Terms: https:\/\/www.cloudflare.com\/website-terms\/ \u2014 Privacy: https:\/\/www.cloudflare.com\/privacypolicy\/<\/li>\n<\/ul>\n\n\nRequirements:<\/strong> WordPress 5.8+ and PHP 8.1+. HTTPS is strongly recommended for 2FA and secure sessions.<\/p>\n\n\n- In WordPress, go to Plugins \u2192 Add New<\/strong> and search for \"WPUltimateSecurity\".<\/li>\n
- Click Install Now<\/strong>, then Activate<\/strong>.<\/li>\n
- Open the Ultimate Security<\/strong> menu and follow the setup flow.<\/li>\n<\/ol>\n\n
Quick Start<\/h4>\n\nRecommended first 5 minutes<\/h4>\n\n\n- Enable 2FA<\/strong> for all administrator accounts.<\/li>\n
- Set login attempt limits<\/strong> and a lockout duration.<\/li>\n
- Add CAPTCHA<\/strong> (reCAPTCHA or Cloudflare Turnstile) to the login, registration and comment forms.<\/li>\n
- Set a custom login URL<\/strong> and save it somewhere safe.<\/li>\n
- Review the Security Score<\/strong>, Site Health<\/strong> and Test Mode<\/strong> before enabling stricter rules.<\/li>\n<\/ol>\n\n\n
\nWill this slow down my site?<\/h3><\/dt>\nIt is built to stay lightweight \u2014 security checks run on login and form submission, not on every page view.<\/p><\/dd>\n
Do I need any technical or coding knowledge?<\/h3><\/dt>\nNo. Defaults are safe out of the box and every setting is in plain English with a guided setup flow.<\/p><\/dd>\n
I enabled 2FA \/ a custom login URL and locked myself out. How do I get back in?<\/h3><\/dt>\nDisable the plugin to restore default login: via FTP\/SFTP rename the folder \/wp-content\/plugins\/ultimate-security<\/code>, or over SSH\/WP-CLI run wp plugin deactivate ultimate-security<\/code>. Then log in and reconfigure.<\/p><\/dd>\nDoes it work with WooCommerce?<\/h3><\/dt>\nCAPTCHA and login protection cover WooCommerce login and registration forms where enabled. Checkout CAPTCHA is not currently part of the verified free feature set.<\/p><\/dd>\n
Does it work on WordPress Multisite?<\/h3><\/dt>\nYes, it runs on Multisite. Network-wide behaviour depends on how you configure it per site.<\/p><\/dd>\n
Does the custom login URL work with caching \/ CDNs?<\/h3><\/dt>\nYes. Exclude the login path from full-page caching (most caching plugins do this for login\/admin automatically) so the secret URL is never served from cache.<\/p><\/dd>\n
Will it conflict with other security or CAPTCHA plugins?<\/h3><\/dt>\nIt can if two plugins do the same job. Pick one plugin per function (one 2FA, one CAPTCHA, one login limiter) and disable the overlapping feature in the other.<\/p><\/dd>\n
Is my data private? Does the plugin track me or phone home?<\/h3><\/dt>\nNo telemetry, no tracking, no usage data collection. It only contacts third-party services you explicitly enable (see External Services below).<\/p><\/dd>\n
Is it GDPR-friendly?<\/h3><\/dt>\nYes. The plugin is self-hosted and stores its data in your own database. The only outbound calls are the optional services you turn on (reCAPTCHA, Turnstile, WordPress.org salt API).<\/p><\/dd>\n
What happens to my data when I uninstall?<\/h3><\/dt>\nYou control whether plugin data is removed on uninstall via the plugin's settings.<\/p><\/dd>\n
What is the difference between Free and Pro?<\/h3><\/dt>\nFree covers core protection: Email\/App 2FA, brute-force lockout, CAPTCHA, custom login URL, password policies, session limits, manual salt rotation, update controls, basic Security Score, Cloudflare WAF rules, Site Health, Test Mode and backup\/restore. Pro adds will add more advanced security features once it is released.<\/p><\/dd>\n
How do I get support?<\/h3><\/dt>\nUse the plugin support forum on WordPress.org, or visit https:\/\/www.wpultimatesecurity.com.<\/p><\/dd>\n\n<\/dl>\n\n\n
1.0.20<\/h4>\n\n\n- New: Improved Session Management settings including concurrent login limits, session cookie hardening and more,<\/li>\n
- New: Cloudflare Turnstile and reCAPTCHA CAPTCHA verifcation when applying their respective keys.<\/li>\n
- Improvement: Cloudflare WAF rules function improvement.<\/li>\n
- Improvement: Code optimization and performance improvements.<\/li>\n<\/ul>\n\n
1.0.19<\/h4>\n\n\n- Fix: 2FA User role was not working properly.<\/li>\n
- Fix: Login activity dashboard modal was showing wrong agent.<\/li>\n
- Improvement: Better user friendly Server Protection Card Design<\/li>\n
- Improvement: Code cleanup and optimization.<\/li>\n<\/ul>\n\n
1.0.18<\/h4>\n\n\n- New: One-click Cloudflare WAF rules apply<\/li>\n
- New: New Modal for Login activity with detailed information.<\/li>\n
- Improvement: Code cleanup and optimization<\/li>\n
- Fix: Login redirected URL was showing exisiting login for password reset<\/li>\n<\/ul>\n\n
1.0.17<\/h4>\n\n\n- Fix: Minor bug fixes and stability improvements<\/li>\n
- Improvement: Code cleanup and optimization<\/li>\n<\/ul>\n\n
1.0.16<\/h4>\n\n\n- Improvement: Code improvements to the ovearll plugin making it snappier.<\/li>\n<\/ul>\n\n
1.0.15<\/h4>\n\n\n- Improvement: Conflict management between applied settings.<\/li>\n
- Improvement: UI improvements to existing settings pages. Making it more intuitive to use.<\/li>\n
- Fix: Multiple bug fixes to dashboard. You should get more accurate results now.<\/li>\n
- Fix: New deactivation URL was not saving after deactiviting-activating plugin.<\/li>\n<\/ul>\n\n
1.0.14<\/h4>\n\n\n- Fix: Email 2FA codes were not being sent properly<\/li>\n
- Fix: 2FA code page flickering effect after login<\/li>\n<\/ul>\n\n
1.0.13<\/h4>\n\n\n- New: Completely redesigned user interface for better usability<\/li>\n<\/ul>\n\n
1.0.12<\/h4>\n\n\n- New: Security Score meter to track your site's security level<\/li>\n
- Improvement: Enhanced modal design for better UI\/UX<\/li>\n<\/ul>\n\n
1.0.11<\/h4>\n\n\n- Fix: Minor UI bug fixes<\/li>\n<\/ul>\n\n
1.0.10<\/h4>\n\n\n- Security: Removed unauthenticated AJAX actions<\/li>\n
- Security: REST routes now require admin permission<\/li>\n<\/ul>\n\n
1.0.9<\/h4>\n\n\n- Fix: Dashboard emergency deactivation URL display issue<\/li>\n<\/ul>\n\n
1.0.8<\/h4>\n\n\n- Improvement: Human-readable values in activity log<\/li>\n
- Improvement: Reduced plugin size with optimized code<\/li>\n
- Fix: 2FA reset issue for users<\/li>\n
- Fix: Password policy not applying to new users<\/li>\n<\/ul>\n\n
1.0.7<\/h4>\n\n\n- New: Activity Log feature<\/li>\n
- New: Improved dashboard design<\/li>\n
- Fix: Nonce validation issues<\/li>\n
- Fix: Turnstile not showing on comment forms<\/li>\n<\/ul>\n\n
1.0.6<\/h4>\n\n\n- Fix: Custom login setup issues<\/li>\n
- Fix: Email 2FA asking for OTP twice<\/li>\n
- Fix: Feedback form email delivery<\/li>\n
- Improvement: Reorganized menu navigation<\/li>\n
- Improvement: Performance optimizations<\/li>\n<\/ul>\n\n
1.0.5<\/h4>\n\n\n- Fix: Request logs page display issue<\/li>\n
- Fix: URL Guard SQL query display<\/li>\n
- Improvement: Performance optimizations<\/li>\n<\/ul>\n\n
1.0.4<\/h4>\n\n\n- Redesigned settings page interface<\/li>\n<\/ul>","raw_excerpt":"Block hackers, bots and brute-force attacks with 2FA, CAPTCHA, login protection, session controls, security tools and more.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/cn.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/222131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cn.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/cn.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/cn.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=222131"}],"author":[{"embeddable":true,"href":"https:\/\/cn.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/wpultimatesecurity"}],"wp:attachment":[{"href":"https:\/\/cn.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=222131"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/cn.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=222131"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/cn.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=222131"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/cn.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=222131"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/cn.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=222131"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/cn.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=222131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}