Ready to get started?Download WordPress

Plugin Directory

All In One WP Security & Firewall

A comprehensive, user-friendly, all in one WordPress security and firewall plugin for your site.


  • Added ability to insert captcha in WordPress Multi Site registration form.
  • Added a condition around the management permission constant. This will allow users to define a custom capability for this plugin's admin side via the wp-config file. This was submitted by Samuel Aguilera.
  • Fixed a bug with the hidden login page feature.
  • Fixed a small settings bug with the "block fake google bot" feature.


  • Added a new DB scan feature. Go to the "Scanner" menu to use this new feature.
  • Added new settings import/export feature.
  • Modified user accounts feature to alert administrator if one or both "admin" or "Admin" usernames are being used.
  • Added Persian language translation. The translation was submitted by Amir Mousavi Pour (me@ameer.ir).
  • Small change to get_mysql_tables function to prevent fatal error when mysqli query is unsuccessful.
  • Added Italian language translation. The translation was submitted by Marco Guglielmetti.


  • Added a new feature to add copy protection for your front-end. You can find this feature under the "Miscellaneous" menu.
  • Fixed comment captcha bug for multi-site. Now this feature can be activated/deactivated for subsites of a multisite installation.
  • Added Hungarian language translation. The translation was submitted by Daniel Kocsis.
  • Moved the custom login page feature's handling code to wp-loaded hook so other plugins that modify the login page can do their task before our one is triggered. This change was suggested by Mark Hudnall.
  • Added German language translation. The translation was submitted by Manuel Fritsch.
  • Updated the Brazilian language translation file.


  • Added Brazilian language translation. The translation was submitted by Sergio Siqueira.
  • Added two new action hooks for plugin activation and deactivation time.
  • Improved the get_user_ip_address() function so it handles cases when multiple addresses are returned due to proxy.
  • Fixed the mis-alignment of login page which was broken by WP3.9 when rename login feature is used.
  • WordPress 3.9 compatibility


  • Added a PHP Info section in the system info interface to show some important PHP details of the server.
  • Added a filter to allow the user to have a custom translation in a place (which will be loaded instead of the default one from the plugin). This change was submitted by Samuel Aguilera.
  • Replaced myslqi fetch_all method with fetch_assoc to cover cases where some servers do not have the correct mysql drivers.
  • Added a new filter to allow manipulation of the htaccess rules from your custom code. The name of the filter is 'aiowps_htaccess_rules_before_writing'.
  • Added a "Delete All 404 Event Logs" button to purge all 404 logs from DB
  • Added code to automatically send an email to the registrant when an account has been manually "Approved" from the User Registration menu.


  • Fixed a minor bug: dashboard link was pointing to the wrong tab for the "Logged In Users" tab.
  • Fix a bug with the login page captcha. The captcha wansn't shown if the rename login page feature was enabled at the same time.


  • Added new feature - 404 detection. This allows you to log 404 events and block selected IPs. This feature can be found in the Firewall menu.
  • Added new dashboard info box to display number of blocked IP addresses in the lockout table.
  • Fixed bug where user could not access login page when maintenance mode and rename login page features were both active.
  • Tweaked the hotlinking .htaccess directives to cover both http and https.
  • Fixed code to prevent mysql errors due to some variables not having default value in failed login and lockdown tables
  • Replaced deprecated PHP function mysql_query with mysqli.
  • Added language file for Spanish language. The Spanish translation was done by Samuel Montoya.
  • Added code to hide the "DB Prefix" menu for the non-main sites in multi-site installation


  • Added a new feature to prevent image hot-linking. (See the "Prevent Hotlinks" tab in the firewall menu)
  • Added a check in the Rename Login Page feature to prevent people from setting the slug to "wp-admin"
  • Fixed a small bug with Login Lockdown feature.


  • Fixed a bug where the cookie-based brute force directives were not being deleted from the .htaccess file when the Rename Login Page feature was being activated.


  • Added new feature which will Block Fake Googlebots from crawling your site. Check the Firewall menu for this new feature.
  • Added code to prevent users from having both the Rename Login Page and Cookie-Based Brute Force features active at the same time.
  • Added some useful info boxes in the dashboard: 1) to inform the user if the cookie based brute force or rename login page features are active, 2) last 5 logins to your site.
  • Fixed minor bug with .htaccess backup feature.
  • Updated the from email address value used for sending backups and file change notification. Thanks to @TheAssurer for the tip.
  • Updated the warning message for the disable index view feature.


  • Consolidated "Brute Force" features by moving all such features to the "Brute Force" menu.
  • Improved the file change detection scan feature: Introduced a button allowing admin to view the file change results from the last scan and fixed small bug whereby the change detected flag was not being cleared for applicable cases.
  • Fixed a small bug with "rename login page" (hide admin login) feature.
  • Made wp-config.php and .htaccess file backups more secure. Thanks to @TheAssurer for the tip.
  • Made the login code more robust by catering for cases where the "wp_login" action was not passing 2 parameters.


  • Added a brand new brute force prevention feature - Rename Login Page. This feature can be found in the new menu item called "Brute Force".
  • Modified the new unlock request feature so that the locked out user will only have to enter email address when they submit an unlock request.
  • Replaced the deprecated PHP function "mysql_list_tables" with alternative code.
  • Added warning message regarding WordPress iOS app when pingback protection feature in the firewall settings is active.
  • Added Malware scan tab and information.
  • Some minor html form and CSS corrections.


  • Added new feature which allows users to generate an automated unlock request link via email when they get locked out because of the login lockdown feature.
  • Added a check to ensure that user cannot enter 0 minutes in the Force Logout feature.
  • Fixed translations so that various previously omitted strings can now be translated.
  • Added a new filter before locking down a user's IP address - aiowps_before_lockdown.
  • Generated a new translation (POT) file.


  • Added a new feature that will allow you to add a captcha to the lost password form (useful if you are allowing user registration on your site).
  • Added ability to specify a system log file in the "Host System Logs" tab of the "File System Security" menu
  • Fixed a tab link bug. One link was going to the wrong menu tab.
  • Updated the POT file of the plugin.


  • Added a new feature which allows you to add captcha to the WordPress user registration page.
  • Added some more helpful comments and link to video tutorial in the brute force and white list features settings pages.


  • Added new feature which automatically sets the status of newly registered wordpress user accounts to "pending" and allows manual approval by an administrator.
  • Improved robustness of file change detection iteration code.
  • WordPress 3.7 compatibility


  • Improved the login captcha implementation
  • Changed the management permission to manage_options


  • Added a feature to insert a simple math captcha to the WordPress comment form (to reduce comment spam). Check the spam prevention menu for this new feature.
  • Fixed a minor bug with bulk unlock/delete in user login menu
  • Fixed a minor bug with math captcha logic.


  • Added a simple math captcha functionality for the WP login page. This is another easy yet effective way to combat Brute Force Login Attacks. You can enable this new feature from the user login security menu.


  • Added a new Login Whitelist feature. This feature enables you to specify one or more IP addresses in a special whitelist which will have access to your WP login page. All other IP addresses trying to access your WP login page which are not in the whitelist will be automatically blocked.
  • The IP address will also be included in the email that gets sent to the admin for the ip address lockout notification.
  • Language file loading fix for Chinese language.
  • Tweaked the code which creates a .htaccess file in the backup directory to ensure it gets run even if the directory already existed.
  • Made DB backups more secure.
  • Added more useful debug logs for .htaccess file manipulation failure scenarios.


  • Added a new feature which will list the currently logged in users who have been active within the last 15 minutes.
  • Added a new feature in settings menu which will disable all firewall rules and clear all applicable directives in the .htaccess file.
  • Improved the way the wp-config.php file is handled when it contains an ending PHP tag "?>" (older sites that were using PHP4 earlier).


  • Added new feature/checkbox which will instantly lockout IP address ranges which attempt to login with an invalid username.
  • Fixed a bug in the Comment SPAM IP Monitoring page where trying to block one or more IPs was failing.
  • Removed the word "config" from the list of bad query strings check (to add compatibility with a few more plugins)
  • Added a notice in the dashboard menu to show you if there are any recent file changes that the plugin detected.
  • Fixed bug with php File Editing feature. Code now also handles older style wp-config.php files which have the php end tag "?>"
  • Fixed bug with "Disable All Security Features" button functionality. When clicked, this will now also make the appropriate changes to the .htacces and wp-config.php files if necessary.
  • Changed the storage of backup files from the plugin's directory to the uploads directory. Also added a .htaccess file for security.
  • Fixed the way user-agent strings were written to the .htacess file from the Blacklist feature. The code now will correctly identify and represent spaces and escaped chars.
  • Fixed a bug related to sending backup to correct email address.


  • Added new menu called Scanner with a new feature called File Change Detection. This feature will alert you if any files have changed, added or removed from your system.
  • Fixed "Deny Bad Query Strings" rules to not break the ability to drag components in the WordPress "Appearance->Menus" page
  • Fixed an activation time warning (on sites with WP_DEBUG option enabled)
  • Re-implemented the wp-config.php file content backup feature. It now directly downloads the contents of the file to your computer.
  • Multi-site enhancements: Suppressed access to configuration settings for features which are not allowed to be configured from subsites of multi-site installations.
  • Fixed a bug with login lockdown feature.


  • Added a new feature which will block some spambots from submitting comments.
  • Moved Comment SPAM IP monitoring interface to the new "SPAM Prevention" menu.
  • Fixed a bug with login lockdown feature for both multi and single site.
  • Improved firewall feature for multi-site by making the "Firewall" menu available only for the main site and not the sub-sites.
  • Added random prefix to backup file names.
  • Fixed a bug for WP multi-site install where DB tables do not get created when new blog are created in the network.


  • Fixed a version tagging issue.


  • Fixed an issue with install time error on some sites for WordPress 3.6
  • Fixed some WP Debug related errors for WordPress 3.6
  • Replaced the deprecated $wpdb->escape() function calls with esc_sql() calls


  • Fixed a bug for general DB backup functionality.
  • Fixed multi-site DB backup - the plugin will now backup only the tables relevant for the sub-site in question.
  • Added blank index.html files in various folders inside the plugin.
  • Disabled the wp-config.php file backup feature until we find a more secure method of doing the backup.


  • Added new WordPress PingBack Vulnerability Protection feature. This allows the user to prohibit access to the xmlrpc.php file in order to protect against certain vulnerabilities in the pingback functionality.
  • Added a configuration item in the brute force login prevention feature to allow ajax functionality to work properly when this feature is enabled.
  • Added a POT file for language translations.
  • Made the DB Prefix feature more robust by adding a check to ensure that plugin can write to the wp-config.php file. This will prevent user from losing access to their site in cases where the system changed the prefix but not the entry in the wp-config.php file.
  • Tightened the data validation for the cookie based brute force login feature to ensure that the user must enter a secret word which consists of alphanumeric characters.
  • Added edit links to the user account list in the "User Acounts" menu.


  • Moved the front end site lockout feature to a new menu called "Maintenance".
  • Added a feature in the front-end lockout feature to allow people to specify their own message which will be displayed on the front-end to visitors who try to access the site when it is in lock out state.
  • Fixed a bug in the front-end lockout feature by adding some checks which ensure that the admin will not get locked if the feature is still active and their login session expires or they log out.
  • Added a widget in the dashboard menu to show the status of the "maintenance mode" feature.


  • Added a new feature which is a password strength tool which calculates how easy it is for your chosen password to be cracked using a desktop PC and the appropriate SW. This tool should help you create strong passwords.
  • Added a front-end general visitor lockout feature. This feature allows you to temporarily lock down the front end of your site while you do security investigation, site upgrades, tweaks etc.


  • Added a new option in the cookie-based Brute Force Login Attack prevention feature to allow users to use this feature together with the WordPress's post/page password protection feature.
  • Fixed a bug in the 5G firewall rules to so that the printed rules include the correct number of '\' characters.
  • Fixed a minor bug in the "restore from backed up htaccess file" feature.
  • Enhanced the "Save current wp-config.php file" feature so it will continue to work with all of the firewall rules active on the site.
  • Added extra checks to account for some error scenarios caused on some servers when recursive file search is done.


  • Added new feature - Cookie-based Brute Force Login Attack Prevention. Check under the "Firewall" menu for this new feature. This feature will stop hackers in their tracks when they try to access your wp-admin or login pages. This feature will secure your WordPress backend by enforcing the requirement that anybody trying to access these pages will require a special cookie.

  • Fixed bug related to setting of default configuration for first-time plugin activation.


  • Tweaked the "Deny Bad Query Strings" firewall rules so that plugin deletion and update operations from the WordPress plugins menu are not affected.
  • Fixed a minor bug related to scheduled database backups.
  • Added some extra default settings to be applied to the plugin's configuration pages upon activation for the first time.
  • Plugin will now display a recommendation message if user sets scheduled backup frequency to less than 24 hours.


  • Added a new feature to remove the WordPress Generator Meta information from the HTML source of your site.
  • Tweaked the "Advanced Character String Filter" to fix issue which was affecting plugins such as "Admin Management Xtended" and also pages with keywords such as "password" in the URL.
  • Updated one rule in the "Advanced Character String Filter" feature to make it compatible with W3 Total Cache Plugin's minify feature.
  • Added a "Delete All Failed Login Records" option in the "Failed Login Records" tab. This will delete all entries in the failed logins table and will make it less tedious for users who get a lot of brute force attacks on their site.


  • Moved the rules which disable index views from the "basic firewall" rules to the "additional rules" section. This will prevent any site breakage for those who want to enable the basic firewall but do not have "AllowOverride" option enabled in their httpd.conf


  • Added the following new feature:
  • Prevent people from accessing the readme.html, license.txt and wp-config-sample.php files.


  • First commit to the WP repository.

Requires: 3.5 or higher
Compatible up to: 3.9.1
Last Updated: 2014-7-4
Downloads: 320,689


4 stars
4.9 out of 5 stars


35 of 77 support threads in the last two months have been resolved.

Got something to say? Need help?



6 people say it works.
2 people say it's broken.

100,4,4 100,6,6 100,2,2 100,5,5 100,1,1 100,1,1 100,2,2 100,2,2 100,1,1 100,1,1 100,2,2 100,1,1
100,1,1 100,1,1 100,1,1 100,3,3 100,2,2 100,2,2 100,4,4 100,6,6
100,4,4 100,3,3 100,4,4 100,4,4 100,7,7 100,1,1
80,5,4 100,5,5 100,6,6 100,5,5 100,2,2 100,5,5 100,3,3
100,3,3 100,6,6 100,8,8
100,5,5 100,8,8 100,6,6 100,5,5 100,1,1
100,4,4 100,5,5 100,15,15 100,8,8 89,9,8 100,8,8 100,5,5 100,2,2
100,7,7 100,1,1
100,2,2 100,1,1
67,3,2 100,9,9 100,4,4
100,6,6 90,10,9 75,8,6