Minimum versions
The free plugin runs on WordPress 5.6 or newer and PHP 7.1 or newer. It is tested up to WordPress 7.1. Pro is an extension of the free plugin and shares the same floor.
HTTPS is strongly recommended. Two-factor codes and session cookies travel in the clear without it.
Passkeys are the one exception: the WebAuthn library behind them needs PHP 8.2 or newer. Everything else works on PHP 7.1.
Where it runs
Any host that runs WordPress runs the plugin. There is no external service to sign up for, and settings and logs stay in your own database.
- Single-site installs are the primary target and where most testing happens.
- Multisite: the plugin activates and runs, and uninstall is network-aware. It has had less testing than single-site, so validate on a staging network first and configure settings per site.
- Persistent object caches such as Redis and Memcached: supported. Lockouts and two-factor sign-in sessions are stored as transients, so give the cache enough memory that entries are not evicted early.
- MySQL, MariaDB and SQLite-based setups.
Forms it protects
Login protection, two-factor sign-in and CAPTCHA cover the WordPress login, registration, lost-password and comment forms out of the box.
- WooCommerce login, registration, lost-password and checkout forms, with a WooCommerce template in the setup wizard.
- Ultimate Member login forms.
- XML-RPC has its own switch, so you can leave it on for a mobile app and still lock down the browser login.
Caching plugins
Full-page caching and the plugin get along, with one rule: keep the login path out of the cache. Most caching plugins already exclude login and admin pages, and the plugin detects common caching plugins and warns you if that exclusion is missing. If you use a custom login URL, the same exclusion keeps that URL from ever being served from cache.
Other security and CAPTCHA plugins
The plugin checks for overlap with other security plugins and tells you when two plugins are doing the same job, so you can turn one side off rather than run both. Two CAPTCHAs on one form is a common cause of locked-out users; no-conflict mode and provider priority keep reCAPTCHA and Turnstile off the same form.
Moving from Wordfence? The setup wizard can import your existing settings so you do not start from zero.
If you lock yourself out
The setup wizard gives you an emergency access link the first time it runs. Keep it somewhere safe: it switches the plugin off from a browser. If Turnstile is rejecting every login after a key rotation, a single constant in wp-config.php disables it until you re-enter the keys. Both recovery paths need access you already have, so neither is a public bypass.
Pro
Pro requires the free plugin installed and active. It refuses to boot without it. Passkey login in Pro needs PHP 8.2; every other Pro feature runs on the same versions as the free plugin.
Secure your site today
Install the free plugin from WordPress.org and set up real protection with the guided setup wizard. Upgrade to Pro whenever you need more.