Security that stays out of your way.
Pure Security closes the doors attackers try first — password-guessing bots, the built-in file editor, XML-RPC abuse and missing security headers. One light plugin, safe defaults, done in two minutes.
v[1.0.0] · WordPress [6.0]+ · PHP [7.4]+ · Free on WordPress.org
Six protections that cover the common attacks.
Most hacked WordPress sites fall to the same few tricks. Pure Security blocks them at the source, without slowing your site or filling your dashboard with alerts.
Limit login attempts
Locks out an IP after repeated failed logins, so bots can't keep guessing passwords. You set the tries and the lockout time.
Disable file editing
Removes the theme and plugin code editor from wp-admin, so a stolen login can't be used to inject malicious code.
Disable XML-RPC
Shuts down xmlrpc.php, the old endpoint attackers use for amplified brute-force and pingback attacks.
Security HTTP headers
Adds X-Frame-Options, X-Content-Type-Options, Referrer-Policy and more to guard against clickjacking and sniffing — no .htaccess edits.
Custom login URL
Move wp-login.php to an address only you know. Bots hitting the default login page find nothing to attack.
Block user enumeration
Stops ?author= scans and REST API lookups that reveal your usernames — half of every login a bot needs.
Start free today. Pro is on the way.
The free plugin protects your site on its own, right now. Pro — coming soon — will hide your login page and your usernames for sites that want a tighter lock.
Free
For every WordPress site
- Limit login attempts
- Disable file editing
- Disable XML-RPC
- Security HTTP headers
- Custom login URL
- Block user enumeration
Pro
For business sites and client work — in development
- Everything in Free
- Custom login URL
- Block user enumeration
- Priority email support
- Early-access launch price
- More Pro features as they ship
Free forever on WordPress.org · No spam, one email when Pro launches · Questions? Contact support