# WP Security Ninja - full corpus > Generated from official markdown sources. Publisher: Larsik Corp. This file concatenates curated product, feature, docs, dictionary, and guide pages referenced from [llms.txt](https://wpsecurityninja.com/llms.txt). It is not a dump of the entire blog. --- ## About, history & future of Security Ninja ## Getting set up The [install wizard](/install-wizard/) gets the basics on, and import/export helps if you manage more than one site. Prefer reading first? There are [150+ docs](/docs/), including help from inside the plugin. On licenses with 25 or more sites, [white label](/whitelabel/) lets agencies brand the plugin for client work. The plugin is maintained and sold by [Larsik Corp](https://larsik.com/). See what we are building next on the [roadmap](/roadmap/). ## The history of Security Ninja Security Ninja celebrated its tenth birthday in 2021. In *internet years* that is a lot. Time flies, and at some point you realize it has been longer than it feels. Through the years what kept us going was the fact that people used it. Security Ninja kept sites safe, users informed, and us happy. We hope that will continue for another ten years, at least. Till then, here is a short history of Security Ninja's birth and growth. For what shipped after this origin story, see the live [changelog](/changelog/) and the year archives below. * **Early summer 2011** Security Ninja (it was called "Site Security Tester" in that first version) was made as an internal tool, used for testing the most common security issues on clients' sites. It had barely ten tests, but we installed it on every site to quickly check things we knew needed checking. * **September 27th, 2011** Security Ninja went live for sale on CodeCanyon! For a disturbingly low $8 you could have bought a lifetime license for unlimited sites. Not a very wise business decision, we know. But those were the prices back in the day. * **December 31st, 2011** After three months Security Ninja already racked 318 sales and was featured on CodeCanyon. Wayback machine has a [snapshot](https://web.archive.org/web/20111231031336/http://codecanyon.net:80/item/security-ninja/577696). The price was increased to a whopping $10. * **August 31st, 2012** Core Scanner add-on is released! First add-on in the series of four (on CC) for $6. Sales are still going strong; we're at 823. Which means Security Ninja sales almost 3 copies a day. From the initial ten tests, it's grown to 26. * **December 2nd, 2012** Security Ninja Lite added to the WordPress repository as a free plugin. This was the only terrible move we ever did with Security Ninja. It turns out nobody wants to use a "lite" version of a plugin. It never got any traction. * **December 23rd, 2012** Scheduled Scanner is released! For $6 you can automatically run Security Ninja and core scanner add-on tests. Security Ninja passed 1,100 sales and Core Scanner 150. * **August 9th, 2014** Third add-on released - Events Logger. Security Ninja is already a reputable brand and sales are still going strong. * **September 17th, 2014** To make purchasing more accessible, we created the Security Ninja Bundle. A package with all the add-ons and the main plugin. By this time Security Ninja has 2,500+ sales and Core Scanner 1,000+. * **March 5th, 2015** Fourth and last add-on on CodeCanyon released - Malware Scanner. Although the sales are still solid, the overall traffic and visibility on CodeCanyon is dropping significantly. * **August 30th, 2016** We pulled the trigger! Security Ninja is no longer available on CodeCanyon and the main module is now free and available on the [WordPress repository](https://wordpress.org/plugins/security-ninja/). All add-ons have been packed into one plugin - Security Ninja PRO which we're selling on our own. Technically we're utilizing the freemium but most sales come from the website, not from the free version. * **September 16th, 2016** Although we've started removing other plugins from CodeCanyon too, we've decided to put Security Ninja PRO back on it. But on our non-exclusive account since we're now selling SN on our own. No sales were expected and (almost) none were made. The move was made only for marketing benefits. * **April 9th, 2017** New module (ex add-on) - Auto Fixer. Nobody wants to mess with code if they can click one "fix" button, right? New tests are continuously added to the main module - we're now at 50+. After moving from CodeCanyon we lost a lot of traffic, but sales are still going strong. * **December 7th, 2017** After asking users what functionality is missing in Security Ninja PRO, we created the Database Optimizer module. A one-click solution to all database speed and maintenance problems. * **April 5th, 2018** Cloud Firewall is released! Ban 600 million bad IPs with one click and protect your login from brute-force attacks. ### Release notes by year The origin timeline above stops in 2018. Everything since then lives in the release notes. * [Current changelog](/changelog/) * [2025](/changelog/2025/) * [2024](/changelog/2024/) * [2023](/changelog/2023/) * [2022](/changelog/2022/) * [2021](/changelog/2021/) * [2020](/changelog/2020/) * [2019](/changelog/2019/) * [2018](/changelog/2018/) * [2017](/changelog/2017/) * [2016](/changelog/2016/) * [2011](/changelog/2011/) --- ## WordPress Cloud Firewall --- ## WordPress Malware Scanner --- ## WordPress Login Protection --- ## WordPress Security Tests --- ## WordPress Vulnerability Scanner --- ## 404 Guard for WordPress --- ## AI Security Advisor for WordPress --- ## White Label WordPress Security --- ## Brute force ## Why it matters for WordPress WordPress exposes a public login URL on most sites. Bots can hit `wp-login.php` and `xmlrpc.php` all day with stolen or guessed passwords. One weak admin password is enough. ## How it shows up in practice - Sudden spikes of failed logins from many IPs - Lockouts or “too many attempts” messages for real users - Successful login from an unfamiliar country right after a wave of failures - Abuse of XML-RPC multicall to try many passwords in one request ## What to do 1. Use unique, long passwords (a password manager helps). 2. Turn on two-factor authentication for admins and editors. 3. Limit login attempts and block noisy IPs. 4. Disable or tightly restrict XML-RPC if you do not need it. 5. Watch the events log for new admin users and plugin installs after any suspected breach. Product tip: login rate limits and related controls live under [login protection](/login-protection/). --- ## WordPress WAF ## Why it matters for WordPress A WordPress-oriented WAF sits in front of (or inside) the site and stops noisy exploit probes, bad bots, and known attack patterns. It is not a substitute for updates, but it buys time and reduces drive-by noise. ## How it shows up in practice - Blocked requests in a firewall log - Country or IP rules - Rules targeting login abuse, scanners, or injection patterns ## What to do 1. Enable a WAF suited to WordPress traffic, not only a generic “block China” toggle. 2. Review false positives so real users and webhooks are not blocked. 3. Combine with patching; a WAF does not fix a known vulnerable plugin forever. 4. Watch logs after big news CVEs when exploit traffic spikes. Feature: [Cloud Firewall](/cloud-firewall/). Guide: [WordPress firewalls](/what-you-should-know-about-wordpress-firewalls/). --- ## Malware ## Why it matters for WordPress Infected sites lose trust, get blacklisted, and can infect visitors. Cleanup that only deletes one file often fails because a backdoor puts it back. ## How it shows up in practice - Google Safe Browsing or host notices - Unexpected redirects, spam SEO pages, or crypto miners - Modified core/theme files or mystery PHP in uploads - New admin users or cron jobs you did not create ## What to do 1. Put the site in maintenance mode and take a backup for forensics. 2. Scan files and compare core against known-good hashes. 3. Remove malware and the access path (weak passwords, vulnerable plugins, backdoors). 4. Rotate all passwords, salts, and API keys. 5. Re-scan after cleanup and watch logs for reinfection. Feature: [Malware scanner](/malware-scanner/). Guide: [WordPress malware removal](/wordpress-malware-removal/). --- ## SQL injection ## Why it matters for WordPress Plugins and custom code that build SQL with raw request data can expose posts, users, or the whole database. On WordPress, that usually means a vulnerable extension, not core itself. ## How it shows up in practice - Odd query strings that dump content or error messages - Unexpected admin users or option changes with no human action in the log - Security scanners flagging a plugin CVE that mentions SQLi ## What to do 1. Keep WordPress, themes, and plugins updated. 2. Remove unused plugins and themes. 3. Prefer well-maintained extensions; check vulnerability databases when a CVE drops. 4. For custom code, use `$wpdb->prepare` and never concatenate untrusted input into SQL. 5. After a suspected SQLi incident, rotate secrets, audit users, and scan files. Full walkthrough: [Understanding SQL injection on WordPress](/what-is-an-sql-injection-attack/). --- ## Two-factor authentication (2FA) ## Why it matters for WordPress Passwords leak. 2FA means the password alone should not open `wp-admin`. It is one of the highest-value controls for site owners and agencies. ## How it shows up in practice - Prompt for an authenticator code after password entry - Recovery codes stored offline for lost devices - Policies that require 2FA for Administrator (and ideally Editor) ## What to do 1. Enable 2FA for all privileged roles. 2. Store recovery codes somewhere safe (not in the same password manager note as the password if you can help it). 3. Prefer app-based TOTP over SMS when you have the choice. 4. Pair 2FA with rate limits so stuffing still costs the attacker time. Feature: [Two-factor authentication](/two-factor-authentication-2fa/). --- ## WP Security Ninja ### Welcome to WP Security Ninja Documentation This documentation provides you with all the necessary information to maximize your use of our plugin, from setup to advanced security measures. If you have questions or need assistance, [our support team is ready to help](/help/). ## [AI Security Advisor](/docs/security-advisor/) 3 * [What happens when you generate a report](/docs/security-advisor/what-happens-when-you-generate-a-report/) * [How to enable AI Security Advisor](/docs/security-advisor/how-to-enable-ai-security-advisor/) * [How to get your first security report](/docs/security-advisor/security-report/) [View all 3 articles](/docs/security-advisor/) ## [Installation and usage](/docs/installation-and-usage/) 18 * [Install Security Ninja](/docs/installation-and-usage/install/) * [Install Pro version](/docs/installation-and-usage/install-pro-version/) * [Installation Wizard](/docs/installation-and-usage/installation-wizard/) * [How to access your website via FTP](/docs/installation-and-usage/how-to-access-your-website-via-ftp/) * [Does Security Ninja Work with WordPress.org?](/docs/installation-and-usage/wordpress-com/) * [How to include custom code on your website](/docs/installation-and-usage/custom-code-website/) * [Remove settings when deactivating](/docs/installation-and-usage/remove-settings-when-deactivating/) * [Dashboard Widget with quick site overview](/docs/installation-and-usage/dashboard-widget-with-quick-site-overview/) * [Last Login](/docs/installation-and-usage/last-login/) * [Activate Default Security Measures](/docs/installation-and-usage/activate-default-security-measures/) * [Data Processing Agreement](/docs/installation-and-usage/data-processing-agreement/) [View all 18 articles](/docs/installation-and-usage/) ## [Firewall](/docs/firewall/) * [How to use the firewall](/docs/firewall/how-to-use-the-firewall/) * [How to get back in to your website](/docs/firewall/how-to-get-back-in-to-your-website/) * [How to restore access without the unblock URL](/docs/firewall/how-to-restore-access-without-the-unblock-url/) * [Block IP Network](/docs/firewall/block-ip-network/) * [Change login URL](/docs/firewall/change-login-url/) * [How to ban subnet mask IP range](/docs/firewall/ban-subnet-mask/) * [Login Form Protection](/docs/firewall/login-form-protection/) * [Whitelisting Services in WP Security Ninja](/docs/firewall/whitelisting-services-in-wp-security-ninja/) * [Secret Access URL](/docs/firewall/secret-access-url/) * [Automatically Validated Crawlers](/docs/firewall/automatically-validated-crawlers/) [View all articles](/docs/firewall/) ## [MainWP](/docs/mainwp/) 9 * [How to Install and Set Up Security Ninja with MainWP](/docs/mainwp/install-security-ninja-mainwp/) * [How to Control White Label Settings Remotely](/docs/mainwp/how-to-control-white-label-settings-remotely/) * [Using Security Ninja tokens in MainWP Pro Reports](/docs/mainwp/using-security-ninja-tokens-in-mainwp-pro-reports/) * [Install the Free MainWP Extension for Security Ninja](/docs/mainwp/install-the-mainwp-extension-for-security-ninja/) * [Get started with Security Ninja and MainWP](/docs/mainwp/get-started-mainwp/) * [How to access Security Ninja in MainWP Dashboard](/docs/mainwp/how-to-access-security-ninja-in-mainwp-dashboard/) * [Bulk Actions in MainWP](/docs/mainwp/bulk-actions-in-mainwp/) * [How to Show/Hide the column](/docs/mainwp/how-to-show-hide-the-column/) * [The Global Event Log](/docs/mainwp/the-global-event-log/) [View all 9 articles](/docs/mainwp/) ## [Vulnerabilities](/docs/vulnerabilities/) * [What does "plugin closed" mean?](/docs/vulnerabilities/plugin-closed/) * [Email Alerts for Detected Vulnerabilities](/docs/vulnerabilities/email-alerts-for-detected-vulnerabilities/) * [How to use the vulnerability scanner](/docs/vulnerabilities/how-to-use-the-vulnerability-scanner/) * [How the vulnerability scanner works](/docs/vulnerabilities/scanner/) * [Dangers of Outdated Plugins](/docs/vulnerabilities/outdated-plugins/) * [What is the outdated.dat file?](/docs/vulnerabilities/what-is-the-outdated-dat-file/) * [Problems with the vulnerability scanner](/docs/vulnerabilities/problems-with-the-vulnerability-scanner/) [View all articles](/docs/vulnerabilities/) ## [Account](/docs/account/) 24 * [My account page](/docs/account/my-account-page/) * [Non-Sensitive Diagnostic Data](/docs/non-sensitive-diagnostic-data/) * [Keeps getting logged out](/docs/account/keeps-getting-logged-out/) * [Cancel subscription](/docs/account/cancel-subscription/) * [Forgotten password](/docs/account/forgotten-password/) * [Change account](/docs/account/change-account/) * [Does the plugin work with WordPress Multisite?](/docs/account/does-the-plugin-work-with-wordpress-multisite/) * [Problems logging in](/docs/account/problems-logging-in/) * [Military and Veteran Discounts](/docs/account/military-and-veteran-discounts/) * [Delete my account](/docs/account/delete-account/) * [Controlling License Usage by Whitelisting Sites](/docs/account/whitelist-sites/) [View all 24 articles](/docs/account/) ## [Security Tests](/docs/security-tests/) 29 * [Security Tests](/docs/security-tests/security-tests/) * [Security Issues were found](/docs/security-tests/security-issues-were-found/) * [Update functions.php](/docs/security-tests/update-functions-php/) * [Fix - temporary folder not writable](/docs/security-tests/fix-temporary-folder-not-writable/) * [Secure or remove readme.html](/docs/security-tests/secure-readme-html/) * [What is the sn-backups folder?](/docs/security-tests/what-is-the-sn-backups-folder/) * [Check if plugins are up to date](/docs/security-tests/check-if-plugins-are-up-to-date/) * [If full WordPress version info is revealed in meta data](/docs/security-tests/if-full-wordpress-version-info-is-revealed-in-meta-data/) * [User “admin” with administrator privileges exists](/docs/security-tests/user-admin-with-administrator-privileges-exists/) * [“Anyone can register” option is enabled](/docs/security-tests/anyone-can-register-option-is-enabled/) * [Unnecessary information on failed login attempts](/docs/security-tests/unnecessary-information-on-failed-login-attempts/) [View all 29 articles](/docs/security-tests/) ## [License](/docs/license/) 12 * [How to change your license key](/docs/license/how-to-change-your-license-key/) * [License activation problems](/docs/license/license-activation-problems/) * [How to upgrade from annual to lifetime license](/docs/license/upgrade-to-lifetime/) * [How to upgrade your license](/docs/license/how-upgrade-license/) * [Can I Resell or Transfer My License?](/docs/license/resell-license/) * [How to use license on another website](/docs/license/remove-website-from-license/) * [License Recovery for Security Ninja](/docs/license/license-recovery/) * [How to renew manually](/docs/license/how-to-renew-manually/) * [How To Renew Your License Early or Apply a Coupon](/docs/license/renew-license-early-coupon/) * [Early License Renewal & Proration](/docs/license/early-license-renewal-proration/) * [Automated License Activation for Multiple Sites - license\_key.txt](/docs/license/automated-license-activation-for-multiple-sites-license-txt/) [View all 12 articles](/docs/license/) ## [Troubleshooting and debugging](/docs/errors-and-debugging/) 18 * [How to locate JavaScript conflicts](/docs/errors-and-debugging/how-to-locate-js-conflicts/) * [How to create an admin account](/docs/errors-and-debugging/how-to-create-an-admin-account/) * [Virus detected in plugin?](/docs/errors-and-debugging/virus-detected-in-plugin/) * [Fix errors showing up frontend](/docs/errors-and-debugging/fix-errors-showing-up-frontend/) * [Debug - Get server and website information](/docs/errors-and-debugging/debug-get-server-and-website-information/) * [How to use WP\_DEBUG](/docs/errors-and-debugging/finding-errors-and-solutions/) * [Jetpack compatibility](/docs/errors-and-debugging/jetpack-compatibility/) * [Many admin-ajax.php requests](/docs/errors-and-debugging/many-admin-ajax-php-requests/) * [Parts of admin load via HTTP](/docs/errors-and-debugging/parts-of-admin-load-via-http/) * [Increase WordPress memory limit](/docs/errors-and-debugging/increase-wordpress-memory-limit/) * [Failed to connect to api.freemius.com](/docs/errors-and-debugging/failed-to-connect-to-api-freemius-com/) [View all 18 articles](/docs/errors-and-debugging/) ## [Filters and hooks](/docs/filters-hooks/) 12 * [securityninja\_whitelist filter](/docs/filters-hooks/securityninja_whitelist/) * [Filter - user\_agent\_items](/docs/filters-hooks/filter-user_agent_items/) * [Filter - securityninja\_visitorlog\_filter\_url](/docs/filters-hooks/filter-securityninja_visitorlog_filter_url/) * [Filter - blocked\_hosts\_items](/docs/filters-hooks/filter-blocked_hosts_items/) * [securityninja\_ignored\_file\_extensions](/docs/filters-hooks/securityninja_ignored_file_extensions/) * [Customizing Firewall Filter Rules](/docs/filters-hooks/customizing-firewall-filter-rules/) * [secnin\_show\_woocommerce\_login\_message](/docs/filters-hooks/secnin_show_woocommerce_login_message/) * [Filter. securityninja\_social\_crawler\_user\_agents](/docs/filters-hooks/filter-securityninja_social_crawler_user_agents/) * [securityninja\_temporary\_login\_params](/docs/filters-hooks/securityninja_temporary_login_params/) * [securityninja\_is\_temporary\_login\_link](/docs/filters-hooks/securityninja_is_temporary_login_link/) * [securityninja\_malware\_exclude\_paths](/docs/filters-hooks/securityninja_malware_exclude_paths/) [View all 12 articles](/docs/filters-hooks/) ## [Visitor Log](/docs/visitor-log/) 2 * [What is the visitor log](/docs/visitor-log/what-is-the-visitor-log/) * [Change how long visitor logs are kept](/docs/visitor-log/change-how-long-visitor-logs-are-kept/) [View all 2 articles](/docs/visitor-log/) ## [Security Fixes](/docs/security-fixes/) 11 * [Security Headers](/docs/security-fixes/security-headers/) * [Secure Cookies](/docs/security-fixes/secure-cookies/) * [Disable plugin & theme editor](/docs/security-fixes/disable-plugin-theme-editor/) * [Disable WP Sitemaps](/docs/security-fixes/disable-wp-sitemaps/) * [Disabling the Application Passwords Feature in WordPress 5.6](/docs/security-fixes/disable-application-passwords/) * [Preventing Username Enumeration on Your WordPress Site](/docs/security-fixes/disable-username-enumeration/) * [Remove unwanted files](/docs/security-fixes/remove-unwanted-files/) * [Hide WP Version](/docs/security-fixes/hide-wp-version/) * [Hide Windows Live Writer - WLW](/docs/security-fixes/hide-windows-live-writer-wlw/) * [Hiding PHP Version by Removing "X-Powered-By" and "Server" Headers](/docs/security-fixes/hide-php-version/) * [Content Security Policy](/docs/security-fixes/content-security-policy/) [View all 11 articles](/docs/security-fixes/) ## [Core Scanner](/docs/core-scanner/) 3 * [Core Scanner](/docs/core-scanner/core-scanner/) * [Scan WordPress](/docs/core-scanner/scan-wordpress/) * [How to ignore files](/docs/core-scanner/how-to-ignore-files/) [View all 3 articles](/docs/core-scanner/) ## [Malware Scanner](/docs/malware-scanner/) 6 * [Malware Scanner](/docs/malware-scanner/malware-scanner/) * [Scan for malware](/docs/malware-scanner/scan-for-malware/) * [False positive results](/docs/malware-scanner/false-positive-results/) * [Whitelist files and folders in Malware Scanner](/docs/malware-scanner/whitelist-files-and-folders-in-malware-scanner/) * [Comprehensive Malware Cleanup Checklist](/docs/malware-scanner/comprehensive-malware-cleanup-checklist/) * [How to exclude paths from the Malware Scanner](/docs/malware-scanner/how-to-exclude-paths-from-the-malware-scanner/) [View all 6 articles](/docs/malware-scanner/) ## [Event Logger](/docs/event-logger/) 6 * [How to use the event logger](/docs/event-logger/how-to-use-the-event-logger/) * [Webhook Events](/docs/event-logger/webhook-events/) * [Automate Alerts: Security Ninja Webhooks via Zapier](/docs/event-logger/integrate-webhooks-with-zapier/) * [Monitoring New Administrator Accounts](/docs/event-logger/monitoring-administrator-accounts/) * [Event Logger Settings](/docs/event-logger/event-logger-settings/) * [How to search and filter events](/docs/event-logger/how-to-search-and-filter-events/) [View all 6 articles](/docs/event-logger/) ## [White label](/docs/whitelabel/) 2 * [What is the White label feature](/docs/whitelabel/custom-name-logo/) * [How to white label the plugin](/docs/whitelabel/how-to-whitelabel-the-plugin/) [View all 2 articles](/docs/whitelabel/) ## [Affiliates](/docs/affiliates/) 3 * [Affiliates](/docs/affiliates/affiliate-program/) * [Known Affiliate Link Issues](/docs/affiliates/known-affiliate-link-issues/) * [Branding assets](/docs/affiliates/branding-assets/) [View all 3 articles](/docs/affiliates/) ## [Scheduled Scanner](/docs/scheduled-scanner/) 2 * [Scheduled Scanner](/docs/scheduled-scanner/scheduled-scanner/) * [Add custom schedule to scanner](/docs/scheduled-scanner/add-custom-schedule-to-scanner/) [View all 2 articles](/docs/scheduled-scanner/) ### Maximizing Your Security with WP Security Ninja As you explore the extensive resources within our documentation, we hope you've found valuable insights and answers to enhance your WordPress site's security. WP Security Ninja is designed to empower you, providing not just tools, but also the knowledge to use them effectively in your quest to protect your site. Security is a journey, not a destination. As WordPress continues to evolve, so do the threats that target it. That’s why we continuously update our plugin and resources to tackle the latest security challenges. Keep your site and your knowledge up to date by revisiting our documentation and utilizing the latest features and best practices provided. #### Engage with Our Community Join the WP Security Ninja community to share experiences, tips, and insights with other WordPress users. Engage with us and the community on social media, forums, and through our support channels. Your feedback not only helps us improve but also shapes the future of WP Security Ninja. #### We're Here to Help If your questions weren't answered in our documentation or you're facing issues that require a more personalized approach, don't hesitate to reach out. Our dedicated support team is ready to assist you with any queries, concerns, or feedback you might have. Contact us through our support page, and let us help you secure your site effectively. #### Stay Updated For the latest updates, security tips, and WP Security Ninja news, subscribe to our newsletter. Stay ahead of threats by being the first to know about our latest features, updates, and best practices. #### Thank You for Trusting WP Security Ninja We appreciate your trust in WP Security Ninja to secure your WordPress site. Our team is committed to providing you with the best tools and support to keep your site safe. Thank you for choosing WP Security Ninja, and here's to a secure online presence! --- ## Firewall Guides for the free 8G request firewall, Pro Cloud Firewall (600M+ bad IPs), login protection, country blocking, and 2FA. * ### [How to use the firewall](/docs/firewall/how-to-use-the-firewall/) * ### [Block IP Network (global bad IPs)](/docs/firewall/block-ip-network/) * ### [8G Firewall Rules](/docs/firewall/8g-firewall-rules/) * ### [How to get back into your website](/docs/firewall/how-to-get-back-in-to-your-website/) * ### [Restore access without the unblock URL](/docs/firewall/how-to-restore-access-without-the-unblock-url/) * ### [Secret Access URL](/docs/firewall/secret-access-url/) * ### [Change login URL](/docs/firewall/change-login-url/) * ### [Login form protection](/docs/firewall/login-form-protection/) * ### [Block or redirect visitors](/docs/firewall/block-or-redirect-visitors/) * ### [How to block a country](/docs/firewall/how-to-block-a-country/) * ### [How to blacklist an IP](/docs/firewall/how-to-blacklist-an-ip/) * ### [Ban subnet / IP range](/docs/firewall/ban-subnet-mask/) * ### [Whitelisting services](/docs/firewall/whitelisting-services-in-wp-security-ninja/) * ### [Automatically validated crawlers](/docs/firewall/automatically-validated-crawlers/) * ### [404 Guard](/docs/firewall/404-guard/) * ### [WooCommerce rate limits & coupon protection](/docs/firewall/woocommerce-rate-coupon-protection/) * ### [Set up 2FA (admin)](/docs/firewall/how-to-set-up-two-factor-authentication-2fa-in-security-ninja/) * ### [Use 2FA (users)](/docs/firewall/setting-up-and-using-two-factor-authentication-2fa-for-users/) * ### [Allow users to bypass 2FA](/docs/firewall/how-to-allow-users-to-bypass-2fa-in-security-ninja/) * ### [Reset 2FA](/docs/firewall/how-to-reset-2fa/) * ### [Cannot import data](/docs/firewall/cannot-import-data/) --- ## Install: Quick Start Guide ## Install the plugin **To install the free plugin from inside WordPress admin. the easiest way** 1. Visit ‘Plugins > Add New’ 2. Search for ‘Security Ninja’ 3. Activate Security Ninja from your Plugins page. ### To install the free or premium plugin manually via FTP 1. Download the latest version from WordPress.org. [https://downloads.wordpress.org/plugin/security-ninja.zip](https://downloads.wordpress.org/plugin/security-ninja.zip) 2. Unpack the.zip file to a folder on your computer. 3. Upload the \`security-ninja\` folder to the \`/wp-content/plugins/\` directory 4. Activate the Security Ninja plugin through the ‘Plugins’ menu in WordPress ### To install the free or premium plugin via “Upload plugin” You can also install the plugin via upload from inside WordPress admin. It requires you have downloaded the free or premium plugin in.zip format locally to your computer. 1. Visit ‘Plugins > Add New’ 2. Choose “Upload plugin” and find the.zip file containing the plugin. 3. Active the Security Ninja plugin ## Activate Pro Version ![Activate Security Ninja Pro from the Plugins page](/media/2019/07/how-to-activate-security-ninja-pro-plugin.webp) After you click activate, you will be asked to enter your license key. ![Enter your license key, includes the “Can’t find your license key?” link](/media/2020/07/enter-license-key.webp) If you cannot locate the license key, please check your email inbox or use the “Can’t find your license key” link right below the License key input field. This will open a small window where you can enter your email to get the license key sent to your inbox. ![Send license key window, enter your email to resend the key](/media/2020/09/resend-license-key.webp) Once you have finished and the license key has been validated you will be directed to the plugin page. ## Upgrading from the old system. Gumroad > If you already had an old version of Security Ninja installed, the plugin will try to detect the license from the old system and automatically create a new license for you, bypassing this screen. If you do see the screen and you need to get a license, here is what you do: 1\. Use the button in the bottom “Activate Free Version.” This will create a license for you, and register your email in the system. 2\. Contact us with a license upgrade request, and we can manually update or create a new license for you to use. Click here: [https://wpsecurityninja.com/help/](/help/) _Important: You have to “Activate Free Version” to create a user in the licensing system before we can create a custom license manually._ * * * ### Activate License If you already installed a Free version you can upgrade the License by going to Security Ninja -> Account and click the Activate License button. ![Account Details, click Activate License](/media/2019/07/activate-license.webp) This will open a popup where you can enter the Pro license key. ![Update License popup with license key field](/media/2020/06/update-license-enter-license-key.webp) --- ## WordPress Security Guide 2026: Where to Start You do not need another 15,000-word “ultimate” guide that repeats the same advice five times. You need a clear order of work and links to guides that already go deep. Use this page as the map. ![WordPress Security Guide](/media/2025/08/WordPress-Security-Guide.webp) ## How to use this hub 1. Start where you are (beginner, hardening, incident, or store) 2. Do the linked guide for that step 3. Come back for the next layer 4. Install tooling that matches the jobs you will actually run Security Ninja covers tests, vulnerability checks, and (on Pro) firewall, malware scanning, and login protection. Details live in the linked feature and comparison posts, not in another pasted essay here. ## 1. Beginners and a working checklist If you are new or inherited a messy site, start here: - [WordPress security beginners guide](/wordpress-security-beginners-guide/) - [WordPress security checklist](/wordpress-security-checklist/) Goal: backups you can restore, updates applied, unused plugins gone, admin accounts under control. ## 2. Best practices and hardening Once the basics are steady, raise the floor: - [WordPress security best practices](/wordpress-security-best-practices/) - [WordPress security hardening guide](/wordpress-security-hardening-guide/) - [Common WordPress security mistakes](/common-wordpress-security-mistakes/) - [Top WordPress security issues](/wordpress-security-issues/) Goal: fewer soft defaults, clearer roles, less unnecessary attack surface. ## 3. Login, passwords, and 2FA Most opportunistic attacks still start at wp-login and weak credentials: - [WordPress login security complete guide](/wordpress-login-security-complete-guide/) - [Two-factor authentication (2FA)](/two-factor-authentication-2fa/) - [Top WordPress passwords](/top-wordpress-passwords/) Goal: strong unique passwords, 2FA on admins, rate limits / lockouts when abuse shows up. ## 4. Firewall and scanners Protection and detection are different jobs. You usually want both: - [WordPress firewall plugins guide](/wordpress-firewall-plugins-guide/) - [WordPress security scanner comparison](/wordpress-security-scanner-comparison/) - [WordPress vulnerabilities hub](/wordpress-vulnerabilities-database/) - Feature pages: [vulnerabilities](/vulnerabilities/), [core scanner](/core-scanner/), [malware scanner](/malware-scanner/), [cloud firewall](/cloud-firewall/) Goal: block known-bad traffic, catch vulnerable versions, notice bad files on a schedule. ## 5. Malware removal and recovery If the site is already weird (spam, redirects, unknown admins, locked hosting): - [Signs your WordPress site is hacked](/signs-wordpress-site-is-hacked/) - [What to do if your WordPress site is hacked](/what-should-you-do-if-your-wordpress-site-is-hacked/) - [WordPress malware removal](/wordpress-malware-removal/) - [Create a backup plan](/create-backup-plan-if-site-gets-attacked/) - [Hire cleanup](/consultation/) when you need hands on the server Goal: contain, clean or restore, rotate credentials, close the entry point, then harden so it does not return. ## 6. WooCommerce and stores Stores add checkout, coupons, and payment noise: - [WooCommerce security guide](/woocommerce-security-guide/) Goal: rate limits where abuse hits, fewer junk plugins, faster response to vuln notices on commerce extensions. ## 7. Free vs Pro and pricing Match spend to jobs: - [Free vs premium security plugins](/free-vs-premium-security-plugins/) - [Best WordPress security plugins](/best-wordpress-security-plugins/) - [Pricing](/pricing/) - Free on [WordPress.org](https://wordpress.org/plugins/security-ninja/) Rough map: Free gets 50+ tests, vulnerability scanning, and core integrity. Pro adds Cloud Firewall (600M+ bad IPs), malware scanning with schedules, login protection and 2FA, WooCommerce limits, and agency-friendly options. ## Suggested order for a healthy site | Stage | Focus | Primary links | | --- | --- | --- | | Week 1 | Checklist, backups, updates | Beginners, checklist | | Week 2 | Login + 2FA | Login guide, 2FA | | Week 3 | Scan + firewall | Scanner comparison, firewall guide | | Ongoing | Patch vulns, review findings | Vulnerabilities hub, best practices | | If hacked | Contain and clean | Malware removal, consultation | ## CMS choice (only if you are deciding platforms) Already on WordPress? Stay and harden. Comparing CMSs for a new project? [Drupal vs WordPress security](/wordpress-vs-drupal/) is a balanced take. Switching platforms just to “feel safer” usually delays the maintenance work that actually matters. ## Related reading - [WordPress security beginners guide](/wordpress-security-beginners-guide/) - [WordPress security checklist](/wordpress-security-checklist/) - [WordPress security hardening guide](/wordpress-security-hardening-guide/) - [WordPress login security guide](/wordpress-login-security-complete-guide/) - [WordPress firewall plugins guide](/wordpress-firewall-plugins-guide/) - [WordPress malware removal](/wordpress-malware-removal/) ## Bottom line Secure WordPress is a maintenance habit: update, reduce plugins, lock logins, scan, firewall, restore-tested backups. Use this hub to pick the next deep guide, then do the work. When you want the tooling in one plugin, start free or move to Pro on [pricing](/pricing/). --- ## WordPress Security for Agencies --- ## WordPress Security Features That Protect Your Site