Ultimate Security – AI Security, 2FA, Login Protection & Vulnerability Scanner

Open the emergency link the setup wizard gave you. It switches the plugin off so you can log in and fix the setting. If you didn't save it, ask your host to rename the folder /wp-content/plugins/ultimate-security, or run wp plugin deactivate ultimate-security over SSH.

No. Checks run only when someone logs in or submits a form, not on every page view. Scans run in the background on a schedule, in small batches. If you turn on AI crawler visits, each page view adds one quick name check; storage is touched only when an AI bot visits, at most once an hour per bot.

No. The setup wizard picks settings for your kind of site and shows every change before applying it. You can undo all of it later.

A safe way to try your settings. Your protections run, but nobody is blocked; instead you get a log of what would have been blocked. Once you are happy, switch it off to enforce the rules. It turns itself off after seven days, so a forgotten test never leaves your site unprotected.

Yes. The wizard shows every change before applying it, and you can undo them all later. Changes you made yourself afterwards are kept.

Yes. Everything described on this page is included, with no account, trial or time limit.

No. The scanner works straight away with the free WPVulnerability database. WPScan and Patchstack keys are optional and only add extra coverage.

Yes. CAPTCHA can protect the WooCommerce login, registration, password reset and checkout forms, two-factor login works on the WooCommerce login form, and the wizard has a WooCommerce template.

Only for the Cloudflare firewall rules. Every other feature works without one.

For Cloudflare, no: it is recognised automatically. For any other proxy or load balancer, add its address under Brute-force protection → Trusted proxies. Until you do, the plugin avoids locking out everyone at once, and Site Health tells you what to add.

Add define( 'ULTIMATE_SECURITY_DISABLE_CAPTCHA', true ); to wp-config.php to switch CAPTCHA off, log in, re-enter your Site Key and Secret Key, then remove the line. To turn off just one provider, use ULTIMATE_SECURITY_DISABLE_TURNSTILE or ULTIMATE_SECURITY_DISABLE_RECAPTCHA. Over SSH, wp ultimate-security captcha off does the same. Site Health warns you when a key stops working.

It can if two plugins do the same job. Use one plugin per job (one for two-factor, one for CAPTCHA, one for login limits) and switch the overlapping feature off in the other. Ultimate Security warns you when it spots an overlap.

You can import two-factor and login settings from Wordfence Login Security. You see exactly what will come across first, and can undo the import afterwards.

Yes. Make sure your caching plugin doesn't cache the login page; most skip login and admin pages automatically.

Yes. Give the cache enough memory so it doesn't drop entries early, or a lockout can end sooner than you set.

It runs on Multisite, with settings per site. It has been tested less there than on single sites, so try it on a staging network first.

Yes. On each site, create an application password for an administrator account you use for monitoring. Then read https://example.com/wp-json/ultimate-security/v1/agent/summary with it, or run wp ultimate-security agent summary. You get the security score, open issues, versions and recent sign-in problems in one reply. It is read-only, and the plugin sends nothing anywhere: your tool asks, the site answers.

No. There is no usage tracking. It contacts an outside service only when you use a feature that needs one, and each is listed under External Services below.

IP addresses and browser details are kept in the session log so you can review sign-ins. Test Mode keeps its own log of what it would have blocked. If you turn on AI crawler visits, only the bot's name and the days it visited are kept, never an IP address. Everything stays in your own database.

Your data stays on your own server. Outside calls are limited to the services listed under External Services, and only for features you turn on. "Explain with AI" removes addresses, user names and your login address before it sends anything to the AI provider you chose.

By default your settings are kept, in case you reinstall. To remove everything, turn on "delete plugin data" in the plugin's advanced settings before uninstalling.

Yes, if your site uses HTTPS and pretty permalinks and has the official WordPress MCP Adapter plugin. Go to API & Agent Access, open "Connect AI apps", turn on "Share security findings with AI agents" and "Let AI apps sign in", then follow the steps shown there for ChatGPT or Claude. An administrator approves each app once on your site. The app can only read security information; it cannot change anything. You can revoke it on the same screen at any time. In ChatGPT, your plan must allow custom apps (developer mode). Cursor can connect too after you choose "Allow Cursor" on the same screen.

Go to API & Agent Access, open the AI agents tab, turn on AI safety checks and click "Scan content now". Ultimate Security looks for hidden instructions, invisible characters and data-leaking links in your content and comments, and shows each place it finds. No AI service is used for the scan.

Turn on "Watch AI crawler visits" on the same AI agents tab. It lists the AI bots that fetch your pages by the name they give, with the last visit and what each bot is for. Pages served from a page cache or CDN do not reach WordPress, so those visits are not counted.

First, turn on "Watch AI crawler visits" to see which AI bots actually come. If your site uses Cloudflare, turn on the ready-made AI crawler rule under Cloudflare firewall rules and preview it before it goes live. Without Cloudflare, list the bots you want to stop in your robots.txt file; well-behaved AI crawlers follow it.

Not through Ultimate Security. AI apps you connect can only read your security information, and fixes run only when a signed-in person clicks them. AI tools added by other plugins are separate: the AI tool check warns you about any that can change your site or skip their permission check.

The MCP Adapter is the official WordPress plugin that lets AI apps such as Claude, Cursor and VS Code use tools a site offers. Ultimate Security's tools are read only and stay off until you turn them on under API & Agent Access. You can see every AI tool on your site, from any plugin, on the same page.

Not unless you ask it to. The prompt injection scan and AI crawler visits work entirely on your site. Only "Explain with AI" sends text to an AI provider, and only the one you set up in WordPress, after you turn it on and click Explain. See External Services below for exactly what is sent.

Ask in the plugin's support forum on WordPress.org, or visit https://www.wpultimatesecurity.com.