Skip to content

wp.freepdftxt.com

Free on WordPress.org

Your WordPress site, locked down.

Blocks brute-force logins, request floods and comment spam — with two-factor authentication, a firewall and hardening in one free plugin. Nothing leaves your server.

Download See all features

100% free · GPL v2 · no account required

0
Layers in the free plugin
0
Second setup
$0
Forever free
0
Bytes sent off your server
// what it does

Six layers, all free

One button on first run turns on the sensible defaults, skipping anything that could lock you out. Everything stays adjustable from a single settings page.

🔐

Two-Factor Authentication

TOTP codes from Google Authenticator, Authy or 1Password, a QR setup screen, and ten one-time recovery codes. Works with no internet connection.

🚪

Login Protection

Failed attempts are counted per IP and locked out automatically. Error messages never reveal which half of the login was wrong, and a hidden honeypot catches bots in silence.

🧱

Firewall & Rate Limiting

SQL injection, XSS, path traversal and RCE patterns are blocked before WordPress loads. Per-IP rate limiting slows the floods and aggressive crawlers behind them.

🛡️

Headers & Hardening

Modern security headers on every response, plus XML-RPC off, the file editor disabled, the WordPress version hidden and user enumeration blocked.

🕵️

Anti-Spam & CAPTCHA

Comment honeypot and link limits, with optional reCAPTCHA or hCaptcha on the login and comment forms using your own key pair.

🌐

Proxy Aware

Behind Cloudflare or a load balancer, every visitor would otherwise share one address and break per-IP blocking. Tell the plugin, and it sees the real one.

// pricing

Free keeps them out. Pro tells you if anyone got in.

Start free. Upgrading keeps every setting you already chose — Pro is the same plugin with the scanners and the recovery tools switched on.

Free
$0
forever · on WordPress.org
  • ✓Login protection, lockouts & honeypot
  • ✓Two-factor authentication (TOTP)
  • ✓Firewall & per-IP rate limiting
  • ✓Security headers & hardening
  • ✓CAPTCHA on login and comments
  • ✓Cloudflare / reverse-proxy support
  • ✗Malware & vulnerability scanning
  • ✗Live traffic, threat log & country blocking
  • ✗Emergency lockdown & session control
Download Free
Recommended Pro
$29
Per Year · 1 site
  • ✓Everything in Free
  • ✓Malware scanner with one-click quarantine
  • ✓Database scan for injected scripts and hidden spam
  • ✓Core file integrity against WordPress.org checksums
  • ✓Vulnerability scanner & scheduled scans by email
  • ✓Live traffic, threat scoring, country blocking & auto-ban
  • ✓Emergency lockdown, session manager & activity log
  • ✓Automatic updates and priority support
Get Pro
Freelancer
$99
per year · 5 sites
  • ✓Everything in Pro, on 5 sites
  • ✓Set one site up, copy the settings to the rest
  • ✓Alerts to your address, not your client's
  • ✓Monthly client report under your own name
  • ✓Cloudflare: block attackers before they reach the server
  • ✓One licence key across all five
Get Freelancer
Agency
$249
per year · 25 sites
  • ✓Everything in Freelancer, on 25 sites
  • ✓Require two-factor for the roles you choose
  • ✓Move a licence between sites as clients come and go
  • ✓Priority support
Get Agency

Need 5 sites? Write to us and we will send a link.

// get protected

Install FPX Security Guard in under a minute

Install, activate, and press one button — the recommended protection is on. Everything else lives under Settings → Security Guard.

Download Free Get Pro
// from the blog

Security news & guides

Release notes, hardening tips, and answers to common questions.