Free, lightweight WordPress security. Harden your site with login protection & 2FA, see Site Health clearly and run on-demand checks—setup in minutes.
As of April 2026, SiteLock Security is a WordPress site health plugin with 1.0K+ active installations and a 3.4/5 rating from 14 reviews. It has been downloaded 48K+ times in total. Requires WordPress 3.8+ and PHP 8.0+. Available on WordPress.org since 2013. Recently updated within the last 3 months. Downloads are up 8% this week. Top alternative: Performance Lab.
🌟 Completely redesigned in Version 5.0 — now even stronger with 2FA in 5.1 🌟
The SiteLock WordPress plugin was recently rebuilt with three goals: make it faster, make it clearer and move the heavy work to the cloud. We built a cloudfirst architecture, modernized UI, expanded security controls and stripped out everything that didn’t need to be there. Our latest 5.1 release builds on that foundation with TwoFactor Authentication (2FA) to strengthen login security and give you tighter control over access.
The big changes:
– 🔒 Enhanced WordPress-specific hardening and login security controls
– ☁️ Cloud-powered scanning architecture for zero performance impact
– 🩺 New Site Health interface that shows you what matters in one view
– ⚡ Streamlined controls (fe…
The SiteLock Security WordPress plugin is a lightweight WordPress security tool aimed at giving site owners essential protections with minimal performance impact. It focuses on baseline hardening (e.g., blocking unsafe scripts and tightening directory permissions) and login security (e.g., brute-force protection, session timeouts, and strong password enforcement) right from your WordPress dashboard. Cloud-powered scans and on-demand checks help you monitor your site’s status without consuming server resources.
Since the start of the service SiteLock is not able to connect to my (verified) domain and verify the SSL certificate. Support reactions are far from satisfying.
They will show false positives for Google Analytics tag, then charge you to remove it, then send you an email saying they were wrong and it was a false positive and that they didn’t actually remove any malware, but won’t refund your money.
With my extensive travels, festival reviews and listing of nearly 1,000 Ohio festivals, it’s impossible for me to constantly check the safety of the thousands of outgoing links found on my website. That’s why I’m thankful when SiteLock warns me about a malicious site so that I can quickly remove the bad link before my readers click on it.
SiteLock employees definitely understand customer service. When I signed up for Sitelock’s website security service, I was also in the middle of changing web hosting companies, transferring my domain name and getting my website redesigned in the wake of my previous website having been hacked and rendered useless. Steve (my SiteLock security consultant) went the extra mile and helped with some things that weren’t even his responsibility.
| WordPress | 3.8+ requiredTested up to 6.9.4 |
| PHP | 8.0+ required |
Release Date February 19, 2026
…and 1 more changes
Plugin data sourced from WordPress.org. Analysis and metrics by PluginSift.