A whole security team, packaged into one plugin.
Six layers of defense — firewall, malware scanning, file integrity monitoring, hardening, 2FA, backups and audit logging — running entirely on your own server. No external service required. No Node, no build step.
Security Score
Excellent
Firewall
Optimized · Active
Malware Scanner
Idle · Clean
Last Full Scan
3 minutes ago
LIVE AUDIT LOG
ISSUE ALERTS
PRO — Under Attack Mode, scheduled scans & live threat intel.
Go ProMODULE 01 — FIREWALL
Web Application Firewall & DDoS Shield
Dual-mode WAF: Optimized Mode runs before WordPress even loads via a lightweight prepend; Standard Mode runs inside WordPress when a prepend can't be deployed. Either way, malicious requests never reach your database.
- Blocks SQL injection, XSS, LFI/RFI, path traversal & RCE
- Rate limiting, brute-force protection & DDoS shielding
- Bad-bot blocker and country-level geo-blocking
- Virtual patching shields vulnerable plugins/themes until updated
MODULE 02 — INTEGRITY
Malware Scanner & File Integrity Monitoring
A heuristic regex + token-based detection engine sweeps every file. Core, plugin and theme files are verified against WordPress.org checksums; everything else — including mu-plugins and drop-ins — is checked against your own baseline.
- On-demand full-site scans + free weekly automatic baseline scan
- Database scanner for spam injections & rogue admin accounts
- Safe quarantine, one-click clean-file recovery & permission reset
- Pro Scheduled daily/twice-daily scans + auto-quarantine on detection
MODULE 03 — ACCESS & HARDENING
Deep Hardening, Two-Factor Auth & Audit Trail
Lock the front door and keep a record of every attempt on it. TOTP-based 2FA with QR enrollment, backup codes, and an enterprise-grade audit log that tracks every meaningful event on your site.
- .htaccess/Nginx rule generation & wp-config hardening
- REST API & XML-RPC restriction, version obfuscation
- TOTP 2FA, login CAPTCHA, password policy & breached-password checks
- Audit log: IP/user/proxy tracking, 90-day retention, CSV export
AUDIT STREAM
EVERYTHING ELSE, INCLUDED — FREE
Not a trimmed-down trial. A complete suite.
Everything on this page is in the free plugin unless it carries a Pro badge. Nothing here is time-limited, request-limited, or crippled to push an upgrade.
04 — THE CONSOLE
This is the actual plugin.
Not a mockup and not a marketing render — every screen below is the shipping Total Security WP admin, running inside wp-admin with WordPress core's own bundled React. No Node, no build step, no Composer install.
Main Dashboard
Security score, module health, and the counters that matter.
01 / 16 SCREENS
USE ← → TO STEP THROUGH
05 — DEFENSE IN DEPTH
Six layers. An attacker has to beat all of them.
Single-control security fails the moment that control is bypassed. Total Security WP is built as concentric layers — the perimeter, the request, the identity, the filesystem, the database, and the evidence trail. Select a layer to see what it stops and what it does when something gets past the one in front of it.
06 — ENGINEERING GUARANTEES
A security plugin has to be safe to install.
Security software runs with the highest privileges on your site. That is exactly why the failure modes matter as much as the features — so here are ours, in writing.
Fails open, by design
If the Optimized Mode prepend's configuration or files are missing or unreadable, it does nothing at all rather than taking your site down with it.
A deployment that tests itself
The Setup Wizard picks the right firewall mode for your host, self-tests the deployment, and rolls itself back automatically if that test fails.
No external service required
Nothing in the free tier calls anything beyond the same public WordPress.org APIs core already uses for update checks. Every optional exception is disclosed in full.
Your data stays your call
Deleting the plugin keeps your logs, scans and settings in case you reinstall — while server-level changes are always reverted. Want a clean wipe instead? One setting.
08 — PLANS
Free protects your site. Pro runs your operation.
Everything that defends your site day to day is free, forever. Pro adds automation, live threat intelligence, and tooling for managing security across many sites.
Every plugin claims its free tier is complete. See exactly which normally-paid features aren't gated here →
Free
$0Forever. No credit card.
- Dual-mode WAF & DDoS shielding
- Virtual patching for vulnerable plugins
- Malware scanner + weekly baseline scan
- File integrity monitoring (core/plugins/themes)
- 2FA, login CAPTCHA, breached-password checks
- On-demand backup & standalone restore
- Audit log with 90-day retention
- Live traffic monitor & WP-CLI support
Pro
UpgradeEverything in Free, plus:
- Real-time threat intelligence & hourly WAF updates
- Under Attack Mode — one-click emergency shield
- Scheduled daily/twice-daily scans + auto-quarantine
- Cloud reputation lookups & impossible-travel detection
- Automatic patching as new CVEs are published
- Extended audit retention, email digests & PDF export
- WooCommerce delta backup & restore
- White-label dashboard, roles & multisite support
07 — ANSWERS
Frequently asked questions
Straight answers, including the ones about what we do and don't send off your server.
SYSTEM REQUIREMENTS
PRIVACY & EXTERNAL SERVICES
The free plugin sends nothing anywhere by default. A few opt-in features call external services, disclosed in full:
- • Breached-password check — k-anonymity lookup against Have I Been Pwned. Only 5 hash chars leave the site; never blocks login.
- • Login CAPTCHA — optional Cloudflare Turnstile / Google reCAPTCHA. See Cloudflare / Google privacy policies.
- • Checksum & CVE lookups — the same public api.wordpress.org service WordPress core already uses for updates.
- • Threat intel & Cloud Reputation Pro / opt-in — our license & threat-intel service, for signature updates and verdicts only.
- • Sentinel AI Pro / opt-in — redacted evidence bundles for a threat verdict, only with explicit consent; disabled by default.
09 — DEPLOY
From zero to protected in under two minutes
- 1
Upload & activate
Upload the
total-security-wpfolder to/wp-content/plugins/, or install directly from Plugins → Add New. Activate it. - 2
Run the Setup Wizard
Open Total Security WP in the admin menu. It deploys the firewall in the best mode for your host automatically.
- 3
Review defaults
Check Total Security WP → Settings and enable two-factor authentication for every admin account.
- 4
You're covered
Optimized Mode needs
auto_prepend_fileor a writable.user.ini. No support? It falls back to Standard Mode automatically — nothing to configure.
wp-cli