Ultimate Security – Login Protection, 2FA, Anti-Spam CAPTCHA, Brute-Force & Security Tools
| 开发者 |
programmelab
wpultimatesecurity |
|---|---|
| 更新时间 | 2026年5月20日 05:29 |
| 捐献地址: | 去捐款 |
| PHP版本: | 8.1 及以上 |
| WordPress版本: | 6.9.4 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- It just works. Sensible defaults out of the box — turn it on, you are safer in minutes.
- Built for real attacks. Stops the automated login, brute-force and spam traffic that actually hits WordPress sites.
- Zero learning curve. Plain-English settings, a Test Mode to preview rules before they go live.
- Privacy-respecting. No tracking, no data collection. Pro features are clearly labelled.
- Two-Factor Authentication (2FA) — Email one-time codes and authenticator apps via TOTP/HOTP.
- Per-user 2FA with role-based configuration options — Let users enable 2FA and configure which roles should use email or app-based 2FA.
- Brute-force login lockout — Limit failed attempts, auto-lock offenders, auto-reset retries, block specific users, and keep a recovery URL for emergencies.
- Custom login URL — Hide
wp-admin/wp-login.phpbehind a secret address so bots cannot find it. - Strong password policies — Enforce length, complexity, expiry and password history.
- Session control — Limit concurrent logins per user and harden auth cookies.
- Anti-spam CAPTCHA — Google reCAPTCHA v2/v3 and Cloudflare Turnstile.
- Form coverage — Protect WordPress login, registration and lost-password forms; Turnstile also supports comment forms; WooCommerce login/register forms are supported when enabled.
- No-conflict mode — Plays nicely alongside other CAPTCHA setups.
- Rotate WordPress security keys / salts on demand.
- Use the Update Manager to control WordPress core, plugin and theme update behavior.
- Connect Cloudflare and deploy configurable WAF rule groups from the dashboard.
- Review a basic Security Score with prioritized security checks.
- Advanced hardening toggles, API privacy filtering and scheduled salt rotation are available in Pro.
- Login Activity snapshot — Review recent successful and failed login activity from the dashboard.
- Basic Security Score — See a scored security posture based on enabled protections.
- Site Health snapshot — WordPress/PHP versions, memory, active plugins and theme at a glance.
- Test Mode — Simulate security rules and review what would have been blocked before enforcing.
- Settings backup & restore — Export/import your configuration as JSON for migrations or disaster recovery.
安装:
- In WordPress, go to Plugins → Add New and search for "WPUltimateSecurity".
- Click Install Now, then Activate.
- Open the Ultimate Security menu and follow the setup flow.
- Enable 2FA for all administrator accounts.
- Set login attempt limits and a lockout duration.
- Add CAPTCHA (reCAPTCHA or Cloudflare Turnstile) to the login, registration and comment forms.
- Set a custom login URL and save it somewhere safe.
- Review the Security Score, Site Health and Test Mode before enabling stricter rules.
常见问题:
Will this slow down my site?
It is built to stay lightweight — security checks run on login and form submission, not on every page view.
Do I need any technical or coding knowledge?
No. Defaults are safe out of the box and every setting is in plain English with a guided setup flow.
I enabled 2FA / a custom login URL and locked myself out. How do I get back in?
Disable the plugin to restore default login: via FTP/SFTP rename the folder /wp-content/plugins/ultimate-security, or over SSH/WP-CLI run wp plugin deactivate ultimate-security. Then log in and reconfigure.
Does it work with WooCommerce?
CAPTCHA and login protection cover WooCommerce login and registration forms where enabled. Checkout CAPTCHA is not currently part of the verified free feature set.
Does it work on WordPress Multisite?
Yes, it runs on Multisite. Network-wide behaviour depends on how you configure it per site.
Does the custom login URL work with caching / CDNs?
Yes. Exclude the login path from full-page caching (most caching plugins do this for login/admin automatically) so the secret URL is never served from cache.
Will it conflict with other security or CAPTCHA plugins?
It can if two plugins do the same job. Pick one plugin per function (one 2FA, one CAPTCHA, one login limiter) and disable the overlapping feature in the other.
Is my data private? Does the plugin track me or phone home?
No telemetry, no tracking, no usage data collection. It only contacts third-party services you explicitly enable (see External Services below).
Is it GDPR-friendly?
Yes. The plugin is self-hosted and stores its data in your own database. The only outbound calls are the optional services you turn on (reCAPTCHA, Turnstile, WordPress.org salt API).
What happens to my data when I uninstall?
You control whether plugin data is removed on uninstall via the plugin's settings.
What is the difference between Free and Pro?
Free covers core protection: Email/App 2FA, brute-force lockout, CAPTCHA, custom login URL, password policies, session limits, manual salt rotation, update controls, basic Security Score, Cloudflare WAF rules, Site Health, Test Mode and backup/restore. Pro adds will add more advanced security features once it is released.
How do I get support?
Use the plugin support forum on WordPress.org, or visit https://www.wpultimatesecurity.com.
更新日志:
- New: Improved Session Management settings including concurrent login limits, session cookie hardening and more,
- New: Cloudflare Turnstile and reCAPTCHA CAPTCHA verifcation when applying their respective keys.
- Improvement: Cloudflare WAF rules function improvement.
- Improvement: Code optimization and performance improvements.
- Fix: 2FA User role was not working properly.
- Fix: Login activity dashboard modal was showing wrong agent.
- Improvement: Better user friendly Server Protection Card Design
- Improvement: Code cleanup and optimization.
- New: One-click Cloudflare WAF rules apply
- New: New Modal for Login activity with detailed information.
- Improvement: Code cleanup and optimization
- Fix: Login redirected URL was showing exisiting login for password reset
- Fix: Minor bug fixes and stability improvements
- Improvement: Code cleanup and optimization
- Improvement: Code improvements to the ovearll plugin making it snappier.
- Improvement: Conflict management between applied settings.
- Improvement: UI improvements to existing settings pages. Making it more intuitive to use.
- Fix: Multiple bug fixes to dashboard. You should get more accurate results now.
- Fix: New deactivation URL was not saving after deactiviting-activating plugin.
- Fix: Email 2FA codes were not being sent properly
- Fix: 2FA code page flickering effect after login
- New: Completely redesigned user interface for better usability
- New: Security Score meter to track your site's security level
- Improvement: Enhanced modal design for better UI/UX
- Fix: Minor UI bug fixes
- Security: Removed unauthenticated AJAX actions
- Security: REST routes now require admin permission
- Fix: Dashboard emergency deactivation URL display issue
- Improvement: Human-readable values in activity log
- Improvement: Reduced plugin size with optimized code
- Fix: 2FA reset issue for users
- Fix: Password policy not applying to new users
- New: Activity Log feature
- New: Improved dashboard design
- Fix: Nonce validation issues
- Fix: Turnstile not showing on comment forms
- Fix: Custom login setup issues
- Fix: Email 2FA asking for OTP twice
- Fix: Feedback form email delivery
- Improvement: Reorganized menu navigation
- Improvement: Performance optimizations
- Fix: Request logs page display issue
- Fix: URL Guard SQL query display
- Improvement: Performance optimizations
- Redesigned settings page interface