Security dashboard
A score out of 100 with a clear status, a threat graph for 24 hours, 7 days or 30 days, and recommendations you can fix in one click.
How the dashboard works
NewVersion 1.0.0 with a 10-minute setup guide
Your WordPress site, secured at every layer.
Wonder Secure brings a firewall, malware scanner, file integrity checks, login protection, two-factor authentication and image protection into one plugin, and explains everything it finds in plain language.
- Free under GPLv2
- WordPress 6.0+ and PHP 7.4+
- Works on shared hosting
- No data sent to us
Firewall activeChecks every request before WordPress loads
Two-factor requiredFor the Administrator role
9admin screens, one menu
21checks behind your security score
<50msfirewall overhead per request
0bytes of your data sent to Wonderfolks
Features
Everything your site needs to stay safe, in one place.
Replace a stack of single-purpose security plugins with one that shares a single log, a single score and a single set of alerts.
Malware scanner
Compares core, plugin and theme files with the official WordPress.org copies, hunts for malware signatures and restores changed files in one click.
Run your first scanWeb application firewall
Blocks SQL injection, cross-site scripting, path traversal, code injection and bad bots, with country blocking, IP lists and rate limiting.
Configure the firewallLogin security
Brute force lockouts, two-factor authentication for any role, reCAPTCHA or hCaptcha, and a custom login address that hides wp-login.php.
Lock down loginsAsset protection
Protect the whole site, chosen folders or single images from hotlinking, right-click saving and dragging, and stop PHP from running in uploads.
Protect your mediaAlerts and reports
Real-time emails for admin logins, file changes, malware and attacks, plus daily, weekly or monthly summaries with your own branding.
Set up alertsAnd much more, included
- Hide the WordPress version
- Disable XML-RPC and the file editor
- Block user enumeration
- Security headers and optional HSTS
- Reversible quarantine with backups
- WPScan vulnerability checks
- Scheduled daily or weekly scans
- Activity log with CSV export
- Ready-made Nginx configuration
- Rule updates without plugin updates
- Emergency access from wp-config.php
- Hooks and a REST API for developers
Security dashboard
Know where you stand in one glance.
The dashboard turns raw security events into a score and a short to-do list, so you always know what to fix next.
- Score and status. 80 and above is Secure, 55 to 79 Needs attention, below 55 At risk.
- Threat analytics. Blocked attacks, failed logins, lockouts and scan findings over 24 hours, 7 days or 30 days.
- One-click fixes. Recommendations that a setting can solve come with a Fix button.
- Live activity. Recent events and the IPs attacking you most.
Malware scanner
Find changed files and malware, then fix them in a click.
The scanner works through your site in short batches, so it finishes even on shared hosting without timing out.
- Integrity checks against the official WordPress.org checksums for core, plugins and themes.
- Malware signatures plus a check for PHP files hiding in your uploads folder.
- Repair or quarantine. Restore a clean copy from WordPress.org, or move a file somewhere the web cannot reach. Both can be undone.
- Vulnerability alerts through the WPScan database, and outdated-version warnings without it.
Findings
4,812 files checkedCriticalQuarantine
Malware signature: obfuscated eval
wp-content/uploads/2026/10/cache.phpHighRepair
Modified core file
wp-includes/functions.phpHighUpdate
Known vulnerability, fixed in 5.9.1
contact-form-plugin 5.8.0MediumIgnore
Unknown file in core folder
wp-admin/includes/old-backup.php
Login security
Stop password guessing before it starts.
Most attacks on WordPress go after the login page. Wonder Secure closes that door from four sides.
- Two-factor authentication with Google Authenticator, Microsoft Authenticator, 1Password, Authy or any TOTP app, plus backup codes.
- Enforce it by role, so every administrator and editor has to enrol.
- Brute force lockouts after a set number of failed attempts, and instantly for made-up usernames.
- A hidden login page. wp-login.php and wp-admin return “not found” to strangers.
Two-factor sign-in
Enter the 6-digit code from your authenticator app.
48192
Verify and log in
Lost your phone? Use a backup code.
Login activity
203.0.113.24Locked out
198.51.100.73 of 5 tries
admin (you)2FA passed
Lockouts end automatically, or unlock an IP yourself.
How it works
Protected in minutes, not days.
Three steps take a fresh install to a site that is scanned, firewalled and watched around the clock.
-
Install and activate
Upload the zip from Plugins > Add New > Upload Plugin and activate it. The firewall starts protecting your site straight away.
Installation steps -
Tell it how visitors reach you
Behind Cloudflare or a load balancer? Pick the right visitor IP source on the Firewall screen, then run your first scan from the Malware Scanner.
Your first 10 minutes -
Follow the recommendations
Work down the dashboard list, turn on two-factor for administrators, and add an email for alerts. Your score climbs as you go.
Raising your score
Privacy and trust
A security plugin that keeps your data on your server.
Wonder Secure stores what it learns in your own database. Optional services stay off until you switch them on and enter your own keys.
Nothing sent to Wonderfolks
No tracking, no phone-home, no account to create. Security events stay in your WordPress database.
Encrypted two-factor secrets
Two-factor secrets are encrypted with the PHP sodium extension, and backup codes are stored as password hashes.
Opt-in services only
WPScan, IPinfo, reCAPTCHA, hCaptcha and the rule feed are only contacted after you turn them on.
Automatic log cleanup
Activity older than your retention period, 90 days by default, is deleted for you.
Administrators only
Every screen and API route needs the manage_options capability and a valid security nonce.
Never locked out for good
One line in wp-config.php turns off the firewall or the hidden login page if you ever lock yourself out.
User guide
Step-by-step help for every screen.
The user guide walks through setup, explains each setting in plain language, and tells you what to do if something goes wrong.
FAQs
Questions, answered.
What is Wonder Secure?
A WordPress security plugin by Wonderfolks Interactive. It combines a web application firewall, malware scanner, file integrity checks, login protection, two-factor authentication, image protection, hardening options and email alerts, all managed from one menu.
Will it slow my site down?
The firewall runs once per request with a cached rule set, keeping the overhead well under 50 ms. Scans run in short batches in the background, and you can lower the work per batch on slow hosting.
Does it work on Nginx?
Yes. Everything runs in PHP except the rules that normally live in .htaccess. For those, the Asset Protection screen shows a ready-made Nginx snippet to add to your server block.
Do I need a WPScan account?
Only for the vulnerability database. Without a token, Wonder Secure still warns you about outdated WordPress core, plugins and themes. The free WPScan plan allows 25 lookups a day, and results are cached for 12 hours.
I'm behind Cloudflare. Is there anything I should change?
Yes, right after you activate the plugin. Open Wonder Secure > Firewall and set Visitor IP address source to the Cloudflare header. Automatic blocking is on by default, and without this change every visitor looks like a Cloudflare server, so blocking one attacker could block everyone.
What happens if I lock myself out?
Add define( 'WONDERSECURE_DISABLE_FIREWALL', true ); or define( 'WONDERSECURE_DISABLE_HIDE_LOGIN', true ); to wp-config.php, log in, fix the setting and remove the line. Lost your two-factor device? Use a backup code, or ask another administrator to reset it.
Can it really stop people saving my images?
Hotlink protection reliably stops other sites embedding your images. Right-click and drag protection is a deterrent: no web technique can fully stop a determined visitor from saving an image they can see.
How do firewall rules and malware signatures stay current?
They ship with the plugin and can also be pulled daily from a signature feed URL under Settings, without updating the plugin. Every rule is checked before it is used.
What happens to my data if I delete the plugin?
Deactivating removes scheduled tasks and server rules. Deleting keeps your data unless you turn on "Delete all Wonder Secure data when the plugin is deleted" under Settings, which removes its tables, settings, quarantine and two-factor secrets.
About us
Made by the folks at Wonderfolks.
Wonderfolks Interactive builds software for teams who would rather get on with their work. Wonder Secure is how we keep WordPress sites safe: serious protection, explained in words anyone can follow.
Questions or support:
hello@wonderfolks.com
Plain language
Every finding says what happened and what to do about it, without security jargon.
Light on your server
Batched scans and a cached firewall, built to run on ordinary shared hosting.
Your data stays yours
Events, logs and secrets live in your own database, never on ours.
Open by default
Released under GPLv2, with hooks and a REST API so developers can extend it.
Give your site a security team that never sleeps.
Install Wonder Secure, run your first scan and see your security score in the next ten minutes.