GPLv2 or later
License
Total Security WP is free software, licensed under the GNU General Public License, version 2 or (at your option) any later version — the same license as WordPress itself.
The grant
Total Security WP
Copyright (C) 2026
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
MA 02110-1301 USA.Read the full text at gnu.org/licenses/gpl-2.0.html.
What that actually means for you
You may
- Use the plugin on as many sites as you like, commercial or not
- Read the entire source — it ships unobfuscated, with no compiled blobs
- Modify it for your own needs
- Redistribute it, modified or not, under the same GPL terms
- Audit it before trusting it, which for a security plugin you arguably should
You must
- Keep the same GPL license on anything you redistribute
- Include the license text and copyright notice
- Make your source available if you distribute a modified version
- Not present a modified version as the official release
A security plugin asks for extraordinary trust: it reads every request, touches every file, and holds your two-factor secrets. That trust should be verifiable. Every line of PHP and JavaScript ships readable, and the dashboard runs on WordPress core's own bundled React — there is no build step hiding what actually executes.
How Pro fits
The Pro tier is GPL code too — the GPL does not permit anything else for a WordPress plugin, and we are not going to pretend otherwise. What a Pro license buys is not permission to run the code; it is:
- Access to the live threat-intelligence service — hourly WAF signature updates, CVE-matched virtual patches and cloud reputation verdicts. That is a running service, not a copyright grant, and it is what a subscription actually pays for.
- Sentinel AI analysis, which runs on our infrastructure.
- Support and continued development.
Pro features are gated locally by cryptographic token verification, so the plugin does not make an HTTP call on every request to decide what you are entitled to. Circumventing that gate does not unlock the service behind it: without a valid license the threat-intel feed and reputation endpoints have nothing to return.
Pirated copies of security plugins are a well-established malware distribution channel — the attacker's edit is trivially hidden in code you were never going to read. Installing a nulled security plugin hands root of your site to whoever repackaged it. The free tier is a complete, permanently free security plugin; there is no reason to run a tampered one.
No warranty
As stated in the license text, the software is provided without warranty of any kind. In plain terms: no security product can guarantee a site will not be compromised. Total Security WP raises the cost of attacking your site substantially, and gives you the tools to detect and recover from a compromise quickly — but it is one layer in a practice that also includes keeping software updated, using strong unique credentials, restricting who has administrator access, and keeping tested off-site backups.
Third-party components
The plugin is self-contained: no Composer dependencies, no npm packages, no vendor
directory. It builds on WordPress core's own bundled libraries — notably React via
wp-element — which are covered by WordPress's own GPL licensing.
Where the plugin consults external data (WordPress.org checksums, the Have I Been Pwned Pwned Passwords API), it uses those public services under their own terms; it does not bundle or redistribute their data. See the privacy disclosure for exactly what is queried and when.
This marketing site loads Tailwind, GSAP and Three.js from public CDNs under their respective MIT licenses, and typefaces from Google Fonts under the SIL Open Font License.
Trademarks
WordPress and WooCommerce are trademarks of their respective owners. Total Security WP is an independent project and is not affiliated with, endorsed by, or sponsored by WordPress.org, the WordPress Foundation or Automattic. Cloudflare, Google, Slack, Microsoft Teams, PagerDuty and OpsGenie are trademarks of their respective owners and are named here only to describe interoperability.