WpIron

Iron Security is your WordPress security bodyguard.
It shields your site from brute force attacks, unauthorized admin access, file injections, and common exploits like XML-RPC and REST API abuse. Whether you’re a solo creator or managing client sites, Iron Security delivers essential protection without the performance hit.
🔒 Don’t wait until your site is compromised. Secure it now — effortlessly.
Iron Security includes real-time brute-force protection, custom login URLs, HTTP headers, session control, malware upload prevention, and much more. All from a single, easy-to-use plugin dashboard.
Protects Against: 
– 🔐 Brute Force Attacks (Limit login attempts, 2FA) 
– 👮 Unauthorized Admin Access (Custom login URL, admin limit) 
– 👤 User Enumeration 
– 🎯 Admin Account Targeting (Admin ID & username protection) 
– 💣 XML-RPC & REST API Exploits 
– 🛡️ Code Injection & PHP Malware Uploads 
– 📂 Direct Access to Sensitive Files 
– 📛 MIME Sniffing & Content-Type Exploits 
– 🖼️ Clickjacking 
– 🧬 Cross-Site Scripting (XSS) 
– 🌐 Referrer Leakage
<h3>🔐 Key Features</h3>
<h3>🛠 General Hardening</h3>
<ul>
<li>Disable XML-RPC & REST API</li>
<li>Hide WordPress & WooCommerce versions</li>
<li>Block AI & scraping bots</li>
<li>Disable file editor</li>
<li>Enable plugin & core auto-updates</li>
</ul>
<h3>🔍 Security Logs</h3>
<ul>
<li>View detailed logs of login attempts and alerts</li>
<li>Filter logs by IP, message, or date</li>
<li>Audit suspicious activity easily</li>
</ul>
<h3>🔑 Login & Authentication</h3>
<ul>
<li>Custom login/admin URL</li>
<li>Limit login attempts with lockouts</li>
<li>Session timeout for idle users</li>
<li>Limit number of administrators</li>
<li>Block user enumeration</li>
<li>Change default Admin ID and Username</li>
<li>Enable 2FA (Google Authenticator)</li>
</ul>
<h3>🗂 Files & Directory Protection</h3>
<ul>
<li>Block PHP file uploads</li>
<li>Prevent direct access to core/system files</li>
</ul>
<h3>📦 HTTP Security Headers</h3>
<ul>
<li>X-Content-Type-Options</li>
<li>X-Frame-Options</li>
<li>X-XSS-Protection</li>
<li>Strict-Transport-Security</li>
<li>Referrer-Policy</li>
<li>Content-Security-Policy</li>
<li>Permissions-Policy</li>
</ul>
<blockquote>
Iron Security is built for creators who care about speed, simplicity, and security. If you’re not securing your site, you’re risking everything.
</blockquote>
<h3>Credits</h3>
Developed and maintained by <a href="https://wpiron.com" rel="nofollow ugc">WPIron</a>
<h3>License</h3>
This plugin is licensed under the GPLv2 or later.

Iron Security – WordPress Security Plugin

Hardening tool that blocks hackers and protect against: Brute Force Attacks, Exploits, Injections, Clickjacking and other important functionalities.

Jeff Starr

Julio Potier

wp-website-mastery

John H

Aldo Latino

<blockquote>
🔥 Install, activate, and done! 
 🔥 Powerful protection from WP’s fastest firewall plugin.
</blockquote>
<a href="https://perishablepress.com/block-bad-queries/" rel="nofollow ugc">BBQ Firewall</a> is a lightweight, blazing-fast firewall plugin that protects your site against a wide range of threats. BBQ checks all incoming traffic and quietly blocks bad requests containing nasty stuff like <code>eval(</code>, <code>base64_</code>, and excessively long request-strings. This is a simple yet solid solution for sites that are unable to use a <a href="https://perishablepress.com/8g-firewall/" rel="nofollow ugc">strong Apache/.htaccess firewall</a>.
<blockquote>
🔥 Adds a strong firewall to ANY WordPress site 
 🔥 Works with all WordPress plugins and themes
</blockquote>
Powerful Protection
BBQ protects your site against many threats:
<ul>
<li>SQL injection attacks</li>
<li>Executable file uploads</li>
<li>Directory traversal attacks</li>
<li>Unsafe character requests</li>
<li>Excessively long requests</li>
<li>PHP remote/file execution</li>
<li>XSS, XXE, and related attacks</li>
<li>Protects against bad bots</li>
<li>Protects against bad referrers</li>
<li>Protects against bad POST content</li>
<li>Protects against many other bad requests</li>
</ul>
<blockquote>
🔥 Works great with <a href="https://wordpress.org/plugins/blackhole-bad-bots/" rel="ugc">Blackhole for Bad Bots</a> and <a href="https://wordpress.org/plugins/banhammer/" rel="ugc">Banhammer</a>
</blockquote>
Awesome Features
BBQ provides all the best firewall features:
<ul>
<li>Rated <a href="https://wordpress.org/plugins/block-bad-queries/#reviews" rel="ugc">5 stars</a> at WordPress.org</li>
<li>100% plug-&-play, zero configuration</li>
<li>100% focused on security and performance</li>
<li>Blocks a wide range of malicious URL requests</li>
<li>Fastest Web Application Firewall (WAF) for WordPress</li>
<li>Based on the <a href="https://perishablepress.com/7g-firewall/" rel="nofollow ugc">7G</a>/<a href="https://perishablepress.com/8g-firewall/" rel="nofollow ugc">8G Firewall</a></li>
<li>Scans all incoming traffic and blocks bad requests</li>
<li>Scans all types of requests: GET, POST, PUT, DELETE, etc.</li>
<li>Protects against known bad bots and referrers</li>
<li>Works silently behind the scenes to protect your site</li>
<li>Hassle-free security plugin that’s easy to use</li>
<li>Thoroughly tested, error-free performance</li>
<li>Extremely low rate of false positives</li>
<li>Compatible with other security plugins</li>
<li>Regularly updated and “future proof”</li>
<li>Firewall < 10 kilobytes in size</li>
<li>Lightweight, fast and flexible</li>
</ul>
<blockquote>
🔥 For advanced protection and features, check out <a href="https://plugin-planet.com/bbq-pro/" rel="nofollow ugc">BBQ Pro »</a>
</blockquote>
Exclusive Pro Version Features
<ul>
<li>Customize firewall via plugin settings</li>
<li>Easily add or remove firewall patterns</li>
<li>Easily add Jeff Starr’s <a href="https://perishablepress.com/ultimate-ai-block-list/" rel="nofollow ugc">AI Block List</a></li>
<li>Send Email Alerts for blocked requests</li>
<li>Quickly enable/disable firewall rules</li>
<li>Disable firewall for logged-in users</li>
<li>Block excessively long URI requests</li>
<li>Protect against XML-RPC exploits</li>
<li>Block any individual IP address</li>
<li>Block entire ranges of IP addresses</li>
<li>Protect against user-ID phishing</li>
<li>Redirect all blocked requests</li>
<li>Display a custom “blocked” message</li>
<li>Set your own response status code</li>
<li>Complete inline documentation</li>
<li>Statistics for blocked requests</li>
<li>Tools to reset options and patterns</li>
<li>Import and Export firewall patterns</li>
<li>One-click pattern testing</li>
<li>Whitelist IP addresses</li>
</ul>
..plus everything the free version can do and more.
<blockquote>
🔥 Learn more and <a href="https://plugin-planet.com/bbq-pro/" rel="nofollow ugc">get BBQ Pro »</a>
</blockquote>
Privacy
This plugin does not collect or store any user data. It does not set any cookies, and it does not connect to any third-party locations. Thus, this plugin does not affect user privacy in any way.
BBQ Firewall is developed and maintained by <a href="https://x.com/perishable" rel="nofollow ugc">Jeff Starr</a>, 15-year <a href="https://plugin-planet.com/" rel="nofollow ugc">WordPress developer</a> and <a href="https://books.perishablepress.com/" rel="nofollow ugc">book author</a>.
<blockquote>
🔥 BBQ = Block Bad Queries
</blockquote>
Support development
I develop and maintain this free plugin with love for the WordPress community. To show support, you can <a href="https://monzillamedia.com/donate.html" rel="nofollow ugc">make a donation</a> or purchase one of my books:
<ul>
<li><a href="https://wp-tao.com/" rel="nofollow ugc">The Tao of WordPress</a></li>
<li><a href="https://digwp.com/" rel="nofollow ugc">Digging into WordPress</a></li>
<li><a href="https://htaccessbook.com/" rel="nofollow ugc">.htaccess made easy</a></li>
<li><a href="https://wp-tao.com/wordpress-themes-book/" rel="nofollow ugc">WordPress Themes In Depth</a></li>
<li><a href="https://books.perishablepress.com/downloads/wizards-collection-sql-recipes-wordpress/" rel="nofollow ugc">Wizard’s SQL Recipes for WordPress</a></li>
</ul>
And/or purchase one of my premium WordPress plugins:
<ul>
<li><a href="https://plugin-planet.com/bbq-pro/" rel="nofollow ugc">BBQ Pro</a> – Blazing fast WordPress firewall</li>
<li><a href="https://plugin-planet.com/blackhole-pro/" rel="nofollow ugc">Blackhole Pro</a> – Automatically block bad bots</li>
<li><a href="https://plugin-planet.com/banhammer-pro/" rel="nofollow ugc">Banhammer Pro</a> – Monitor traffic and ban the bad guys</li>
<li><a href="https://plugin-planet.com/ga-google-analytics-pro/" rel="nofollow ugc">GA Google Analytics Pro</a> – Connect WordPress to Google Analytics</li>
<li><a href="https://plugin-planet.com/head-meta-pro/" rel="nofollow ugc">Head Meta Pro</a> – Ultimate Meta Tags for WordPress</li>
<li><a href="https://plugin-planet.com/simple-ajax-chat-pro/" rel="nofollow ugc">Simple Ajax Chat Pro</a> – Unlimited chat rooms</li>
<li><a href="https://plugin-planet.com/usp-pro/" rel="nofollow ugc">USP Pro</a> – Unlimited front-end forms</li>
</ul>
Links, tweets and likes also appreciated. Thank you! 🙂

BBQ Firewall – Fast & Powerful Firewall Security


I have made a living as a WP developer for close to 20 years and have almost seen it all during that time.  I manage a lot of sites for myself and for clients.  This is one of the most useful plugins that I have come across in the security space.



I liked it so much, I sprung for the Pro version which adds a few extra features.



Certainly, you could get by with .htaccess rules (either yourself, or with what Jeff provides), but this makes it much easier to implement.  I really have made use of the adding custom patterns feature, and the tracking of blocked attempts shows that this is very effective.



It's a simple plugin, really, which is what I like most.  As a WP developer, I could have written my own, but for what Jeff charges for the Pro version, it makes more sense to just buy his.



For the clown who rated it 1 star - that guy didn't really have a clue what he was talking about, and appeared to be someone who thinks he knows what he's talking about but doesn't - that's the most dangerous kind of administrator.  Seriously, this is exactly what a WAF is and is supposed to be, and it works great for what it is.  



Yes, there are other means of intrusion, and this plugin doesn't address those - it's not a "end-all-be-all" which is what I like about it.  Those plugins that try to do it all usually end up being complex, bloated, intrusive, and an all-around a pain to work with.  Instead, Jeff has produced a plugin that does one thing and does it perfectly with clean code and very light overhead.


Great lightweight security


After discovering this plugin, I use it all the time for smaller projects and sometimes for larger projects - doesn't seem to add too much overhead but gives great piece of mind. 


Great plugin - very handy.


BBQ is a lightweight plugin, install it and forget it!


Great plugin and fast support

The fastest firewall plugin for WordPress. Protect against a wide range of threats with minimal performance impact.

Iron Security – WordPress Security Plugin vs BBQ Firewall – Fast & Powerful Firewall Security