Get Total Security WP

Check requirements first

For the strongest firewall mode you also want auto_prepend_file support or a writable .user.ini. If your host provides neither, the plugin detects that and deploys Standard Mode automatically — there is nothing for you to configure and nothing to fix.

Install & activate

From the WordPress admin

1. Go to Plugins → Add New and search for Total Security WP.
2. Click Install Now, then Activate.
3. Open Total Security WP in the admin menu. The Setup Wizard starts automatically.

From a zip

1. Go to Plugins → Add New → Upload Plugin and choose the zip.
2. Or upload the total-security-wp folder to /wp-content/plugins/ over SFTP.
3. Activate it from the Plugins screen.

From WP-CLI

wp plugin install total-security-wp --activate
wp total-security-wp status

The first ten minutes

The order here matters. It gets you protected, then verified, then recoverable.

1. Run the Setup Wizard. It probes your host, deploys the best firewall mode available, self-tests the deployment with a loopback request, and rolls back automatically if the test fails.
2. Run a first full scan. Do this before assuming the site was clean when you installed. It also gives integrity monitoring its baseline.
3. Enable 2FA on every administrator account. This is the single highest-value thing on the list. Save the backup codes somewhere off the site.
4. Take a backup and enable emergency recovery. Download the recovery script and store it where you can reach it without the site.
5. Set a notification channel. Email or a Slack/Teams webhook. Detection nobody sees is not detection.
6. Review the hardening checklist. Each control says what it changes and can be reverted from the same screen.

Migrating from another security plugin

1. Deactivate the other plugin first. Two firewalls writing competing .htaccess rules is the most common way a site breaks after installing any security plugin.
2. Check it cleaned up after itself. Look for leftover rule blocks in .htaccess and stray constants in wp-config.php, and remove any it left behind.
3. Then run the Setup Wizard, so it probes a clean environment rather than one still carrying another plugin's rules.

Existing 2FA enrolments do not transfer between plugins — the secrets are stored in each plugin's own format. Plan on re-enrolling administrators, and do it before you deactivate the old plugin so nobody is locked out in between.

If something breaks

Every irreversible-looking thing the plugin does has an exit. Worth knowing before you need it:

• The firewall prepend fails open — if its files are missing or corrupt it does nothing rather than throwing a fatal error.
• The wizard self-tests and rolls back, so a failed deployment does not leave a half-installed prepend behind.
• Server-level changes are written into clearly marked, reversible blocks, and are always removed when the plugin is deleted.
• Renaming the plugin folder over SFTP deactivates it, which is the universal escape hatch when you cannot reach wp-admin.
• Troubleshooting covers the common lockouts and how to undo each one.

Next steps