time.
Reject passwords that have appeared in known data leaks. The check never sends the password itself anywhere.
Works with password managers: they are told your rules, so the passwords they create are accepted, and the “Generate password” button follows your rules too.
Control who stays signed in.
Limit how many devices one account can use at once.
Sign people out automatically after a period of inactivity.
See who is signed in right now, and end any session with one click.
Control apps, API keys and AI agents
More and more tools reach WordPress without a browser: apps signed in with application passwords, the REST API and AI agents.
Application passwords. See every key on the site, when it was last used, and revoke it. Switch keys off for the whole site or for chosen roles.
Confirm risky actions. Ask for the password again before someone installs a plugin, makes a new administrator or creates a new key, so a stolen browser session can’t do it.
API & Agent Access. One page showing what each plugin exposes: REST routes, public AJAX actions, scheduled tasks and AI agent tools.
Outbound connections. See which outside servers your plugins contact through WordPress.
AI security for your site
AI agents and AI search bots now read WordPress sites every day. Ultimate Security helps you keep them safe and in check. Every AI feature is off until you turn it on.
Prompt injection scan. Finds hidden text written to trick AI agents into doing something: instructions hidden from visitors, invisible characters and links built to leak data. It checks posts, custom fields and page-builder content, comments (pending ones too), menus, author profiles, categories, widgets and the site title. Move a matching comment to the Trash or strip the hidden part of a post after a preview, or open the item and edit it yourself. No AI needed, and nothing leaves your site.
Weekly AI safety scan. Optionally scans every week and emails you about new high-risk finds.
AI tool check. Flags AI tools from other plugins that can change your site and are offered to every AI agent, or that skip their permission check.
AI crawler visits. See which AI bots fetch your pages (GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-SearchBot, PerplexityBot, Amazonbot, CCBot, Bytespider, DuckAssistBot and others), when they last came and what they are for, without Cloudflare. Block them with the Cloudflare firewall rules or robots.txt.
Connect ChatGPT, Claude and Cursor safely. Let them read your security status through a sign-in you approve once on your site. Read only, and you can disconnect each app at any time.
Claude, Cursor and VS Code. Share read-only security tools and ready-made prompts (“Run a security review”) with AI apps through the official WordPress MCP Adapter.
Explain with AI. On WordPress 7 and newer, an “Explain” button on Security Fixes, Security Events and sensitive settings pages asks the AI provider you set up in WordPress for a plain-language answer. Addresses, user names and your login address are removed before anything is sent.
Ask your AI. Copy a ready-made question about any security issue into ChatGPT, Claude or any AI chat. No AI key needed.
Block spam and bots on your forms
Add Google reCAPTCHA or Cloudflare Turnstile to your login, registration, password reset and comment forms, and to WooCommerce login, registration and checkout.
Check that your keys work before going live.
If the CAPTCHA service is down, your forms keep working.
Won’t clash with another CAPTCHA plugin on the same form.
Find security problems before hackers do
Vulnerability scanner. Checks WordPress, your plugins and your themes against a database of known security holes, and emails you when it finds one. It works without an API key; WPScan or Patchstack keys add extra coverage. Holes that attackers are known to use are marked and listed first.
Runs on a schedule in the background.
Flags plugins that haven’t been updated in a long time.
Results show in the dashboard, Site Health and your plugins list.
Security score. One number that tells you how well protected your site is, which fix to do next, and how it has changed over time.
File check. Compares your WordPress core files with the official copies, so changed or added files stand out.
See what is happening. Security Fixes lists everything that needs attention, most serious first, with fixes you can preview before they run. Security Events shows recent sign-ins, failed sign-ins and lockouts. Troubleshoot checks the things your protections rely on, including whether your server’s PHP has the latest security fixes, and Security Baseline tells you when a setting changes. You get an email when any account gains the power to install plugins, change settings or manage users, or is signed in without the login form. You are also told when a plugin appears or changes unexpectedly, or hides from your Plugins list. If you think someone got in, Emergency Lockdown stops all plugin and theme changes for a set time while you clean up, without taking your site offline. The Application Passwords and API & Agent Access pages show which apps and AI tools can reach your site.
Safer updates. Choose when WordPress, plugins and themes update automatically. Set update days and quiet periods, delay updates by a few days, and get an email when something changes.
Advanced protection
Cloudflare firewall rules. If your site uses Cloudflare, connect your account and turn on ready-made rules from wp-admin: let good bots through, block bad crawlers, AI crawlers and risky traffic, and block attacks on known WordPress flaws before you’ve had a chance to update. You can preview every rule before it goes live. New block rules can start as a challenge for 24 hours, so you see their effect before anyone is blocked.
Security keys (salts). Change the secret keys in wp-config.php on demand or on a schedule, which signs everyone out and makes stolen login cookies useless. You get a warning before a scheduled change, and can restore a previous set.
Test Mode
Turn on your protections without blocking anyone, and review a log of what would have been blocked. Choose which user roles it covers. Visitors who aren’t signed in are still held to the login limit, and Test Mode switches itself off after seven days, so a forgotten test never leaves your site unprotected.
Moving from another plugin
Import your two-factor and login settings from Wordfence Login Security. Preview it first and undo it if you change your mind.
Import your login limits and blocked usernames from Wordfence, Solid Security or All In One WP Security, plus the hidden login address from the last two. You see every change first, nothing is weakened, and one click undoes it.
Copy your settings to another site, or keep a backup, as a file.
Detects WooCommerce, Ultimate Member, page builders, form, caching and SEO plugins, and warns you if another security p
See it in action
Screenshots & previews.
The dashboard tells you in plain words how safe your site is and what to fix next.Answer a few questions and the setup wizard secures your site. You see every change first and can undo it later.Stop bots that guess passwords. Repeat offenders are locked out for longer.Test Mode shows what would have been blocked, without blocking anyone.Add a second step to login with an email code or an authenticator app.Hide your login page and require strong passwords.Stop spam bots on your login, comment and WooCommerce forms with reCAPTCHA or Cloudflare Turnstile.Find plugins, themes and WordPress versions with known security holes, automatically.Turn on ready-made Cloudflare firewall rules without writing any code.See who is signed in right now and sign anyone out with one click.Switch each feature on or off. Your site stays fast.Bring your settings over from Wordfence Login Security, or copy them to another site.
02 / Source details
Gettingstarted.
Requirements: WordPress 5.6+ and PHP 7.1+. HTTPS is strongly recommended for 2FA and secure sessions.
Install from your dashboard
01In WordPress, go to Plugins → Add New and search for “wpultimatesecurity”.
02Click Install Now , then Activate .
03Follow the Security Wizard that appears — it scans your site, recommends settings, and shows you every change before applying it.
Install manually
04Download the plugin ZIP.
05Go to Plugins → Add New → Upload Plugin , choose the ZIP, and click Install Now .
06Click Activate , then follow the Security Wizard.
Or with WP-CLI: wp plugin install ultimate-security --activate
Your first 3 minutes
07Run the Security Wizard and apply the template that matches your site.
08Save the emergency link the wizard shows you somewhere safe. It gets you back in if you ever lock yourself out.
09Turn on two-factor login for every administrator.
Then, when you have a minute: open API & Agent Access → AI agents and run the AI safety scan to check your content for text written to trick AI agents.
03 / Source details
Frequently asked questions.
I locked myself out. How do I get back in?
Open the emergency link the setup wizard gave you. It switches the plugin off so you can log in and fix the setting. If you didn’t save it, ask your host to rename the folder /wp-content/plugins/ultimate-security , or run wp plugin deactivate ultimate-security over SSH.
Will this slow down my site?
No. Checks run only when someone logs in or submits a form, not on every page view. Scans run in the background on a schedule, in small batches. If you turn on AI crawler visits, each page view adds one quick name check; storage is touched only when an AI bot visits, at most once an hour per bot.
Do I need any technical knowledge?
No. The setup wizard picks settings for your kind of site and shows every change before applying it. You can undo all of it later.
What is Test Mode?
A safe way to try your settings. Your protections run, but nobody is blocked; instead you get a log of what would have been blocked. Once you are happy, switch it off to enforce the rules. It turns itself off after seven days, so a forgotten test never leaves your site unprotected.
Can I undo what the wizard changed?
Yes. The wizard shows every change before applying it, and you can undo them all later. Changes you made yourself afterwards are kept.
Is it really free?
Yes. Everything described on this page is included, with no account, trial or time limit.
Do I need an API key for vulnerability scanning?
No. The scanner works straight away with the free WPVulnerability database. WPScan and Patchstack keys are optional and only add extra coverage.
Does it work with WooCommerce?
Yes. CAPTCHA can protect the WooCommerce login, registration, password reset and checkout forms, two-factor login works on the WooCommerce login form, and the wizard has a WooCommerce template.
Do I need a Cloudflare account?
Only for the Cloudflare firewall rules. Every other feature works without one.
I use Cloudflare or another CDN or proxy. Do I need to do anything?
For Cloudflare, no: it is recognised automatically. For any other proxy or load balancer, add its address under Brute-force protection → Trusted proxies. Until you do, the plugin avoids locking out everyone at once, and Site Health tells you what to add.
CAPTCHA is blocking every login. How do I recover?
Add define( 'ULTIMATE_SECURITY_DISABLE_CAPTCHA', true ); to wp-config.php to switch CAPTCHA off, log in, re-enter your Site Key and Secret Key, then remove the line. To turn off just one provider, use ULTIMATE_SECURITY_DISABLE_TURNSTILE or ULTIMATE_SECURITY_DISABLE_RECAPTCHA . Over SSH, wp ultimate-security captcha off does the same. Site Health warns you when a key stops working.
Will it conflict with other security or CAPTCHA plugins?
It can if two plugins do the same job. Use one plugin per job (one for two-factor, one for CAPTCHA, one for login limits) and switch the overlapping feature off in the other. Ultimate Security warns you when it spots an overlap.
I already use another security plugin. Can I bring my settings across?
You can import two-factor and login settings from Wordfence Login Security. You see exactly what will come across first, and can undo the import afterwards.
Does the custom login URL work with caching and CDNs?
Yes. Make sure your caching plugin doesn’t cache the login page; most skip login and admin pages automatically.
Does it work with Redis or Memcached?
Yes. Give the cache enough memory so it doesn’t drop entries early, or a lockout can end sooner than you set.
Does it work on WordPress Multisite?
It runs on Multisite, with settings per site. It has been tested less there than on single sites, so try it on a staging network first.
Can I check many sites at once?
Yes. On each site, create an application password for an administrator account you use for monitoring. Then read https://example.com/wp-json/ultimate-security/v1/agent/summary with it, or run wp ultimate-security agent summary . You get the security score, open issues, versions and recent sign-in problems in one reply. It is read-only, and the plugin sends nothing anywhere: your tool asks, the site answers.
Does the plugin track me or phone home?
No. There is no usage tracking. It contacts an outside service only when you use a feature that needs one, and each is listed under External Services below.
What does the plugin store about my visitors?
IP addresses and browser details are kept in the session log so you can review sign-ins. Test Mode keeps its own log of what it would have blocked. If you turn on AI crawler visits, only the bot’s name and the days it visited are kept, never an IP address. Everything stays in your own database.
Is it GDPR-friendly?
Your data stays on your own server. Outside calls are limited to the services listed under External Services, and only for features you turn on. “Explain with AI” removes addresses, user names and your login address before it sends anything to the AI provider you chose.
What happens to my data when I uninstall?
By default your settings are kept, in case you reinstall. To remove everything, turn on “delete plugin data” in the plugin’s advanced settings before uninstalling.
Can I connect ChatGPT or Claude?
Yes, if your site uses HTTPS and pretty permalinks and has the official WordPress MCP Adapter plugin. Go to API & Agent Access, open “Connect AI apps”, turn on “Share security findings with AI agents” and “Let AI apps sign in”, then follow the steps shown there for ChatGPT or Claude. An administrator approves each app once on your site. The app can only read security information; it cannot change anything. You can revoke it on the same screen at any time. In ChatGPT, your plan must allow custom apps (developer mode). Cursor can connect too after you choose “Allow Cursor” on the same screen.
How do I check my WordPress site for prompt injection?
Go to API & Agent Access, open the AI agents tab, turn on AI safety checks and click “Scan content now”. Ultimate Security looks for hidden instructions, invisible characters and data-leaking links in your content and comments, and shows each place it finds. No AI service is used for the scan.
How do I see which AI bots visit my site?
Turn on “Watch AI crawler visits” on the same AI agents tab. It lists the AI bots that fetch your pages by the name they give, with the last visit and what each bot is for. Pages served from a page cache or CDN do not reach WordPress, so those visits are not counted.
How do I block AI crawlers like GPTBot?
First, turn on “Watch AI crawler visits” to see which AI bots actually come. If your site uses Cloudflare, turn on the ready-made AI crawler rule under Cloudflare firewall rules and preview it before it goes live. Without Cloudflare, list the bots you want to stop in your robots.txt file; well-behaved AI crawlers follow it.
Can an AI agent change my site?
Not through Ultimate Security. AI apps you connect can only read your security information, and fixes run only when a signed-in person clicks them. AI tools added by other plugins are separate: the AI tool check warns you about any that can change your site or skip their permission check.
What is the WordPress MCP Adapter, and is it safe?
The MCP Adapter is the official WordPress plugin that lets AI apps such as Claude, Cursor and VS Code use tools a site offers. Ultimate Security’s tools are read only and stay off until you turn them on under API & Agent Access. You can see every AI tool on your site, from any plugin, on the same page.
Does the plugin send my site data to AI services?
Not unless you ask it to. The prompt injection scan and AI crawler visits work entirely on your site. Only “Explain with AI” sends text to an AI provider, and only the one you set up in WordPress, after you turn it on and click Explain. See External Services below for exactly what is sent.
How do I get support?
Ask in the plugin’s support forum on WordPress.org, or visit https://www.wpultimatesecurity.com.
FinderPress Media Auditor helps site administrators scan for broken images, missing Media Library files, unreachable media URLs, and other media issues across WordPress content. Use it to audit images, video, audio, PDFs, featured images, and attachment files without sending scan data to an external
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
