Top 10 Security and Protection Plugins for Wordpress

April 8, 2008 - 115 Comments
Popular, Wordpress, Wordpress Plugins

With every site you build there are going to be security risks and issues, there is no way around this, it is going to happen. All we can do is minimize the damage, be ready for it and take action. Wordpress is now the most popular Blogging Engine, this will not mean an increase attacks, but it will have the highest potential of attacks.
I haven’t included Akismet, because I am sure everyone has heard about it.
Antway, here are my Top 10 Security Plugins for Wordpress.

1. WordPress Database Backup (http://www.ilfilosofo.com/blog/wp-db-backup/)

URL: http://www.ilfilosofo.com/blog/wp-db-backup/.
Description: This plugin does exactly what it says, it backs up your entire WP installation. This has got to be one of the first plugins you install upon first installation. You can back it up to your hard drive, on a server or even to a specified email address. Whether it be a rogue plugin or a hacker (or yourself) that crashes WP, WP Database Backup will reinstate everything as it should be. I like to think of it as my “WP system restore“.

2. Semisecure Login (http://jamesmallen.net)

URL: http://jamesmallen.net/2007/09/16/semisecure-login/.
Description: Semisecure increases the security of your WP Login, it uses client-side MD5 encryption on the password. JavaScript is required to enable encryption. When JavaScript is not available, the password is transmitted in plaintext (as normal), but authentication still completes in this case.

3. AskApache Password Protect (http://www.askapache.com)

URL: http://www.askapache.com/wordpress/htaccess-password-protect.html.
Description: This will secure your WP Admin with a very powerful htaccess password protection, preventing all unwanted bots from entering your site.

4. Force SSL (http://almosteffortless.com/)

URL: http://almosteffortless.com/wordpress/force-ssl/.
Description: For those will an SSL certificate, the Force SSL plugin for Wordpress forces for an HTTPS connection for security purposes. This is useful for those who with to enforce a higher level of security regarding the delivery of Wordpress content to the browser.

5. WP Security Scan (http://wordpress.org/extend/plugins)

URL: http://wordpress.org/extend/plugins/wp-security-scan/.
Description: I love this plugin, it scans your site for security issues and checks passwords, file permissions, database security, WP version hiding and WordPress admin protection/security. It also makes me a little paranoid.

6. Secure Files (http://wordpress.org/extend/plugins)

URL: http://wordpress.org/extend/plugins/secure-files/#post-271.
Description: This plugin allows you to upload and download files from outside of your web document root for security purposes. When used in conjunction with a plugin that requires a user to be logged in to see your site, you can restrict file downloads to users that are logged in.

7. WP-SpamFree (http://www.hybrid6.com/)

URL: http://www.hybrid6.com/webgeek/plugins/wp-spamfree.
Description: I had heard a lot about this plugin before I tried it, it said it is better than Akismet. To be honest I never noticed much difference (I get 500+ spam a day at the moment) between the two. User choice I suppose. I wish there was a way to stop the spammers instead.

8. BackUpWordPress (http://wordpress.designpraxis.at)

URL: http://wordpress.designpraxis.at/plugins/backupwordpress/.
Description: Almost identical as the first plugin, just not as straight forward. The list of features goes on and on, this is for the WP Pro. Some features: Database backup including uploaded files, plugins, etc.; EMail notofication on new backups; Trigger backup manually; Set schedules for your backups; restore backups; Staggered SQL import; Automatically continue unfinished backups in background; Language Support. (And thats just the Easy Mode, wait until you see the advanced).

9. Anonymous Wordpress Plugin Updates (http://f00f.de/)

URL: http://f00f.de/blog/2007/10/02/plugin-anonymous-wordpress-plugin-updates.html.
Description: Anonymizes the plugin update checking system which is a new feature in WordPress 2.3. The plugin prevents WordPress from transmitting a list of active plugins, the blog url and WordPress version. Ideal for privacy-aware administrators of WordPress installation.

10. Replace WP-Version (http://wordpress.org/extend/plugins/)

URL: http://wordpress.org/extend/plugins/replace-wp-version/#post-2859.
Description: (We have all read about the security issue of showing your WP version, this resolves it).
If you’re running an older version of WordPress, anyone can view source to see what attacks might work against your blog. This plugin replace the WP-version with a random string < WP 2.4 and eliminate WP-version > WP 2.4.

Subscribe via RSS or Follow us on Twitter

Share This Post

There are 42 Comments › Leave your comment

linux4life
8 Apr, 2008

Great list! I didn’t know many of these plugins, so I really need to improve the security of my blog

Reply
Frank
14 Apr, 2008

another nice plugin for security: WP Adminprotection

Reply
Alex @ WordPress Web 2.0 Guide
16 Apr, 2008

Great list of plugins although I still think that some of the functions that those plugins do are easier accomplished by simply editing the file (like hide the version) and it will reduce the load on your host … I guess some plugins are designed to help less experienced users …

Great list non-less.

Alex

Reply
Richard
16 Apr, 2008

re: WP Security Scan (http://wordpress.org/extend/plugins)
See “issues” with this plugins at at http://wordpress.org/support/topic/165807

selective quotes include: “Was that meant to be an April Fool’s joke? Being concerned about security, I downloaded this plugin, ran it, set my permissions to the “suggested corrective actions” and when trying to access my site, all I got were errors. I had to reset my permissions as best as I could and got it to work again.

Either this is a bad joke or awfully written code by someone who doesn’t have a clue as to what WP permissions should be.”

Reply
ジェイソン (Jason)
16 Apr, 2008

The Replace WP-Version plugin is pretty slick. I’ve been doing this manually for the last few releases. It’s good to see that everyone can easily do this, now :)

Thanks for the list!

Reply
Carter Mason
16 Apr, 2008

The biggest difference between wp-spamfree and akismet is that wp-spamfree stops the comment before it gets sent, and is extremely accurate at detecting bots from humans without captchas.

I no longer have to look through a huge list of comments in akismet to find the false-positives. There aren’t any!

Reply
Mike Cherim
16 Apr, 2008

I had that problem with Akismet. I still had to much spam, but in a different queue. I added Mike Jolley’s comment stopper and it has been a blessing. Now I have no spam, only legit comments.

http://blue-anvil.com/archives/wordpress-comment-spam-stopper-plugin

Reply
Kelson
16 Apr, 2008

A couple of notes:

Having worked with lots of spam filters, I’m *extremely* suspicious of anything that claims to have “no false positives.” The only way to guarantee that is to never block anything.

Semisecure Login does not appear to work with WP 2.5, probably because of the new password storage scheme.

Reply
Carter Mason
16 Apr, 2008

Yes, I would be suspicious, too. But… the developer has been extremely quick to release updates whenever there is any type of quirk, and if you read through the documentation, you will understand why wp-spamfree blocks bots and not humans.

Reply
Rémy Roy
16 Apr, 2008

“I wish there was a way to stop the spammers instead.”

There are many ways but one is to use a CAPTCHA. I suggest you have a look at my CAPTCHA available at http://www.remyroy.com/yacaptcha/ .

Reply
Geoserv
16 Apr, 2008

STUMBLED!

I just started blogging, this post will come on handy.

VOTED for you at:
http://www.newsdots.com/software/top-10-security-and-protection-plugins-for-wordpress-speckyboy-wordpress-and-design/

Reply
BeyondRandom
17 Apr, 2008

I have most but not all…thanks for the tips!

Reply
Matt
17 Apr, 2008

Last time I tried AskApache PassPro I was not able to make it work with another scheme I had set up called, “Hiding WordPress Installation Files”

My question is this, Do you think the AskApache protection is more important that the protection provided by hiding the WordPress installatin files? Thanks.

Reply
Richard H
17 Apr, 2008

I agree with Alex regarding “simply editing the file” instead of using some of these plugins, but still, a pretty decent list.

Thanks.

Reply
Richard
17 Apr, 2008

Great list. I like it.

Reply
Adam K
18 Apr, 2008

I’m surprised Bad Behavior didn’t make this list; it does what you said you wanted: to stop spammers.

I’ve used it for a long time, and it definitely cut down the load of spam comments and such… one downside is that it makes it take a lot longer to reload a page when editing (regular viewing seems fine, it’s the editing process that gets slowed down).

Reply
AskApache
18 Apr, 2008

In response to Matt.

The latest version of AskApache Password Protection has a lot of new features. Other than staying updated to the latest version of WordPress and having decent passwords, NOTHING can secure your blog better and more completely than this plugin.

2 new features enable you to turn on or off wp-includes/wp-content/wp-admin protection.

The wp-admin directory is password protected to erect a 1st line of defense against maliciousness. Hackers cannot even begin to try to hack your wp-admin until they get past that.

The wp-includes and wp-content folders are protected by disallowing any direct requests for files other than the static files like images, css, js, etc.

And of course I backup my databases like crazy, all the time.

Great list speckyboy!

Reply
Enrique
19 Apr, 2008

WP-SECURITY-SCAN:

WARNING! It generated almost 5 gigas error.log.

I had to contact my hosting provider, after erasing it, to flush my logs

Reply
Gurcay
25 Apr, 2008

thanks. :)

Reply
illegalcrew
25 Apr, 2008

great list.

Reply
Firewall Script
8 May, 2008

Great PHP based firewall that plugs into any php based site, wordpress included: Firewall Script.

Reply
Will
23 May, 2008

I already use some of them, plugins are very useful.

Reply
jocuri
27 May, 2008

Thanks for this useful plugin.

Reply
jocuri
30 May, 2008

Keep up the good work! 10q

Reply
Chris
22 Jun, 2008

Thanks a lot for the useful list and the descriptions! It’s a pleasure that you always provide such toplists on your blog.

Reply
Typolight
6 Sep, 2008

Thanks, you nice post that helped me alot.

Reply
nadie007
21 Sep, 2008

great list! a lot of options for wp more secure!
thanks

Reply
Jocuri
21 Sep, 2008

WP-SECURITY-SCAN:

Reply
Victoria
5 Nov, 2008

Very good post! Thank you for the work done!

Reply
Mark
2 Jan, 2009

There’s a brand new available that you can add to your list if/when you decide to update: “Maximum Security for Worpdress” – see the Web site for a long list of powerful features.

Reply
Berrie Pelser
2 Feb, 2009

Very nice list, all installed ;)

Reply
Roberto
26 Apr, 2009

Very useful, I am using at the moment 3 of this list of pluggins in mu blogs and I recommend everybody to use it.

Roberto

Reply
romonoeroetoko
8 Jul, 2009

Hm that sounds good but I would like to know more details.

Reply
Raghu
8 Jul, 2009

Great list thanks… this will help me

Reply
romonoeroetoko
15 Jul, 2009

Your news is a cool stuff man, keep it going.

Reply
Joltivan
30 Jul, 2009

Thanks for the list..nice collection :D

Reply
amenodimeno
31 Jul, 2009

That’s good man, keep it going.

Reply
amenodimeno
5 Aug, 2009

Good story for me but please more details.

Reply
queroeropoo
6 Aug, 2009

Good information to me.

Reply
adamoerikom
19 Sep, 2009

Stunning blog and good article. High 5 for u man !

Reply
Sports Picks
15 Oct, 2009

Security and protection for anyone’s website is a must have. Out of this list I would think the backup tools are probably most important. Backup Backup Backup – or one day you might lose it all. Which, trust me, is horrible.

Reply
adamusxyz
6 Jan, 2010

This is a very good stuff man. But you can be more specific next time. See ya !

Reply