Ultimate Security – Vulnerability Scanner, 2FA, and Login Protection
| 开发者 |
programmelab
wpultimatesecurity |
|---|---|
| 更新时间 | 2026年10月1日 00:06 |
| PHP版本: | 7.1 及以上 |
| WordPress版本: | 7.1.2 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Free, with no account needed. Install it and it works. No sign-up and no usage tracking.
- Set up in about 3 minutes. The wizard asks what kind of site you run, checks it, and shows every change before applying it. You can undo it all later.
- Try before you enforce. Test Mode shows what would have been blocked, without blocking anyone.
- You can't lock yourself out for good. The wizard gives you an emergency link that switches the plugin off from any browser.
- Lock out anyone who gets the password wrong too many times. Repeat offenders wait longer each time.
- Permanently block addresses you never want to see again.
- An administrator can send a locked-out user a 15-minute recovery link.
- Works behind Cloudflare automatically. Site Health tells you if your host's setup needs one extra step.
wp-login.php to a private address so bots can't find it.
Stronger passwords.
- Set rules for length, letters, numbers and symbols, or pick a ready-made preset.
- Stop people reusing old passwords, and ask for a new one on first login or after a set time.
- Reject passwords that have appeared in known data leaks. The check never sends the password itself anywhere.
- Limit how many devices one account can use at once.
- Sign people out automatically after a period of inactivity.
- See who is signed in right now, and end any session with one click.
- Check that your keys work before going live.
- If the CAPTCHA service is down, your forms keep working.
- Won't clash with another CAPTCHA plugin on the same form.
- Runs on a schedule in the background.
- Flags plugins that haven't been updated in a long time.
- Results show in the dashboard, Site Health and your plugins list.
wp-config.php on demand or on a schedule, which signs everyone out and makes stolen login cookies useless. You get a warning before a scheduled change, and can restore a previous set.
Test Mode
Turn on your protections without blocking anyone, and review a log of what would have been blocked. Choose which user roles it covers. Visitors who aren't signed in are still held to the login limit, and Test Mode switches itself off after seven days, so a forgotten test never leaves your site unprotected.
Moving from another plugin
- Import your two-factor and login settings from Wordfence Login Security. Preview it first and undo it if you change your mind.
- Copy your settings to another site, or keep a backup, as a file.
- Detects WooCommerce, Ultimate Member, page builders, form, caching and SEO plugins, and warns you if another security plugin is already doing the same job.
- Set up an authenticator app
- Two-factor login by email
- Hide your login page
- Set strong password rules
- Limit login sessions
- Manage plugin and theme updates
- Change your security keys after a breach
- Spot changed WordPress files
- Understand Site Health reports
- Dashboard walkthrough
- Move your Wordfence two-factor settings
- Website — features and articles.
- Documentation — setup guides, troubleshooting and how-tos.
- YouTube — all video guides.
安装:
- In WordPress, go to Plugins → Add New and search for "wpultimatesecurity".
- Click Install Now, then Activate.
- Follow the Security Wizard that appears — it scans your site, recommends settings, and shows you every change before applying it.
- Download the plugin ZIP.
- Go to Plugins → Add New → Upload Plugin, choose the ZIP, and click Install Now.
- Click Activate, then follow the Security Wizard.
wp plugin install ultimate-security --activate
Your first 3 minutes
- Run the Security Wizard and apply the template that matches your site.
- Save the emergency link the wizard shows you somewhere safe. It gets you back in if you ever lock yourself out.
- Turn on two-factor login for every administrator.
屏幕截图:
常见问题:
I locked myself out. How do I get back in?
Open the emergency link the setup wizard gave you. It switches the plugin off so you can log in and fix the setting. If you didn't save it, ask your host to rename the folder /wp-content/plugins/ultimate-security, or run wp plugin deactivate ultimate-security over SSH.
Will this slow down my site?
No. Checks run only when someone logs in or submits a form, not on every page view. Scans run in the background on a schedule.
Do I need any technical knowledge?
No. The setup wizard picks settings for your kind of site and shows every change before applying it. You can undo all of it later.
What is Test Mode?
A safe way to try your settings. Your protections run, but nobody is blocked; instead you get a log of what would have been blocked. Once you are happy, switch it off to enforce the rules. It turns itself off after seven days, so a forgotten test never leaves your site unprotected.
Can I undo what the wizard changed?
Yes. The wizard shows every change before applying it, and you can undo them all later. Changes you made yourself afterwards are kept.
Is it really free?
Yes. Everything described on this page is included, with no account, trial or time limit.
Do I need an API key for vulnerability scanning?
No. The scanner works straight away with the free WPVulnerability database. WPScan and Patchstack keys are optional and only add extra coverage.
Does it work with WooCommerce?
Yes. CAPTCHA can protect the WooCommerce login, registration, password reset and checkout forms, two-factor login works on the WooCommerce login form, and the wizard has a WooCommerce template.
Do I need a Cloudflare account?
Only for the Cloudflare firewall rules. Every other feature works without one.
I use Cloudflare or another CDN or proxy. Do I need to do anything?
For Cloudflare, no: it is recognised automatically. For any other proxy or load balancer, add its address under Brute-force protection → Trusted proxies. Until you do, the plugin avoids locking out everyone at once, and Site Health tells you what to add.
CAPTCHA is blocking every login. How do I recover?
Add define( 'ULTIMATE_SECURITY_DISABLE_CAPTCHA', true ); to wp-config.php to switch CAPTCHA off, log in, re-enter your Site Key and Secret Key, then remove the line. To turn off just one provider, use ULTIMATE_SECURITY_DISABLE_TURNSTILE or ULTIMATE_SECURITY_DISABLE_RECAPTCHA. Over SSH, wp ultimate-security captcha off does the same. Site Health warns you when a key stops working.
Will it conflict with other security or CAPTCHA plugins?
It can if two plugins do the same job. Use one plugin per job (one for two-factor, one for CAPTCHA, one for login limits) and switch the overlapping feature off in the other. Ultimate Security warns you when it spots an overlap.
I already use another security plugin. Can I bring my settings across?
You can import two-factor and login settings from Wordfence Login Security. You see exactly what will come across first, and can undo the import afterwards.
Does the custom login URL work with caching and CDNs?
Yes. Make sure your caching plugin doesn't cache the login page; most skip login and admin pages automatically.
Does it work with Redis or Memcached?
Yes. Give the cache enough memory so it doesn't drop entries early, or a lockout can end sooner than you set.
Does it work on WordPress Multisite?
It runs on Multisite, with settings per site. It has been tested less there than on single sites, so try it on a staging network first.
Does the plugin track me or phone home?
No. There is no usage tracking. It contacts an outside service only when you use a feature that needs one, and each is listed under External Services below.
What does the plugin store about my visitors?
IP addresses and browser details are kept in the session log so you can review sign-ins. Test Mode keeps its own log of what it would have blocked. Everything stays in your own database.
Is it GDPR-friendly?
Your data stays on your own server. Outside calls are limited to the services listed under External Services, and only for features you turn on.
What happens to my data when I uninstall?
By default your settings are kept, in case you reinstall. To remove everything, turn on "delete plugin data" in the plugin's advanced settings before uninstalling.
How do I get support?
Ask in the plugin's support forum on WordPress.org, or visit https://www.wpultimatesecurity.com.
更新日志:
- Fix: Test Mode no longer locks out the accounts it covers when they reach the login limit. The attempt is recorded in the Test Mode log instead.
- Fix: On phones, the plugin's menu no longer makes pages scroll sideways or overlap other buttons.
- Improvement: Notifications on the email verification, two-factor and login settings pages now look and behave like the rest of the plugin.
- Improvement: Code optimized, so the plugin is a little lighter.
- Stronger protection for sign-in, two-factor authentication and brute-force limits, following an internal security review. The details are kept private so sites that have not updated yet stay safe. New
- Choose how many email two-factor codes can be requested every 15 minutes, and how long someone must wait before asking for another (Login → Two-Factor → Email Authentication).
- Set how many wrong two-factor codes are allowed, and how long the lockout lasts, for each method on the profile screen.
- The lockout message on the login page counts down and clears itself when the lockout ends.
- Brute-force protection now works in two stages: a few short lockouts first, then a longer one. You choose how many short lockouts come first, and you can switch the longer stage off.
- Site Health tells you when your site is behind Cloudflare but real visitor addresses are not reaching WordPress.
- On your first visit, a "Setting up your dashboard" window shows each check as it finishes instead of empty cards. The results are saved, so the dashboard opens with real numbers next time. Improved
- A fresh, consistent look on every screen, including the setup wizard and the two-factor section on your profile page.
- Dark mode now covers every screen.
- Text is a little larger, and text boxes, dropdowns and switches have an outline you can actually see.
- Severity colours match everywhere: red for critical, amber for high.
- Settings pages show the page name above the form, like the dashboard.
- The unsaved-changes banner tells you which field needs attention.
- The brute-force settings are clearer: they are labelled Initial and Advanced, and the long lockout is set in minutes.
- Update Manager freeze periods need a start and an end date, and dates in the past are rejected.
- The two-factor lockout email is sent once per lockout instead of on every blocked attempt.
- API keys pasted with an extra space or line break are cleaned up when saved. Changed
- The "Require authorization to reset 2FA" option added in 1.0.29 has been removed. It was off by default. If you had turned it on, users can once again reset their own two-factor method without re-entering their password. Fixed
- Saving settings is more reliable: switches no longer flip back, a failed save shows the real reason instead of "No internet connection", and page caches are cleared after saving.
- The hidden login page shows the right address after you save.
- Cloudflare Turnstile and Google reCAPTCHA now protect the WooCommerce block checkout as well as the classic one.
- "Update all plugins" and "Update all themes" now run the updates.
- Password-reset links from WordPress or WooCommerce are no longer logged as attacks.
- "Clear all IP lockouts" no longer empties the whole site cache on sites that use Redis or Memcached.
- People on the block list see a clear "blocked" message instead of a countdown.
- Sites behind Cloudflare no longer risk locking out many visitors at once when Cloudflare's visitor-address header is missing.
- Authenticator app setups survive uninstalling and reinstalling the plugin when you choose to keep plugin data.
- Saved API keys stay readable after you change your site's security keys (salts).
- The Patchstack and WPScan vulnerability checks work again and catch more affected versions.
- Test Mode respects the "Always exclude administrators" and "Log simulated blocks" switches, and records the right user.
- Undoing a settings import in Backup & Restore works again, and the Copy button works on sites without HTTPS.
- The reCAPTCHA and Turnstile debug logs load again, the dashboard shows your PHP version straight away, and two messages that could crash on PHP 8 are fixed.