New from Kodezen . Free on WordPress.org
WordPress security that Protects what you’ve built
Firewall, malware scanning, login protection and two‑factor in one fast dashboard. Switch on only the modules you need. The rest load no code at all.
Open source (GPL-3.0+) · WordPress 6.4+ · PHP 7.4+ · No account needed
Everything that keeps a site safe, in one dashboard
23 modules across four protection areas. Each one has its own switch, its own help guide.
Firewall
2FA
Scanner
Features
46
across 4 areas
At a glance
Modules
Switch each one on or off
CAPTCHA providers
Keys tested before going live
Sign-in methods
2FA, social and magic link
Alert channels
Five things people
notice first
23 modules across four protection areas. Each one has its own switch, its own help guide.
Stops bad requests first
WAF rules, IP lists, rate limits and bot control block attacks before WordPress answers.
Finds what does not belong
Foreign files, vulnerable plugins and hidden code, grouped by what they mean with a clear action on each.
Tests keys before going live
reCAPTCHA, hCaptcha or Turnstile, with a live login preview.
Removes rogue admins
An approved admin list, hidden-admin detection and an owner email.
Every event, searchable
Severity, user, IP and time on each row. Export to CSV.
A rough admin,
gone in a second
A real entry from the activity log. Someone created an administrator that was not on the approved list.
Activity log
An account appears
A new user is created with the administrator role.
Admin Guard checks
The email is not on the approved list, so the account is removed.
rogue_admin_deleted
Four layers.
One dashboard.
An attack meets each layer in this order. Each one works alone and gets stronger with the next.
Build for real site owners,
not
security experts
A first-run setup wizard and a help guide on every page. Turn on an area and it explains itself.
Stop bad requests before WordPress answers
Block bad requests, bots and spam before WordPress answers, and close the doors attackers probe first.
Strong sign-in, with the guardrails around it
Lockouts, two-factor, CAPTCHA and passwordless sign-in, plus Admin Guard watching who holds the keys.
Find what should not be there, and what changed
Integrity checks, vulnerability lookups and a file watcher, grouped by what each finding means.
46 features,
every one with
a real screen
Pick an area to see what is inside. Pro features are marked.
Web Application Firewall
Inspect requests for SQL injection, XSS, file inclusion and code-execution patterns.
IP blocklist and safelist
Block single IPs and CIDR ranges.
Rate limiting and 404 throttle
Slow down request floods and scanners that hammer missing pages, per IP.
Bot control
Block known bad scanners, empty user agents and AI crawlers.
Anti-spam
Silent bot checks, CAPTCHA on comments, heuristic scoring.
Real visitor IP detection
Forwarding headers are trusted only behind Cloudflare or a proxy you list.
Web Application Firewall
Inspect requests for SQL injection, XSS, file inclusion and code-execution patterns.
IP blocklist and safelist
Block single IPs and CIDR ranges.
Rate limiting and 404 throttle
Slow down request floods and scanners that hammer missing pages, per IP.
Bot control
Block known bad scanners, empty user agents and AI crawlers.
Anti-spam
Silent bot checks, CAPTCHA on comments, heuristic scoring.
Real visitor IP detection
Forwarding headers are trusted only behind Cloudflare or a proxy you list.
Web Application Firewall
Inspect requests for SQL injection, XSS, file inclusion and code-execution patterns.
IP blocklist and safelist
Block single IPs and CIDR ranges.
Rate limiting and 404 throttle
Slow down request floods and scanners that hammer missing pages, per IP.
Bot control
Block known bad scanners, empty user agents and AI crawlers.
Anti-spam
Silent bot checks, CAPTCHA on comments, heuristic scoring.
Real visitor IP detection
Forwarding headers are trusted only behind Cloudflare or a proxy you list.
Web Application Firewall
Inspect requests for SQL injection, XSS, file inclusion and code-execution patterns.
IP blocklist and safelist
Block single IPs and CIDR ranges.
Rate limiting and 404 throttle
Slow down request floods and scanners that hammer missing pages, per IP.
Bot control
Block known bad scanners, empty user agents and AI crawlers.
Anti-spam
Silent bot checks, CAPTCHA on comments, heuristic scoring.
Real visitor IP detection
Forwarding headers are trusted only behind Cloudflare or a proxy you list.
Made for sites that can’t
afford day.
Agencies and freelancers
Export one configuration, import it on every client site, and get alerts in the channel your team already watches.
Online stores
Guard logins and checkout pages against bots and tampering.
Membership and course sites
Give members easy sign-in and protect the accounts that matter.
Publishers and blogs
Keep spam out and catch injected code before readers do.
Start free when need it.
Every paid plan includes every Pro feature. Plans differ only by the number of sites.
Free
The essentials, no account needed. Any number of sites.
$0
forever
What’s included
Business
Active threat defence, malware clean-up and monitoring for up to 5 sites.
$99
per year
$19.80 per site
Everything in Free, plus
Billed yearly. Checkout on the Kodezen store. Refund
policy
More sites
Running more than 25 sites? We will help you find the right licence.
Let’s talk
Good to know
Free
The essentials, no account needed. Any number of sites.
$0
forever
What’s included
Business
Active threat defence, malware clean-up and monitoring for up to 5 sites.
$99
per year
$19.80 per site
Everything in Free, plus
Billed yearly. Checkout on the Kodezen store. Refund
policy
More sites
Running more than 25 sites? We will help you find the right licence.
Let’s talk
Good to know
Free
The essentials, no account needed. Any number of sites.
$0
forever
What’s included
Business
Active threat defence, malware clean-up and monitoring for up to 5 sites.
$99
per year
$19.80 per site
Everything in Free, plus
Billed yearly. Checkout on the Kodezen store. Refund
policy
More sites
Running more than 25 sites? We will help you find the right licence.
Let’s talk
Good to know
Have Question?
answered
What site owners ask before they switch a security plugin on.
Still have a question?
Can’t find what you are looking for? Our support team answers real questions from real site.
Will the firewall lock me out?
No. Logged-in administrators are never blocked by the IP blocklist or auto-bans, your own IP is refused in the blocklist, and aggressive options.
Does it work without a paid plan?
Lorem ipsum dolor sinonet amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
What does turning a module off do?
Lorem ipsum dolor sinonet amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
Does it send data off my site?
Lorem ipsum dolor sinonet amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
Does it support WordPress multisite?
Lorem ipsum dolor sinonet amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
What do I need to run it?
Lorem ipsum dolor sinonet amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
Protect your site in
a few minutes
Install the free plugin, run the setup wizard and switch on the modules you want.