Title: Balui Security Suite Author: baluidigital Published: November 2, 2026 Last modified: November 2, 2026 --- Search plugins ![](https://ps.w.org/balui-security-suite/assets/banner-772x250.png?rev=3780696) ![](https://ps.w.org/balui-security-suite/assets/icon-256x256.png?rev=3780696) # Balui Security Suite By [baluidigital](https://profiles.wordpress.org/baluidigital/) [Download](https://downloads.wordpress.org/plugin/balui-security-suite.1.8.2.zip) * [Details](https://wordpress.org/plugins/balui-security-suite/#description) * [Reviews](https://wordpress.org/plugins/balui-security-suite/#reviews) * [Installation](https://wordpress.org/plugins/balui-security-suite/#installation) * [Development](https://wordpress.org/plugins/balui-security-suite/#developers) [Support](https://wordpress.org/support/plugin/balui-security-suite/) ## Description Balui Security Suite, by Balui Digital, protects WordPress sites without dozens of screens. Everything is configured from one modern dashboard with light and dark themes, ready to be translated. It is designed for site owners without technical knowledge: the defaults are safe and every option explains what it does. * **Two-step verification**: authenticator app (TOTP, RFC 6238) or one-time email codes, recovery codes and remembered devices. Each user turns it on from their profile. Works on wp-login.php, WooCommerce “My account” and any form that uses the WordPress login. * **Login attempt limit**: per account and per IP, progressive lockouts, notifications and generic error messages that never disclose whether a user exists. Also protects the WooCommerce login. * **Password policy**: minimum length, character mix, no username or email inside the password, and breached-password detection with Have I Been Pwned (k-anonymity). * **CAPTCHA** with ALTCHA (proof of work solved in the browser and checked on your own server: no keys, no cookies and no third parties) on login, registration, lost password, comments and WooCommerce. * **Custom login URL**: wp-login.php and /wp-admin/ stop answering for visitors. * **Security headers**: HSTS, X-Frame-Options, X-Content-Type-Options, Referrer- Policy, Permissions-Policy, COOP/CORP and a Content-Security-Policy you write( Report-Only first, then enforced). A checker shows the headers your site really sends. * **Hardening**: XML-RPC, application passwords, REST user listing, user enumeration, file editor, PHP in uploads, directory listing, sensitive files, version disclosure, pingbacks, forced HTTPS for the dashboard and more. * **Integrations**: detects management panels, supplier syncs, payment gateways and AI assistants, and tells you before a protection would cut one of them off. * **Comments**: disable everywhere or per content type, close existing threads, hide the UI and the feed, or strip links. * **Security score and one-click recommendations**, activity log (you choose how many days it is kept), privacy tools integration, settings export and import, WP-CLI commands. #### Balui Security Suite Pro [Balui Security Suite Pro](https://baluidigital.es/categoria/balui-security-suite/) is a separate plugin that includes everything above and adds a firewall with country blocking, CAPTCHA services from external providers (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA, Friendly Captcha, MTCaptcha), a Content-Security-Policy assistant with automatic nonces for an A+ grade, passkeys, magic links, temporary access, two-step verification required by role, password expiry and history, session control, an integrity scan, vulnerability alerts, activity log export to CSV, weekly reports, WooCommerce “My account › Security”, multisite and support. When you install it, it replaces this plugin and keeps all your settings. This plugin is complete on its own and never needs Pro to work. ### External services Balui Security Suite only connects to other services for the features below. Nothing is sent to Balui Digital. * **Have I Been Pwned (Pwned Passwords)**, only if you turn on “Reject breached passwords” (off by default). Then, when a password is set or checked, the first 5 characters of its SHA-1 hash are sent to api.pwnedpasswords.com; the password itself, the site address and user data never leave the site. [Terms](https://haveibeenpwned.com/API/v3#AcceptableUse), [privacy](https://haveibeenpwned.com/Privacy). * **Your own site**: the “Check now” button in Headers requests your home page to read the headers it returns, and after removing lines from .htaccess or .user. ini (Hardening › Server files) the plugin requests your home page and one admin stylesheet to make sure the site still works. Nothing is sent anywhere else. ### Third-party libraries The plugin includes these open-source libraries, unmodified. Their readable source code is public: * ALTCHA widget 2.2.4 (`assets/altcha.min.js`), MIT license. Source: [github.com/altcha-org/altcha](https://github.com/altcha-org/altcha), file `dist/altcha.i18n.umd.js` of the npm package `altcha`. * QR Code Generator 2.0.4 by Kazuhiko Arase (`assets/qrcode.js`), MIT license. Source: [github.com/kazuhikoarase/qrcode-generator](https://github.com/kazuhikoarase/qrcode-generator), file `dist/qrcode.js` of the npm package `qrcode-generator`. * Geist and Geist Mono fonts (`assets/fonts/`), SIL Open Font License 1.1 (`assets/ fonts/OFL.txt`). Source: [github.com/vercel/geist-font](https://github.com/vercel/geist-font). The rest of the CSS and JavaScript is not minified. ## Screenshots [⌊Overview: security score, recommendations and recent activity.⌉⌊Overview: security score, recommendations and recent activity.⌉[ Overview: security score, recommendations and recent activity. [⌊Two-step verification: authenticator app or email codes, recovery codes and remembered devices.⌉⌊Two-step verification: authenticator app or email codes, recovery codes and remembered devices.⌉[ Two-step verification: authenticator app or email codes, recovery codes and remembered devices. [⌊Login page protection: CAPTCHA (ALTCHA), custom login URL and attempt limit.⌉⌊ Login page protection: CAPTCHA (ALTCHA), custom login URL and attempt limit.⌉[ Login page protection: CAPTCHA (ALTCHA), custom login URL and attempt limit. [⌊Security headers with the checker that reads what your site really sends.⌉⌊Security headers with the checker that reads what your site really sends.⌉[ Security headers with the checker that reads what your site really sends. [⌊One-click hardening, explained in plain words.⌉⌊One-click hardening, explained in plain words.⌉[ One-click hardening, explained in plain words. [⌊Activity log of sign-ins, lockouts and security changes.⌉⌊Activity log of sign- ins, lockouts and security changes.⌉[ Activity log of sign-ins, lockouts and security changes. ## Installation 1. Install and activate the plugin. 2. When two-step verification is in use, the plugin asks you to add its encryption key to wp-config.php with one click (Settings › Encryption key). Nothing is written to wp-config.php without that click. 3. Open Balui Security Suite in the admin menu and follow the recommendations. On Apache and LiteSpeed the hardening measures marked “server” are written to .htaccess( in the site root and in the uploads folder), inside a block marked “Balui Security Suite”. Four of them are on by default: no directory listing, PHP blocked in uploads, sensitive files and readme.html/license.txt blocked. You can turn each one off in Hardening, and the block is removed when the plugin is deleted. Emergency switches for wp-config.php: `BALUI_SECURITY_2FA_OFF` (second step only),` BALUI_SECURITY_LOGIN_URL_OFF` (custom login URL) and `BALUI_SECURITY_OFF` (whole plugin). ## FAQ ### I locked myself out. What do I do? Add `define( 'BALUI_SECURITY_2FA_OFF', true );` to wp-config.php to skip the second step, or `define( 'BALUI_SECURITY_OFF', true );` to turn the whole plugin off. You can also rename the plugin folder by FTP. ### Does it work with WooCommerce? Yes. Two-step verification, the login attempt limit, the password policy and the CAPTCHA also work on the WooCommerce “My account” login, registration and checkout. ### Are there hooks for developers? Filters: `bsnt_capability` (capability needed to manage the plugin, default `manage_options`),` bsnt_allow_without_second_step` (return true to let a given user sign in through XML-RPC or the REST API with the normal password, for example a service account),` bsnt_totp_issuer` (name shown in the authenticator app), `bsnt_static_headers` ( security headers sent), `bsnt_csp_skip` and `bsnt_csp_directives` (pages without Content-Security-Policy, and the directives sent), `bsnt_send_mail` (send the plugin’s emails with your own mailer). Actions: `bsnt_event` (every activity log event), ` bsnt_lockout`, `bsnt_tfa_reset` and `bsnt_settings_updated`. ### What happens to my settings if I move to Balui Security Suite Pro? They are kept. Pro uses the same settings and turns this plugin off when it is activated. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Balui Security Suite” is open source software. The following people have contributed to this plugin. Contributors * [ Balui Digital ](https://profiles.wordpress.org/baluidigital/) [Translate “Balui Security Suite” into your language.](https://translate.wordpress.org/projects/wp-plugins/balui-security-suite) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/balui-security-suite/), check out the [SVN repository](https://plugins.svn.wordpress.org/balui-security-suite/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/balui-security-suite/) by [RSS](https://plugins.trac.wordpress.org/log/balui-security-suite/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.8.2 * CAPTCHA uses ALTCHA only: the challenge is solved in the visitor’s browser and checked on your own server. Nothing is loaded from or sent to third parties. * The encryption key is only added to wp-config.php when you press the button. * Multisite: the server rules (.htaccess) are written from the main site’s settings, and the custom login URL is not offered (all the sites share the login page). * The dashboard follows the WordPress language of each user. * Activity log queries, privacy tools and uninstall use fully prepared SQL. * Code clean-up: removed code and options that this plugin did not use. #### 1.8.1 * This plugin no longer contains any multisite network administration or code from Balui Security Suite Pro. On a multisite each site is configured on its own. * Server files: the backups made before cleaning .htaccess or .user.ini are now kept in the database (the last 10) instead of as files in the uploads folder. Existing backups are moved automatically and the old folder is removed. * Server files: the files are located with WordPress functions (get_home_path() and wp_upload_dir()). * Paths to the plugins folder and to WordPress core are worked out with WordPress functions instead of constants. #### 1.8.0 * New: before writing its server rules, the plugin checks .htaccess and .user.ini for leftovers of security plugins that are no longer active (WP Cerber, Wordfence, Solid Security, All-In-One Security, NinjaFirewall), sections without a pair ( a 500 error on Apache) and auto_prepend_file lines pointing to missing files. If something can break the site, its own rules wait and the administrator decides. * New: Hardening › Server files explains each finding and offers to remove it after a backup. If the site answers worse afterwards, the backup is put back automatically. Undo for 24 hours. * New: WP-CLI command wp balui-security-suite htaccess [check|clean|ignore|undo], which also works when the site shows a 500 error. * Nothing is changed without an explicit action, and rules of plugins that are still active are never offered for removal. #### 1.7.0 * New name: Balui Security Suite (formerly Balui Sentinel). * The activity log keeps as many days as you choose (7 to 730). * The breached-password check (Have I Been Pwned) is now off by default and is only used if you turn it on. * “Force HTTPS for login and dashboard” uses WordPress’s own force_ssl_admin(); the plugin no longer changes automatic update settings. * Two-step verification form protected with a WordPress nonce; stricter sanitising of request data and escaping of output. * WP-CLI: wp balui-security-suite. #### 1.6.2 * Database queries use placeholders for table names. * Translator notes for strings with placeholders. #### 1.6.1 * The Pro links now point to baluidigital.es/categoria/balui-security-suite/. #### 1.6.0 * First version on WordPress.org. * New: Content-Security-Policy written by hand, with a starting template and Report- Only mode. * The plugin cannot be active at the same time as Balui Security Suite Pro, which already includes it. ## Meta * Version **1.8.2** * Last updated **7 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.5 or higher ** * Tested up to **7.1.4** * PHP version ** 8.1 or higher ** * Tags * [2FA](https://wordpress.org/plugins/tags/2fa/)[login security](https://wordpress.org/plugins/tags/login-security/) [security](https://wordpress.org/plugins/tags/security/)[Security Headers](https://wordpress.org/plugins/tags/security-headers/) [two factor](https://wordpress.org/plugins/tags/two-factor/) * [Advanced View](https://wordpress.org/plugins/balui-security-suite/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/balui-security-suite/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/balui-security-suite/reviews/) ## Contributors * [ Balui Digital ](https://profiles.wordpress.org/baluidigital/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/balui-security-suite/)