We banned WP Lockdown

A recent WP Lockdown update has crossed a line that we consider completely unacceptable.

After the update, administrator accounts on sites using the plugin were locked down and users attempting to access WordPress administration were being required to provide their WordPress user password to WP Lockdown.

For a security plugin to insert itself into the authentication process in a way that requires access to administrator credentials is an extraordinary breach of trust. Our clients trust us to protect their websites, their accounts, and their credentials. We will not knowingly allow a third party security plugin to place itself between our clients and WordPress authentication in this manner.

ILGM manages more than 300 WordPress installations. WP Lockdown has now been removed from every system we manage.

And to be absolutely clear, this is permanent.

ILGM will never use WP Lockdown software again.

The problem is no longer simply this particular feature or update. Someone within this company made the decision that requiring WordPress administrators to provide their credentials to WP Lockdown was acceptable. That decision fundamentally changed our assessment of whether this company can be trusted with software running inside our clients’ websites.

Even if this functionality is removed because of the current backlash, the trust is gone. We would now have to wonder whether a similar capability could be introduced differently or less visibly in a future update. That is not a risk we are willing to take with our clients.

Security software requires an exceptional level of trust because of the access it has to a WordPress installation. Once that trust is lost, uninstalling a feature does not restore it.

I am posting this so other WordPress administrators and agencies are aware of what occurred and can make their own decision about whether WP Lockdown still deserves that level of access to their systems.