The Leading Independent
WordPress Security Plugin.

Fantastic product

Secures your website from malicious attacks. Thanks for this wonderful plugin 🙂

Great plugin!!

Great plugin. Works as advertised and makes life much easier!

The original WordPress Firewall worked very well, but hasn’t been compatible with current versions of WordPress for a long time now. Version 2 introduced more problems than it solved, and isn’t compatible with current WP versions either.

But not so this version. It solves all outstanding compatibility issues, adds some very useful new features (including possibly the best login protection currently available), but is still just as simple to use as the original.

Most other WordPress security solutions are too complex for the average user, and/or cause serious problems of their own. Many are also foils for paid subscriptions. None of that BS here: just good, simple and extremely effective protection for your WordPress blog.

Back in the day, I used the Limit Login Attempts plugin and Firewall 2. None of the sites I had running these two plugins ever got hacked because Firewall 2 really did a great job at blocking bad URL requests.

I was so happy to find WordPress Simple Firewall, because it is an upgrade of the old Firewall 2 plugin with the limit login cool down built in. It also does other great things which are so helpful to security:

1 – Several options for two-factor authentication. This is critical because if the worst case happens (i.e. someone gets your login creds), they won’t be able to login because they’ll be missing the second factor for authentication.

2 – A firewall that actually works. It doesn’t “throttle” bad bot requests, it stops them in their tracks.

3 – Other lock down options.

4 – Site audit trail.

5 – Automatic short-term blocking of IPs making too many bad requests.

It’s lightweight, well maintained, and thoughtful.

Other plugins focus on aspects of security that are not that practical or helpful, such as obscurity tactics, blocking IP addresses or countries, writing a bunch of .htaccess files that can break your site.

People often use features with other plugins that won’t actually do anything for your security. Some plugins aren’t really meant as security plugins so much as scanning tools. Others have so many options, users implement all the unhelpful ones and not the ones that matters.

This plugin is simple, and iControlWP has a great blog about everything you could wonder about in relation to the plugin’s features, so you can educate yourself and your clients if you build sites for others. And, best of all, it won’t break your site!

I use this on multiple sites for my friends and family and it works, I don’t have a need to change most of the settings so there’s far more to customise should one want to, but the “out of the box” option works great for simple sites.

I’ve been using it for years and have always found it to be solid and helpful. It’s one of the very first things I install on any WordPress installation I do. I’m using some but not all of the features.

The only thing I’d like to see added is some level of logging/reporting other than the email messages (which I actually just auto-filter into a folder), but I can also see how having the firewall log into the database could allow a “fill the logs” denial of service. Maybe something simple like a per-day numerical count of attacks by type (e.g. “SQL Injections”, “WP Keywords”, etc.). Right now it suffers the problem of many working security solutions – it’s hard to see that it’s doing anything unless you’re looking at the firehose of email notifications.