Free WordPress Security Plugin with Firewall and Login Lockout

Security Scanner & Firewall is a free WordPress security plugin that covers the basics most sites need: it stops password guessing, blocks obvious attack probes, checks your WordPress core files against the official checksums and lets you switch on common hardening settings. Every feature is off until you turn it on, so nothing changes on your site by surprise.

It runs entirely on your own server. There’s no cloud dashboard, no account and no license key.

Why a lightweight security plugin

Many security plugins add heavy scanning, constant notices and outside services. This one keeps to a short list of protections that actually matter for a typical WordPress site, and it tells you plainly what each switch does. You stay in control, and you can see what’s happening in the activity log.

Who Security Scanner & Firewall is for

• Small business sites that want login protection without a heavy suite
• Bloggers who keep seeing failed login attempts in their logs
• Agencies setting up a sensible security baseline on client sites

What’s included in the free version

• Login lockout: counts failed logins per IP address and locks the address out after a set number of failures, with defaults of 5 failures in 15 minutes and a 30-minute lockout.
• Covers every login path: the login form, XML-RPC and application passwords. A locked-out address can’t get in even with the right password.
• Unlock from the dashboard: locked-out addresses are listed with an Unlock button, and an optional email tells you when a lockout happens.
• Lite request firewall: blocks obvious SQL injection, script injection and path traversal probes in page addresses and query strings with a 403 page.
• No false alarms for editors: logged-in administrators and editors aren’t checked, and comment or contact form content isn’t filtered.
• XML-RPC switch and login rate limit: turn XML-RPC off completely and cap login form submissions per IP address.
• Core integrity scan: compares every WordPress core file with the official WordPress.org checksums and lists modified, missing or unexpected files. It only reports and never deletes anything.
• Hardening switches: turn off the file editors, limit username discovery and hide the WordPress version.
• Security activity log: a record of lockouts, blocks and scans.

Tips for getting the most from Security Scanner & Firewall

Start with login lockout, since password guessing is the most common attack on WordPress. Then turn on the firewall and the XML-RPC switch if you don’t use the mobile app or remote publishing. Run the integrity scan after every WordPress update and look at anything it lists as modified. If a file you didn’t change shows up, that’s worth checking with your host.

How to install Security Scanner & Firewall

1. Enter your email below to get the download link.
2. In WordPress, go to Plugins → Add New → Upload Plugin and upload the zip.
3. Activate Security Scanner & Firewall.
4. Open Security in your dashboard, switch on login lockout and the firewall, then click Run scan now.

Download Security Scanner & Firewall free

It’s free, with no site account needed. Just enter your email and your download is ready right away.

Upgrade to Pro: 007AJ Security Scanner & Firewall Suite

The free plugin covers what most sites need. When you want more, 007AJ Security Scanner & Firewall Suite adds:

• IP allow and block lists, rate limits and temporary blocks
• Firewall rule categories with custom skip and block paths
• Core file repair with quarantine and undo
• Scheduled scans with an email digest
• File change monitoring and live traffic view

See 007AJ Security Scanner & Firewall Suite

Frequently asked questions

Is this WordPress security plugin really free?

Yes. Login lockout, the lite firewall, the core integrity scan, hardening switches and the activity log are all included at no cost.

Does it contact outside servers?

Only the integrity scan contacts WordPress.org, to download the official core checksums. Nothing is sent to 007AJ.

Will it block my own posts that contain code?

No. Logged-in administrators and editors aren’t checked by the firewall, so writing posts with HTML or code keeps working.

Does it scan plugins and themes for malware?

No. The free scan checks WordPress core files only and doesn’t change or delete anything. It’s not a complete defence, so keep WordPress, themes and plugins up to date.

What do I need to run it?

WordPress 6.3 or newer and PHP 7.4 or newer.

Why do you ask for my email?

It’s how we deliver the free download without making you create an account. We may also send occasional news about this plugin and related tools, and you can unsubscribe at any time.

Can I use it on more than one site?

Yes. Security Scanner & Firewall is licensed under the GPL, so you can install it on as many of your own or your clients’ sites as you like.