WordSec is a complete WordPress security plugin. Eight modules cover the firewall, malware scanner, login security, live traffic, IP and country blocking, supply-chain intelligence, audit log and alerts, so you block attacks and harden your site from one dashboard instead of installing eight plugins
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.9 and PHP 7.4.
SourceWordPress plugins · Oct 21, 2026
01 / Source details
Aboutthistool.
WordSec is a complete WordPress security plugin. Eight modules cover the firewall, malware scanner, login security, live traffic, IP and country blocking, supply-chain intelligence, audit log and alerts, so you block attacks and harden your site from one dashboard instead of installing eight plugins.
If your site gets hacked you do not just lose the site. You lose customer trust, your search rankings, and days of work restoring backups. WordSec is built to stop that before it happens, and to help you recover if it already has: the scanner finds the malware, quarantine takes it out of the way, and modified core, plugin and theme files are repaired from their original copies.
Free, and no license key to enter. WAF firewall rules, malware and file-integrity scanning, brute force protection, two factor authentication, IP and country blocking, the audit log and one-click hardening all run locally on your own server.
Web Application Firewall (WAF)
Custom rule builder with regex and wildcard matching
Built-in rules for SQL injection, XSS, path traversal, PHP and command injection
Learning and active modes, bot blocking, security headers, rate limiting
25+ hardening toggles for wp-config access, author enumeration and REST API
Real-time request logging with bot detection and CSV export
Exclusion filtering by role, IP, country or URI
IP and Country Blocking
Country and continent allow or block lists
IP and CIDR blocking, temporary or permanent, with allow-list support
Supply Chain and Threat Intelligence
Reputation scoring and abandoned-plugin detection
Known-vulnerability alerts for core, plugins, themes and PHP
Update-integrity verification with backups and an SBOM inventory
Audit Log
Activity tracking across 11 object types and 14 actions
Alarms
36 alert event types delivered by Email, Telegram or Slack
Every feature runs locally with no license key. Optionally, the WordSec service at wordsec.net supplies threat-intelligence data that cannot be produced locally: managed WAF rule sets, the malware signature feed, IP-reputation lists, the GeoIP database and vulnerability records. Connecting is optional and every external service is documented in “External services” below.
External services
WordSec is designed to run locally, and with no license key it makes no outbound requests to the WordSec service. Core request filtering and file scanning run on your server. The services listed below are contacted only for the specific features described, and most of them only when you explicitly enable that feature (or, for the WordSec API, only after you activate a license key). This section documents every third-party service the plugin can connect to and the data each one receives.
WordSec API (api.wordsec.net)
WordSec runs free without a license, in which case it does not contact this service at all. A free license is available to everyone; once you activate a key the plugin communicates with the WordSec service for two distinct purposes:
01Required service calls (only while a license key is active): license activation and validation, and threat-data updates (firewall rules, malware signatures, IP reputation lists, GeoIP data, the disposable-email domain list and known-vulnerability data). These enable the cloud-backed features and cannot be performed locally; with no key, none of these calls are made. The local enforcement code for these features (the WAF engine, the malware scanner, the IP-blocking filters and the signup-restriction filter) is always present and active; without an up-to-date feed it simply has no threat-intelligence data to check requests against.
* When: on activation/validation and on scheduled threat-data update checks. * Data sent: your site URL and license key (used to authenticate you and bind the license to this site) and, for update checks, the current versions of your installed threat-data feeds.
02Optional usage/environment telemetry (OPT-IN, OFF by default): an anonymous once-daily snapshot used to improve WordSec. It is only sent after you explicitly enable “Share usage & environment data” (at license activation or in Settings → Advanced → Usage Data) and can be turned off again at any time.
* When: once daily, only while the opt-in is enabled. * Data sent: a non-personal snapshot of the site environment (server, WordPress, PHP and database versions, the list of active plugins and themes) and aggregate WordSec feature-usage and security statistics. No passwords, database credentials, secret keys or e-mail addresses are ever sent.
Terms of Service: https://wordsec.net/terms
Privacy Policy: https://wordsec.net/privacy
Have I Been Pwned (api.pwnedpasswords.com)
Used by the optional leaked-password check to detect whether a password appears in known data breaches, using k-anonymity. * When: when a user sets or submits a password and the leaked-password check is enabled. * Data sent: only the first 5 characters of the SHA-1 hash of the password. The password itself and its full hash never leave your site. * Terms & Privacy: https://haveibeenpwned.com/Privacy
WordPress.org API (api.wordpress.org, downloads.wordpress.org, wordpress.org, core.svn.wordpress.org, plugins.svn.wordpress.org, themes.svn.wordpress.org)
Used to verify WordPress core, plugin and theme file integrity, to look up public plugin/theme information (plugins_api/themes_api) for the supply-chain reputation scores and update-integrity checks, to download WordSec’s own translation language pack from translate.wordpress.org when you pick a Display Language that is not installed yet (the same mechanism WordPress itself uses when the site language changes), and — only when you click “Repair” on a scanner finding — to download the original copy of a modified core/plugin/theme file so it can be restored. Repair downloads fetch single original files from plugins.svn.wordpress.org / themes.svn.wordpress.org / core.svn.wordpress.org, falling back to full packages from downloads.wordpress.org (plugin/theme zips) and wordpress.org (core release zips). * When: during malware/integrity scans and supply-chain reputation checks, on an explicit repair action, and when you save a Display Language whose translation is not installed yet. * Data sent: the WordPress core version, site locale, and the slugs/versions of the plugins/themes being checked; for a language download, the plugin slug/version and the chosen locale. * Terms & Privacy: https://wordpress.org/about/privacy/
RDAP (rdap.org)
Used by the WHOIS/RDAP lookup tool on the Tools page to show ownership information for an IP address or domain you inspect. * When: only when you run the WHOIS/RDAP lookup tool. * Data sent: the IP address or domain you chose to look up. * Terms & Privacy: https://about.rdap.org/
ipify (api.ipify.org)
Used by the Tools page blacklist checker and the server-info tool to determine your server’s own public IP address. * When: only when you run the “Blacklist Check” or “Server IPs” tool. * Data sent: a plain request from your server; no site data is included (the service simply echoes the requesting IP). * Terms & Privacy: https://www.ipify.org/
DNS blocklist providers (Blacklist Check tool)
The Tools page “Blacklist Check” queries DNS-based blocklists (DNSBLs) to tell you whether your server’s public IPv4 address is listed. Each provider receives a standard DNS query containing your server’s IP address in reversed form. Five providers are queried: * Spamhaus ZEN (zen.spamhaus.org) – https://www.spamhaus.org/privacy-notice/ * SpamCop (bl.spamcop.net), operated by Cisco – https://www.cisco.com/c/en/us/about/legal/privacy-full.html * Barracuda Reputation Block List (b.barracudacentral.org) – https://www.barracuda.com/company/legal/privacy-policy * UCEPROTECT Level 1 (dnsbl-1.uceprotect.net) – https://www.uceprotect.net/en/index.php * PSBL (psbl.surriel.com) – https://psbl.org/ Details: * When: only when you click “Blacklist Check” on the Tools page. * Data sent: your server’s public IPv4 address, embedded in each DNS blocklist query.
Telegram Bot API (api.telegram.org)
Optional alarm delivery channel. Active only when you configure your own Telegram bot token and chat ID. * When: when a security alarm you enabled fires and Telegram delivery is configured. * Data sent: the alarm message text (event type, site name, relevant IP/user context) to the bot/chat you configured. * Terms of Service: https://telegram.org/tos * Privacy Policy: https://telegram.org/privacy
Slack Incoming Webhooks (hooks.slack.com)
Optional alarm delivery channel. Active only when you configure your own Slack incoming-webhook URL. * When: when a security alarm you enabled fires and Slack delivery is configured. * Data sent: the alarm message text (event type, site name, relevant IP/user context) to the webhook you configured. * Terms of Service: https://slack.com/terms-of-service * Privacy Policy: https://slack.com/privacy-policy
Google reCAPTCHA (www.google.com, www.gstatic.com)
Optional login/registration CAPTCHA. Active only when you select reCAPTCHA and provide your own keys. * When: on login and registration forms while enabled. * Loaded remotely: reCAPTCHA requires its widget script (www.google.com/recaptcha/api.js, served with assets from www.gstatic.com) to
See it in action
Screenshots & previews.
Web Application Firewall: inspect every request, build multi-condition custom rules, and review detailed firewall logs.Malware & Integrity Scanner: a seven-stage scan across files, database and scheduled tasks, with quarantine and restore.Login Security: role-based two-factor authentication, multiple CAPTCHA providers, and brute-force protection.Live Traffic Monitor: real-time traffic with historical replay and safe request inspection.IP & Geo Blocking: country and continent lists, IP and CIDR blocking, and rate limiting.Plugin & Theme Intelligence: reputation scoring, vulnerability alerts, and update-integrity checks.Audit Log: complete activity tracking across object types and actions.Real-Time Security Alerts: 36 event types delivered by email, Telegram or Slack.
02 / Source details
Gettingstarted.
01Upload the plugin files to /wp-content/plugins/wordsec/ , or install through the WordPress Plugins screen.
02Activate the plugin through the Plugins screen in WordPress.
03Open the WordSec menu to start configuring.
Activation only creates the plugin’s database tables, default settings and its own data directory. WordSec never modifies .htaccess, .user.ini or wp-config.php, changes file permissions, or installs the pre-WordPress WAF bootstrap without an explicit, clearly-labelled action from you, and deactivation reverts every such change.
03 / Source details
Frequently asked questions.
Does WordSec slow down my site?
No. WordSec is built around minimal database queries, batch processing and smart caching so protection does not come at the cost of performance.
Do I need a license key to use WordSec?
No. WordSec installs and runs as a fully functional free plugin with local protection: the web application firewall (your own custom rules plus the built-in preset rules), brute-force and login protection, two-factor authentication, hardening, geo-blocking configuration, the audit log and more all work without any key.
Does it require any external service?
No, not to run. WordSec’s core protection runs locally on your server, and with no license key it contacts no external WordSec service at all.
Can WordSec help with malware removal on a hacked site?
Yes. The security scanner examines your files, the database and scheduled tasks, and every finding can be quarantined with one click. A modified WordPress core, plugin or theme file can also be repaired straight from its original copy on WordPress.org, and the scan history keeps a record of everything that was found and changed.
Does WordSec include brute force protection?
Yes. Failed logins are rate limited with progressive lockout, so each further attempt from the same source waits longer. You can also add a honeypot field, rename the login URL, require a CAPTCHA on the login form, and restrict logins by IP, country or time of day.
Does WordSec support two factor authentication?
Yes. Two factor authentication uses RFC 6238 TOTP codes from any standard authenticator app, and you choose which roles have to use it. For the case where a device is lost and nobody can get in, a WORDSEC_DISABLE_2FA constant in wp-config.php provides emergency access.
What does the web application firewall actually block?
The built-in rule sets cover SQL injection, cross-site scripting, path traversal, and PHP and command injection. You can add your own rules with a multi-condition builder, run the firewall in learning mode before you enforce anything, and optionally enable Extended Protection so requests are inspected before WordPress loads.
Can I run WordSec next to another security plugin?
You can, but it is not recommended. Two firewalls inspecting the same request, or two scanners walking the same files, cost you performance and produce duplicate alerts. WordSec is built to own site security end to end, so the usual path is to deactivate the others first.
What are the minimum requirements?
WordPress 6.9+, PHP 7.4+, and MySQL 5.6+ / MariaDB 10.1+.
Website LLMs.txt and LLMs-Full.txt Generator is an LLMs.txt generator and llms-full.txt generator for WordPress. It helps site owners generate, manage, preview, validate, and serve AI discovery files from published public content. Use it to create structured /llms.txt and optional /llms-full.txt end
EngageDock AI is a customizable floating contact widget for WordPress websites that want more leads and faster visitor communication. It helps small businesses turn website traffic into calls, texts, emails, and callback requests from one clean contact panel. Key Features: Click-to-Call – One tap ca
Altify AI is an auto ALT text and AI ALT text plugin for WordPress images. It helps generate descriptive image ALT text for accessibility and image SEO. Use bulk image ALT text tools for your Media Library, generate featured image ALT text automatically, and scale WooCommerce image ALT updates with
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
