Atlant Security protects a WordPress site from the first byte of a request to the clean-up after a break-in: a firewall with rate limits, brute-force and two-factor login protection, a file and database malware scanner, hardening that is verified on your own server, alerts, a visitor log and an audi
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.0 and PHP 8.0.
SourceWordPress plugins · Nov 7, 2026
01 / Source details
Aboutthistool.
Atlant Security protects a WordPress site from the first byte of a request to the clean-up after a break-in: a firewall with rate limits, brute-force and two-factor login protection, a file and database malware scanner, hardening that is verified on your own server, alerts, a visitor log and an audit log, and a post-breach recovery toolkit. Everything runs on your server, with no external dependencies.
Every setting is one search away. Type in the box at the top of the plugin menu, or press “/”, and it finds any setting on any of the plugin’s pages and takes you straight to it.
Layered Defense
01Early-request firewall – the WAF, rate limiter and IP block list inspect every request at init priority 0, before the page is built and before other plugins handle it.
02Logins and accounts – lockouts, CAPTCHA, a custom login URL, 2FA, session security, password and REST API policies.
03Content and configuration – hardening, security headers, AI crawler control and honeypots.
04Outbound and data – SSRF prevention and malware scanning of files and the database.
05Response and recovery – alerts, logs and the Post-Breach Command Center.
Features
Security Dashboard A protection status strip shows at a glance the firewall mode (with a one-click “Switch to Block” while it only logs), login lockouts, two-factor coverage, rate limits, logging, the security headers grade, the last malware scan, whether PHP can run in uploads, and GeoIP, each linking to its page. Below it: visitors online now (refreshed every 15 seconds), requests, bots and blocks in the last 24 hours, a traffic chart, top IPs and top pages.
Web Application Firewall (WAF) 39 rules in 8 categories: SQL injection, XSS, path traversal and file inclusion, remote code execution, PHP object injection, SSRF, WordPress-specific probes (.env, .git, backups, debug logs, readme files) and scanner fingerprints. Request values are decoded twice more after PHP’s own URL decoding, and HTML entities and \u and \x escapes are resolved, before matching, so encoded payloads are caught. Log Only, Block or Tarpit mode; high-severity matches can block the attacking IP for as long as you choose.
Rate Limits Sliding-window limits per visitor IP for 10 kinds of request: front-end pages, logins, search, feeds, sitemaps, the REST API (signed-in and anonymous), WooCommerce checkout, XML-RPC and WP-Cron. The WAF page shows every limit, lets you change it, and counts the requests throttled in the last 24 hours. Uses APCu when available.
Brute Force Protection Progressive lockouts (5 minutes, then 30 minutes, then 24 hours) after a number of failures you set, with generic login errors that do not reveal whether a username exists. Unlock one IP, or clear every lockout, in one click; every page that can lock you out explains how to get back in. Author ID scans are blocked, and author archive URLs can be rebuilt from display names so they no longer publish login names.
CAPTCHA and Custom Login URL Cloudflare Turnstile or Google reCAPTCHA v2 or v3 on the login, registration and lost-password forms, off until you choose a provider. Move wp-login.php to a secret address; the plugin asks you to whitelist your own IP first.
Two-Factor Authentication (2FA) Authenticator apps (Google Authenticator, Microsoft Authenticator, Authy, 1Password and any TOTP app) set up by QR code or key, or codes by email, with 10 recovery codes; require it per role. A password alone never gets in: the session a password-only login creates is revoked on the server before the code is asked for. Anyone who has set up 2FA is asked for a code on every login, each account allows 10 wrong codes in 15 minutes, and API logins for 2FA accounts need an application password.
Malware Scanner Scans PHP files in WordPress core, plugins, themes, uploads and mu-plugins, checks wp_options and post content for injected scripts, and flags newly created administrator accounts. Core files are verified against the official WordPress.org checksums. 17 signatures cover eval, base64, gzinflate and ROT13 backdoors, web shells (WSO, b374k, China Chopper), crypto miners, card skimmers, malicious redirects, hidden iframes and PHP files in uploads. The scan runs in batches in the background, picks up again after a page reload, can be cancelled, and can run daily on a schedule. Quarantine with one-click restore, a false-positive list with Undo, and CSV export of every finding.
Hardening, Verified on Your Server One-click hardening (disable XML-RPC and the file editor, hide the WordPress version, block REST API user listing and author scans, force SSL for wp-admin, automatic updates, block PHP execution in uploads) with Enable and Disable buttons, and “How to fix” instructions for what the plugin cannot change itself. Checks report what is actually true: “Block PHP in Uploads” writes the rule into the uploads .htaccess, then requests a test file to confirm the server obeys it, and gives nginx and IIS sites the snippet to paste. A Vulnerability Audit lists everything still open.
Security Headers HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Content-Security-Policy (report-only or enforced), Cross-Origin-Resource-Policy and Cross-Origin-Opener-Policy, with every CSP directive and Permissions-Policy feature configurable and a preview of the exact header that will be sent, plus a letter grade. Removes X-Powered-By.
Session Security HttpOnly, Secure and SameSite cookies; each session bound to the browser that created it (by User-Agent, and optionally by IP); a limit on concurrent sessions; an optional idle timeout; and a “Who is logged in” list with “Log out everywhere” for each account.
Honeypots and AI Crawlers Hidden-link traps, a fake login page, and comment and Contact Form 7 fields that only bots fill in. Search engines and the AI crawlers you allow are never banned. Allow or block 20 known AI and LLM crawlers (GPTBot, ClaudeBot, Google-Extended, Bytespider and others) one by one, through robots.txt and with a 403 at the request level.
Outbound Monitor (SSRF Prevention) Logs every outgoing HTTP request with the plugin or theme that made it, blocks requests to private and internal addresses including cloud metadata endpoints, and can enforce a domain allowlist.
Cron Guard Takes a snapshot of the scheduled tasks and flags new or unusually frequent ones, a common way for malware to reinstall itself, while recognising every task WordPress core schedules. Detects wp-cron.php floods and helps you move to a real system cron.
Alerts Email, Slack and custom JSON webhooks, off until you enable them, filtered by a minimum severity. Alerts cover malware, PHP files uploaded through the media library, new administrators, two-factor lockouts, unexpected scheduled tasks, blocked outbound requests, failed two-factor emails, login lockouts, firewall auto-blocks and honeypot bans. Each kind is sent at most once per 15 minutes (lockouts, blocks and bans once per 6 hours) with a count of what was held back, so an attack produces a summary, not a flood. “Send test” shows the mail server’s or webhook’s own answer, a Recent alerts table records what was sent where, and an optional daily digest sums up the day.
Visitor Log and Audit Log Every request with its IP, country (with the free MaxMind GeoLite2 database), method, page, browser and status, kept for 30 days by default and searchable over the whole period: date ranges, country, method and HTTP status filters, sortable columns, and a CSV export that follows the filters. The audit log records administrator actions (users and roles, plugins and themes, blocks, unlocks and whitelisting, exports) and can be searched, filtered by action, user and date, and exported.
Post-Breach Command Center The recommended order of response in one place: audit administrator accounts, terminate all sessions, rotate the secret keys and salts, lock the site down, scan the database, reinstall WordPress core and plugins, force a password reset for every user, deactivate plugins, clear caches, and download an incident report. Results stay on screen after the logout these actions cause.
Why Atlant Security?
Status you can trust – a check passes only when the plugin has verified it on your server, not because a checkbox is ticked.
One plugin, not five – firewall, logins, scanning, hardening, alerts, logs and recovery share one block list and one whitelist.
No external dependencies – no CDN, external fonts or telemetry; outside services only for the features you switch on (see External Services).
Safe Mode – one line in wp-config.php pauses every blocking feature if you lock yourself out.
Your data, your choice – nothing is deleted on deactivation; deleting the plugin asks whether to keep its data.
Accessible and multisite-ready – labelled controls, keyboard focus rings and phone layouts; activation and uninstall cover every subsite.
External Services
The plugin contacts these services only when you switch on the feature that needs them.
Cloudflare IP ranges
Used to check that a request really comes from a Cloudflare edge server before the visitor IP in its CF-Connecting-IP header is trusted.
Data sent: none; the plugin downloads Cloudflare’s public IP range lists.
When: weekly (cron aswp_refresh_cloudflare_ips ), only while Cloudflare integration is on.
Endpoints: https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6
Cloudflare Terms of Use , Cloudflare Privacy Policy
MaxMind GeoLite2 database
Downloads the GeoLite2-Country database, which is stored on your server and used to show visitor countries.
Data sent: your MaxMind license key, to authenticate the download. No visitor data.
When: when you download it, then weekly (cron aswp_update_geoip_db ), only while GeoIP is on and a license key is set.
Lets requests from Google’s published IP ranges through the plugin’s protections when they also identify as Googlebot or
See it in action
Screenshots & previews.
Security Dashboard: the protection status strip, visitors online now, requests, bots and blocks, live visitors, traffic and top IPs.Settings search: type a word to find any setting on any page and jump straight to it.Web Application Firewall: mode, block response, auto-blocking and rate limits.Malware Scanner: file and database findings, progress, and the false-positive list.Login Security: brute-force lockout settings and the attempt monitor with Unlock, Reset, Block and Whitelist.Two-factor setup in the user profile: scan the QR code with any authenticator app.Hardening Status: each check verified on the server, with Enable, Disable, Re-check and How to fix.Visitor Log: search, date range, country, method and status filters, sortable columns and CSV export.Audit Log: every administrator action, searchable and filterable, with CSV export.Notifications: what sends an alert at your threshold, and a record of every alert sent.Session Security: who is logged in, with Log out everywhere for each account.Post-Breach Command Center: the recommended response order and the emergency actions.IP Block List: blocked addresses with reason, hit count and expiry, next to the whitelist.
02 / Source details
Gettingstarted.
01In WordPress, go to Plugins > Add New , search for “Atlant Security”, then click Install Now and Activate . Or upload the atlant-security folder to /wp-content/plugins/ and activate it on the Plugins screen.
02The Setup Wizard opens. It sets up the firewall, login protection, hardening, visitor logging and alerts, and whitelists your own IP so you cannot lock yourself out. Run it again at any time from the plugin menu.
03Open Atlant Security in the admin menu for the dashboard. The search box at the top of the plugin menu finds any setting.
Minimum Requirements
04WordPress 6.0 or higher
05PHP 8.0 or higher
Safe Mode
If you ever get locked out of your site, add this line to wp-config.php :
define( 'ASWP_SAFE_MODE', true );
It pauses every blocking feature (firewall, IP blocks, login lockouts, rate limits, custom login URL, REST API policies and honeypot bans) and mutes alerts, while keeping the admin area available so you can fix the settings. Remove the line afterwards.
03 / Source details
Frequently asked questions.
How do I find a setting?
Type in the search box at the top of the plugin menu, or press “/” on any plugin page. It searches every setting, panel and page as you type; choose a result to jump to it, and the setting is highlighted.
I locked myself out
Add define( 'ASWP_SAFE_MODE', true ); to wp-config.php : it pauses every blocking feature while keeping the admin area available. If another administrator can still log in, they can lift your lockout under Login Security > Brute Force Attempt Monitor (Unlock) or remove your IP from the IP Block List . As a last resort, rename the folder wp-content/plugins/atlant-security over FTP (for example to atlant-security-off ), log in, rename it back, and whitelist your IP.
The firewall is blocking my page builder (Elementor, Divi)
Switch the WAF to Log Only , repeat what was blocked, then check Top Triggered on the WAF page, or look for “WAF log only” in the Visitor Log , to see which rule matched. Page builders can trigger false positives with the encoded content in their save requests. Logged-in administrators are not inspected on admin pages.
Users keep getting logged out unexpectedly
This happens when Session Binding is set to bind to the IP address, which is off by default because mobile networks, VPNs and IPv6 change addresses constantly. Go to Session Security and turn off “Bind to IP Address”, keeping User-Agent binding on. “Exempt Administrators” lifts every session restriction for administrators.
Will I get an email for every blocked attack?
No. Each kind of alert is sent at most once per 15 minutes, and login lockouts, firewall auto-blocks and honeypot bans at most once per 6 hours; repeats in between are counted and reported in the next alert or a summary. Choose the minimum severity on the Notifications page, which lists every event that can send an alert.
Email alerts are not arriving
Click Send test next to the address on the Notifications page: it waits for the answer and shows the mail server’s own error, if there is one. WordPress sends mail with PHP’s mail() by default, which many hosts block; an SMTP plugin such as WP Mail SMTP or FluentSMTP routes it through a proper mail provider.
Does two-factor authentication work with the WordPress mobile app, Jetpack or XML-RPC?
Yes, with an application password. Those tools cannot ask for a code, so accounts with 2FA must use an application password ( Users > Profile > Application Passwords ) for XML-RPC and other API logins. Accounts without 2FA are unaffected.
The Hardening page says PHP still runs in the uploads folder
The plugin writes the blocking rule into wp-content/uploads/.htaccess and then tests it. If PHP still runs, the server ignores .htaccess there: nginx and IIS never read it, and Apache can be set not to. The Hardening page shows the rule for your host to add to the server configuration, and Re-check tests again.
Cron Guard flagged a scheduled task
Cron Guard compares the scheduled tasks with the snapshot taken when it started and flags new or very frequent ones. If you recognise the task (a plugin you just installed, for example), click Approve ; if you do not, remove it and run a malware scan. Tasks scheduled by WordPress core and by Atlant Security itself are never flagged.
Will this slow down my site?
No. The firewall runs once per request at init priority 0 against a fixed rule set, the rate limiter uses APCu when available, and the visitor log is one lightweight INSERT per request.
The malware scan is running slowly
Lower “Files per Batch” to 20 or 30 on shared hosting. The scanner works in batches to avoid timeouts and keeps running in the background if you leave the page. Files larger than 5 MB are skipped.
How does the honeypot protect legitimate crawlers?
Three ways: trap URLs are listed as Disallow rules in robots.txt, hidden links carry rel=”nofollow”, and 30 known search engine, social media and uptime-monitoring bots are recognised by their user agent and receive a 404 instead of a ban. AI crawlers you have allowed are protected too.
Does this plugin work with multisite?
Yes. Activation, deactivation and uninstall cover every subsite, and each site has its own settings and logs. Session lists are limited to each site’s own users, and network super admins are never listed to site administrators.
What happens to my data when I deactivate the plugin?
Nothing is deleted on deactivation. When you delete the plugin, a dialog asks whether to keep or remove all its data; you can also set this under Settings > Delete data on uninstall .
FinderPress Media Auditor helps site administrators scan for broken images, missing Media Library files, unreachable media URLs, and other media issues across WordPress content. Use it to audit images, video, audio, PDFs, featured images, and attachment files without sending scan data to an external
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
