WordPress login security, without a firewall in the way.
A WordPress security plugin should start with the login: two-factor or passkeys for every administrator, a limit on repeated failed attempts, and an alert when something you’ve installed has a known vulnerability. A firewall is a separate job, and it’s worth knowing what it does before you choose.
Security² is the light security plugin we’re planning, with passkeys on the WordPress login as its headline. We’re building it next, and it’s not available yet.
- Planned
- Wordfence, Solid Security
- None yet
- WordPress.org
Out of the box, WordPress signs people in with a username and a password. Anyone who has an administrator’s password has the site. These are the usual ways to close that gap.
Two-factor authentication (2FA)
After the password, the login asks for a six-digit code from an authenticator app on the person’s phone. The code changes every 30 seconds, so a leaked password on its own isn’t enough.
Passkeys
A passkey replaces the password with a key kept on the person’s phone or computer, unlocked with a fingerprint, face or device PIN. A passkey only works on the site it was made for, so a lookalike login page can’t collect it, and there’s no password to reuse or guess.
Login limits
Rate limiting slows or blocks repeated failed logins from the same place, which stops automated password guessing from running freely.
A custom login URL
Moving the login page away from /wp-login.php cuts down the bot traffic that hits it. It reduces noise; it isn’t protection on its own, so treat it as an extra, not a replacement for the three above.
Is there a 2FA plugin for WordPress?
Yes, several. Wordfence’s free plugin lists passkeys and two-factor authentication in its WordPress.org description, and Kadence Security (formerly Solid Security) lists two-factor authentication (both checked 25 October 2026). Security² will offer both.
A web application firewall (WAF) inspects requests to your site and blocks ones that match known attack patterns. A firewall inside a WordPress plugin runs on your own server, so it works on requests that have already reached it. It is only as good as its rules: Wordfence’s WordPress.org description says its free version receives new firewall rules and malware signatures 30 days after its paid customers (checked 25 October 2026).
A firewall doesn’t replace a strong login, and it doesn’t update an out-of-date plugin for you. Blocking traffic before it reaches your server at all is a job for your host or a network service in front of the site, not for a WordPress plugin.
Security² won’t include a firewall. If you want one, keep the one you have or use your host’s; Security²’s login protection, checks and alerts are meant to sit alongside it.
- Passkeys on the wp-admin login.
- Two-factor authentication with an authenticator app (TOTP), and passkeys.
- Rate limiting on failed logins.
- An optional custom login URL.
- One-click hardening switches.
- Integrity checks that compare WordPress core and plugin files with the official checksums.
- Alerts when an installed plugin, theme or WordPress version has a known vulnerability.
- An activity log.
None of it puts a filter in front of every request to your pages. That’s what we expect to keep it light, and like every ² plugin it will be benchmarked and the results published before we say so.
- No firewall. It won’t inspect or block ordinary requests to your pages.
- No full-filesystem malware scans. The integrity checks compare core and plugin files with WordPress.org’s checksums; they aren’t a malware scanner.
- No malware cleanup service. If a site has been hacked, you’ll need your host or a cleanup specialist.
- No automatic patching. A vulnerability alert tells you something needs updating; you, or your auto-updates, still do the update.
- No guarantee. No plugin can promise a site won’t be compromised, and we won’t claim Security² does.
Wordfence has 5 million+ active installs on WordPress.org and is the larger product: a firewall, a malware scanner and login security in one. Wordfence’s plans page lists Premium at $149 a year (checked 25 October 2026), and its free version gets new firewall rules and malware signatures 30 days late, as above.
Solid Security has been rebranded. Its changelog for version 10.0.0 reads “Updated branding from SolidWP to Kadence”, and its WordPress.org listing is now titled Kadence Security, with 700,000+ active installs (checked 25 October 2026). If you’re reviewing your security plugin because of the change, this is a good time to check what you actually use it for.
If what you mainly use is the login protection, Security² is meant to be the lighter alternative, with a free version that is complete. If you rely on a firewall or malware scanning, stay where you are or pair Security² with your host’s protection.
Security² will be sold the way Calendar² is: a free plugin on WordPress.org that does the job properly, and a Pro licence for the extras some sites need. There’s no price yet, and we won’t publish one until there is something to buy.
- You pay for the licence and nothing else: no commission, no paid support tier.
- No upsell banners or “Powered by” credits in your dashboard or on your site.
- The free version is complete. Pro adds features; it doesn’t unlock the ones every site needs.
- It will be benchmarked against Wordfence, and the method published with the results so you can repeat it.
Read the licensing rules we hold every ² plugin to.
- Features: our Security² scope, decided 17 October 2026. Plans can change before release; this page will change with them.
- Wordfence’s features, free-version delay and installs: wordpress.org, WordPress.org, version 9.0.2, checked 25 October 2026.
- Wordfence Premium price: lp.wordfence.com, Wordfence’s plans page, checked 25 October 2026.
- Kadence Security (formerly Solid Security): wordpress.org, WordPress.org, version 10.0.6, checked 25 October 2026.
- The rebrand from SolidWP to Kadence: docs.nexcess.com, its changelog, version 10.0.0, checked 25 October 2026.
Want to know when Security² is out?
Email us and we’ll tell you when Security² is out. Tell us what you use your current security plugin for, and it will shape what we build first.