Title: Ultimate Security – Login Protection, 2FA, CAPTCHA & Hardening
Author: WP Ultimate Security
Published: <strong>Març 22, 2025</strong>
Last modified: Febrer 18, 2026

---

Search plugins

![](https://ps.w.org/ultimate-security/assets/banner-772x250.png?rev=3397281)

![](https://ps.w.org/ultimate-security/assets/icon-256x256.gif?rev=3344476)

# Ultimate Security – Login Protection, 2FA, CAPTCHA & Hardening

 By [WP Ultimate Security](https://profiles.wordpress.org/wpultimatesecurity/)

[Download](https://downloads.wordpress.org/plugin/ultimate-security.1.0.17.zip)

[Live Preview](https://bal.wordpress.org/plugins/ultimate-security/?preview=1)

 * [Details](https://bal.wordpress.org/plugins/ultimate-security/#description)
 * [Reviews](https://bal.wordpress.org/plugins/ultimate-security/#reviews)
 *  [Installation](https://bal.wordpress.org/plugins/ultimate-security/#installation)
 * [Development](https://bal.wordpress.org/plugins/ultimate-security/#developers)

 [Support](https://wordpress.org/support/plugin/ultimate-security/)

## Description

Ultimate Security protects your WordPress site from brute force attacks, unauthorized
access, and bots. Lightweight, modular, and privacy-focused.

Check out the documentation for this plugin from here

Link: [Visit Documentation Site](https://docs.wpultimatesecurity.com/docs/)

#### Key Features

**Two-Factor Authentication**
 * Email OTP verification * Google Authenticator, 
Authy, Microsoft Authenticator (TOTP/HOTP) * 2FA status dashboard

**Login Protection**
 * Custom login URL (hide wp-admin) * Login attempt limits *
Password policy enforcement * Session management

**Bot Protection**
 * Google reCAPTCHA v2/v3 * Cloudflare Turnstile * Protect login,
registration, comments, WooCommerce

**Security Hardening**
 * Security keys rotation * Auto-update controls * Site health
monitoring

**Content Protection**
 * Right-click disable * Text selection control * Image drag
prevention

**Tools**
 * Security Score dashboard * Settings backup/restore * Test mode for 
previewing rules

### External Services

This plugin connects to external services:

#### Cloudflare Turnstile

 * When: Turnstile CAPTCHA enabled
 * Sends: Response token, site secret key
 * URL: https://challenges.cloudflare.com/turnstile/v0/siteverify
 * Privacy: https://www.cloudflare.com/privacypolicy/

#### Google reCAPTCHA

 * When: reCAPTCHA enabled
 * Sends: Response token, site secret key
 * URL: https://www.google.com/recaptcha/api/siteverify
 * Privacy: https://policies.google.com/privacy

#### WordPress.org Salt API

 * When: Security keys rotation requested
 * Sends: Request for random salt strings
 * URL: https://api.wordpress.org/secret-key/1.1/salt/

## Screenshots

 * [[
 * [[
 * [[
 * [[
 * [[
 * [[
 * [[
 * [[

## Installation

 1. Go to Plugins > Add New
 2. Search “Ultimate Security”
 3. Click Install, then Activate
 4. Go to Ultimate Security menu
 5. Run the setup wizard

#### Quick Start

 1. Enable 2FA for admin accounts
 2. Set login attempt limits
 3. Add CAPTCHA to forms
 4. Check your Security Score

## FAQ

### Will this slow my site?

No. Adds less than 0.1s to page load.

### Works with WooCommerce?

Yes. CAPTCHA works on checkout and login forms.

### What if I get locked out?

Rename `/wp-content/plugins/ultimate-security` via FTP, or run `wp plugin deactivate
ultimate-security` via SSH.

### Works with other security plugins?

Yes. Disable overlapping features to avoid conflicts.

### Need technical knowledge?

No. The setup wizard handles configuration.

## Reviews

There are no reviews for this plugin.

## Contributors & Developers

“Ultimate Security – Login Protection, 2FA, CAPTCHA & Hardening” is open source 
software. The following people have contributed to this plugin.

Contributors

 *   [ WP Ultimate Security ](https://profiles.wordpress.org/wpultimatesecurity/)

[Translate “Ultimate Security – Login Protection, 2FA, CAPTCHA & Hardening” into your language.](https://translate.wordpress.org/projects/wp-plugins/ultimate-security)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/ultimate-security/),
check out the [SVN repository](https://plugins.svn.wordpress.org/ultimate-security/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/ultimate-security/)
by [RSS](https://plugins.trac.wordpress.org/log/ultimate-security/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.0.17

 * Fix: Minor bug fixes and stability improvements
 * Improvement: Code cleanup and optimization

#### 1.0.16

 * Improvement: Code improvements to the ovearll plugin making it snappier.

#### 1.0.15

 * Improvement: Conflict management between applied settings.
 * Improvement: UI improvements to existing settings pages. Making it more intuitive
   to use.
 * Fix: Multiple bug fixes to dashboard. You should get more accurate results now.
 * Fix: New deactivation URL was not saving after deactiviting-activating plugin.

#### 1.0.14

 * Fix: Email 2FA codes were not being sent properly
 * Fix: 2FA code page flickering effect after login

#### 1.0.13

 * New: Completely redesigned user interface for better usability

#### 1.0.12

 * New: Security Score meter to track your site’s security level
 * Improvement: Enhanced modal design for better UI/UX

#### 1.0.11

 * Fix: Minor UI bug fixes

#### 1.0.10

 * Security: Removed unauthenticated AJAX actions
 * Security: REST routes now require admin permission

#### 1.0.9

 * Fix: Dashboard emergency deactivation URL display issue

#### 1.0.8

 * Improvement: Human-readable values in activity log
 * Improvement: Reduced plugin size with optimized code
 * Fix: 2FA reset issue for users
 * Fix: Password policy not applying to new users

#### 1.0.7

 * New: Activity Log feature
 * New: Improved dashboard design
 * Fix: Nonce validation issues
 * Fix: Turnstile not showing on comment forms

#### 1.0.6

 * Fix: Custom login setup issues
 * Fix: Email 2FA asking for OTP twice
 * Fix: Feedback form email delivery
 * Improvement: Reorganized menu navigation
 * Improvement: Performance optimizations

#### 1.0.5

 * Fix: Request logs page display issue
 * Fix: URL Guard SQL query display
 * Improvement: Performance optimizations

#### 1.0.4

 * Redesigned settings page interface

## Meta

 *  Version **1.0.17**
 *  Last updated **2 mesos ago**
 *  Active installations **Fewer than 10**
 *  WordPress version ** 5.8 or higher **
 *  Tested up to **6.8.5**
 *  PHP version ** 8.1 or higher **
 *  Language
 * [English (US)](https://wordpress.org/plugins/ultimate-security/)
 * Tags
 * [Brute Force](https://bal.wordpress.org/plugins/tags/brute-force/)[firewall](https://bal.wordpress.org/plugins/tags/firewall/)
   [login security](https://bal.wordpress.org/plugins/tags/login-security/)[security](https://bal.wordpress.org/plugins/tags/security/)
   [two factor authentication](https://bal.wordpress.org/plugins/tags/two-factor-authentication/)
 *  [Advanced View](https://bal.wordpress.org/plugins/ultimate-security/advanced/)

## Ratings

No reviews have been submitted yet.

[Add my review](https://wordpress.org/support/plugin/ultimate-security/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/ultimate-security/reviews/)

## Contributors

 *   [ WP Ultimate Security ](https://profiles.wordpress.org/wpultimatesecurity/)

## Support

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/ultimate-security/)