ProgrammeLab

WP Ultimate Security

<p>Ultimate Security protects your WordPress site from brute force attacks, unauthorized access, and bots. Lightweight, modular, and privacy-focused.</p>
<p>Check out the documentation for this plugin from here</p>
<p>Link: <a href="https://docs.wpultimatesecurity.com/docs/" rel="nofollow ugc">Visit Documentation Site</a></p>
<h4>Key Features</h4>
<p><strong>Two-Factor Authentication</strong><br />
* Email OTP verification<br />
* Google Authenticator, Authy, Microsoft Authenticator (TOTP/HOTP)<br />
* 2FA status dashboard</p>
<p><strong>Login Protection</strong><br />
* Custom login URL (hide wp-admin)<br />
* Login attempt limits<br />
* Password policy enforcement<br />
* Session management</p>
<p><strong>Bot Protection</strong><br />
* Google reCAPTCHA v2/v3<br />
* Cloudflare Turnstile<br />
* Protect login, registration, comments, WooCommerce</p>
<p><strong>Security Hardening</strong><br />
* Security keys rotation<br />
* Auto-update controls<br />
* Site health monitoring</p>
<p><strong>Content Protection</strong><br />
* Right-click disable<br />
* Text selection control<br />
* Image drag prevention</p>
<p><strong>Tools</strong><br />
* Security Score dashboard<br />
* Settings backup/restore<br />
* Test mode for previewing rules</p>
<h3>External Services</h3>
<p>This plugin connects to external services:</p>
<h4>Cloudflare Turnstile</h4>
<ul>
<li>When: Turnstile CAPTCHA enabled</li>
<li>Sends: Response token, site secret key</li>
<li>URL: https://challenges.cloudflare.com/turnstile/v0/siteverify</li>
<li>Privacy: https://www.cloudflare.com/privacypolicy/</li>
</ul>
<h4>Google reCAPTCHA</h4>
<ul>
<li>When: reCAPTCHA enabled</li>
<li>Sends: Response token, site secret key</li>
<li>URL: https://www.google.com/recaptcha/api/siteverify</li>
<li>Privacy: https://policies.google.com/privacy</li>
</ul>
<h4>WordPress.org Salt API</h4>
<ul>
<li>When: Security keys rotation requested</li>
<li>Sends: Request for random salt strings</li>
<li>URL: https://api.wordpress.org/secret-key/1.1/salt/</li>
</ul>


Ultimate Security – Login Protection, 2FA, CAPTCHA & Hardening

Protect your WordPress site with 2FA, brute force protection, CAPTCHA, custom login URL, and security hardening.

Oliver Campion

<h4>Block Access to wp-login.php</h4>
<p>This plugin does the following:</p>
<ul>
<li>Locates wp-login.php in your WordPress installation and duplicates it</li>
<li>Locates .htaccess and inserts lines to block the default wp-login.php and creates a new secret address to use for legitimate login</li>
<li>Will email the site admin if an administrator signs in with an un-recognised IP address</li>
</ul>
<p>When installed your server will return “403 Forbidden“ when attempts are made to access the default wp-login.php file. This has two benefits; it prevents hackers from using brute force methods to hack your website and it reduces the load on the server when such brute force attacks are launched on your site as WordPress isn’t run at all.</p>
<p>Please note, this plugin uses .htaccess so is only compatible with Apache web servers, it is not compatible with Nginx web servers.</p>


Block wp-login

This plugin completely blocks access to wp-login.php and creates a new secret login URL

Ultimate Security – Login Protection, 2FA, CAPTCHA & Hardening vs Block wp-login