HT Security
Complete Security Suite: Security Headers, CVE Detection, Core Integrity, Login Alerts, Plugin Update Management, Force Cron, and Maintenance Mode.
Solid choice
HT Security is a solid plugin choice in 2026, with a few things worth checking first. It runs on 100+ sites, is rated 5/5 and was last updated 2 months ago, and scores 66/100 on our health check.
- Small user base (100+ active installs)
- Very few reviews so far
- Needs PHP 8.2 or newer
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where HT Security stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| cve | #7 |
| headers | >100 |
| maintenance | >100 |
| security | #58 |
| vulnerabilities | #98 |
Version adoption
Share of active sites per release.
Rating breakdown
★★★★★★★★★★ 5 from 1 reviews
About HT Security
From the official readme · v1.7.1Description
HT Security is a complete security suite for WordPress, offering multiple layers of protection for your website.
Important – External Service:
This plugin queries the National Vulnerability Database (NVD) API to check for known CVE vulnerabilities. Requests are made to:
* API URL: https://services.nvd.nist.gov/rest/json/cves/2.0
* Terms of Use: https://nvd.nist.gov/general/legal-disclaimer
* Privacy Policy: https://www.nist.gov/privacy-policy
* Frequency: Automatic check every 12 hours or manual on-demand
* Data sent: Name and version of WordPress/installed plugins (no personal data is sent)
The NVD API query is essential for the plugin’s CVE vulnerability detection functionality.
Key Features
- Security Headers – HSTS, X-Frame-Options, Content-Security-Policy, and more
- Login Alerts – Email notifications for successful and failed login attempts with rate limiting
- Login Captcha – Built-in SVG numeric captcha or Cloudflare Turnstile for login, password reset, and registration forms
- Core Integrity Check – Verify WordPress core files against official checksums with 24h cache
- CVE Vulnerability Detection – Check WordPress Core and active plugins against NVD database
- User Enumeration Protection – Block user enumeration via REST API and author parameters
- Maintenance Mode – Maintenance mode with authorized IP whitelist (IPv4, IPv6, CIDR support)
- File Permissions Audit – Audit and automatic correction of critical file permissions
- Plugin Security Indicators – Visual badges on plugins page showing vulnerability status
- Plugin Update Management – Notify when plugins need updates; optionally auto-update only selected plugins
- Force Cron – Secret HTTP ping to spawn WordPress cron when official wp-cron is unreliable
CVE Detection Features
- Integration with NVD (National Vulnerability Database) API 2.0
- Check WordPress Core and active plugins for known vulnerabilities
- Intelligent batch processing with rate limiting
- 8 layers of anti-false-positive validation
- Vulnerability badges on plugins page (enable/disable option)
- Dismissible alerts per user
- Email notification when vulnerabilities are detected
- Automatic check every 12 hours
- NVD API Key support (increased rate limit)
Security Improvements in v1.5.0
- IP Spoofing Fix – Properly detects real IP behind Cloudflare, proxies, and load balancers
- Capability Check Fix – Authorization verified before processing
- Rate Limiting by IP – More granular rate limiting for login alerts
- Input Validation – Maximum length validation for feedback form
Supported Languages
- English (US) – 100%
- English (UK) – 100%
- Português do Brasil – 100%
- Português de Portugal – 100%
- Español – 100%
License
This plugin is licensed under the GNU General Public License v2.0 or later. For more information, visit https://www.gnu.org/licenses/gpl-2.0.html.
Installation
- Upload the
ht-securityfolder to the/wp-content/plugins/directory - Activate the plugin through the ‘Plugins’ menu in WordPress
- Go to ‘Settings > HT Security’ to configure
Frequently asked questions
When does the plugin send emails?
Successful logins, failed logins, CVE vulnerabilities (if enabled), vulnerable WordPress version alerts (if enabled), and available plugin updates (if Plugin Update Management is enabled).
Can I disable the security headers?
Yes, through the settings page.
Does the plugin check WordPress Core integrity?
Yes, since version 1.1.0 we added this functionality to provide clear security visibility for administrators.
How does CVE vulnerability detection work?
The plugin queries the NVD (National Vulnerability Database) to check for known vulnerabilities in WordPress Core and active plugins. The check runs automatically every 12 hours and can also be run manually.
Do I need an NVD API Key?
It’s not required, but recommended. Without an API Key, the rate limit is 5 requests per 30 seconds. With a free API Key, it increases to 50 requests per 30 seconds, making checks much faster.
Can vulnerability badges be disabled?
Yes! In HT Security settings there’s an option to disable badges on the plugins page. The top alert will continue to work.
How do dismissible alerts work?
You can close alerts on the plugins page by clicking the X. They won’t reappear until the next vulnerability check. The dismissed state is saved per user.
How does user enumeration blocking work?
The plugin blocks attempts to list users through the REST API and redirects via author parameters.
How do I enable the login captcha?
Go to Settings > HT Security > Login Captcha, enable it and choose SVG (built-in) or Cloudflare Turnstile (requires free keys from https://dash.cloudflare.com → Turnstile). The captcha applies to the login, password reset and registration forms.
Does the SVG captcha send data anywhere?
No. The SVG captcha is generated entirely on your server and never makes external requests. The Cloudflare Turnstile option loads the official Turnstile script from challenges.cloudflare.com and verifies the token via Cloudflare’s siteverify API.
Does maintenance mode affect administrators?
No, logged-in administrators can continue accessing the site normally.
Does automatic permission correction always work?
It depends on server settings. In some cases, manual correction via FTP/SSH may be necessary.
Does the anti-false-positive system work well?
Yes! We implemented 8 layers of validation: name validation, version validation, generic term filtering, addon detection, license variant detection, word matching, word count ratio, and more. This eliminates over 99% of false positives.
Will new features be added?
Yes, we’re constantly improving the plugin with new features and security enhancements.
Changelog
Improved SVG captcha: rotated banner, better visuals, and a refresh button to get a new code without reloading. Fixes for the refresh button (login footer printing and WAF-safe URL-encoded requests) and WordPress Plugin Check compliance. Recommended update.
1.7.0
- NEW: Login Captcha
- Protect wp-login.php forms (login, password reset, registration) with a captcha
- SVG numeric captcha (built-in, no external requests, works offline), with per-IP rate limiting
- Cloudflare Turnstile option (managed challenge) when site/secret keys are configured
- Fail-closed: if Turnstile is selected without keys, logins are blocked (no silent downgrade to SVG)
- Captcha skipped for XML-RPC, REST API and WP-CLI (form logins only)
- Admin preview button (AJAX) to test the captcha without leaving the settings page
- Maintenance: DolutechAI added as contributor
- Development ecosystem now includes DolutechAI alongside WPFastSec
- Security: IP Spoofing Fix (CWE-290)
- Proxy headers (X-Forwarded-For, CF_CONNECTING_IP, X-Real-IP) are now only trusted when the immediate peer is a configured trusted proxy
- New “Trusted Proxy IPs” setting with Cloudflare ranges reference
- Removed HTTP_CLIENT_IP trust; X-Forwarded-For now uses the last hop (real client)
- Security: Force Cron hardening
- Ping secret now uses a URL-safe charset; fallback query URL works correctly
- Token validated with strict regex (alphanumeric, 32 chars)
- Security: Maintenance mode fixes
- wp-login.php is no longer blocked by maintenance mode (exact path comparison)
- CIDR masks validated per address family (IPv4 <= 32, IPv6 <= 128); /0 rejected
- Security: User enumeration
- Also blocks ?author=slug and author_name parameters (previously only numeric)
- Fix: NVD keyword search double-encoding
- keywordSearch was URL-encoded twice, causing silent “no vulnerabilities” results
- Fix: CVE check reliability
- Overlap lock prevents concurrent scheduled/manual checks
- Time cap enforced inside each batch; results only overwritten on completed checks
- Progress stored as transient; cron scheduled only when CVE alerts are enabled
- Fix: Emails
- Plain-text emails no longer contain HTML entities (esc_html removed)
- Site name sanitized in email subjects and From headers (header injection hardening)
- Cleanup: uninstall.php
- Removes all plugin options, transients, user meta, and cron events on uninstall
- Compatibility: Tested up to WordPress 7.0
1.7.1
- Improved: SVG captcha usability
- Captcha banner now rotates as a whole (plus per-character rotation) to stay human-readable while resisting OCR
- Redesigned SVG: gradient background, rounded corners, line and dot noise
- New refresh button to generate a new code without reloading the page (per-IP rate limited, validates the existing challenge)
- Fix: Captcha refresh button not working
- Script is now printed on the login footer (the login page never calls wp_footer(), so footer-enqueued scripts were never loaded)
- Refresh request switched from multipart FormData to URL-encoded, which some WAFs/firewalls block on admin-ajax.php
- Compliance: WordPress Plugin Check
- Escaped Turnstile site key output; sanitized cron ping token inputs
- Renamed auto-update allowlist option to
htsec_autoupdate_pluginswith automatic migration of the legacy value - Aligned “Tested up to” between plugin header and readme (7.0); author header now reads WPFastSec / DolutechAI
- Nonce and resource-version phpcs ignores placed on the exact flagged lines
1.6.1
- Security: Force Cron ping
- Prefer
X-HTSEC-Cron-Tokenheader; query-string token kept as fallback - UI documents header-based curl and HTTPS; warns about access-log leakage
- Prefer
- Security: Secret reveal
- Replaced GET reveal link with POST + nonce and one-shot per-user transient (60s)
- Security: Plugin updates
- Sanitize plugin names/versions in update alert emails
- Overlap lock (10 minutes) to prevent concurrent update checks
- Inline notice explaining HT Security controls native auto-updates when enabled
1.6.0
- NEW: Plugin Update Management
- Enable/disable scheduled plugin update checks (twice daily)
- Modes: Notify only, or Notify and auto-update selected plugins
- Per-plugin allowlist for automatic updates
- Email alerts via existing alert email setting (with deduplication)
- Manual “Check for plugin updates now” action
- Uses WordPress native
autoupdatefilter andwp_maybe_auto_update() - Respects DISALLOW_FILE_MODS / automatic updater file-mod policy
- NEW: Force Cron
- Toggle to enable a secret HTTP ping endpoint that calls
spawn_cron() - Cron health status UI (DISABLE_WP_CRON, last ping, last spawn, overdue events)
- Regenerable ping secret; rate-limited ping handler
- Soft assist spawn on admin when Force Cron is enabled
- Toggle to enable a secret HTTP ping endpoint that calls
- Improved: Internationalization
- Source strings converted to English (WordPress.org convention)
- Regenerated POT/PO/MO for pt_BR, pt_PT, es_ES, en_GB
- Removed redundant en_US catalog (English is the source language)
- Security
- Capability check added to manual CVE check POST handler
- Centralized activation/deactivation cron cleanup for CVE and plugin-update events
1.5.0
- NEW: CSP Custom Module (Advanced)
- Custom Content-Security-Policy configuration
- 4 preset modes: Strict, Moderate, WordPress Optimized, Custom
- Report-Only mode for testing without blocking
- Disabled by default to avoid breaking existing sites
- Custom directives for all CSP directives (default-src, script-src, etc.)
- NEW: WordPress Version Vulnerability Check
- Automatic detection of vulnerable WordPress versions
- Visual alert on plugin settings page with severity breakdown
- Email notification when vulnerable version detected (enabled by default)
- Direct link to update WordPress
- Checks enabled by default
- CRITICAL Security Fix: IP Spoofing Vulnerability (CWE-290)
- Added
htsec_get_user_ip()function to detect real IP behind Cloudflare, proxies, and load balancers - Support for CF_CONNECTING_IP, X-Forwarded-For, X-Real-IP headers with fallback
- Added
- CRITICAL Security Fix: Capability Check Order (CWE-862)
- Permission verification now occurs BEFORE processing in file permissions module
- Improved: Rate Limiting by IP
- Login alerts rate limiting is now per-IP for better granularity
- Added: Input Length Validation
- Maximum 5000 characters validation for feedback form
- Fixed: Deprecated Function
- Replaced
current_time('timestamp')withtime()(deprecated since WP 5.3)
- Replaced
- Added: API Response Validation
- Validate NVD API response before processing
- Added: AJAX Capability Check
- Added capability check in plugin indicators AJAX handler
- Improved: Internationalization
- 153 strings translated in 5 languages (pt_BR, pt_PT, en_US, en_GB, es_ES)
- All .mo files compiled
- Removed: Legacy Code
- Removed
ht-security-antigofolder
- Removed
- Updated: WordPress Compatibility
- Tested up to WordPress 6.9.4
1.4.0
- Added: Complete CVE Check Module
- Integration with NVD API 2.0
- Check WordPress Core and active plugins
- Batch processing with rate limiting
- Added: Internationalization (i18n)
- Support for pt_BR, pt_PT, en_US, en_GB, es_ES
- Added: IP Validation with CIDR Support
- IPv4, IPv6, and CIDR notation support in Maintenance Mode
- Added: Rate Limiting for Login Alerts
- 1 email per 5 minutes per type per IP
- Added: Core Check Cache
- 24h transient cache with manual refresh button
- Improved: Documentation
- Complete documentation in /docs directory
Screenshots
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best HT Security alternatives
All cve plugins →FAQ
HT Security: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 4, 2026
Is HT Security free?
Yes. HT Security is free to download and use from the official WordPress.org plugin directory.
Is HT Security safe to use in 2026?
HT Security is a solid plugin choice in 2026, with a few things worth checking first. It runs on 100+ sites, is rated 5/5 and was last updated 2 months ago, and scores 66/100 on our health check.
How many websites use HT Security?
HT Security is active on 100+ WordPress websites and has been downloaded 1,701 times since it launched in April 2025. It was downloaded 134 times in the last 30 days.
Does HT Security work with WordPress 7.1?
HT Security is officially tested up to WordPress 7.0.6, while the latest release is 7.1.2. It may still work, but try it on a staging site first.
What PHP version does HT Security need?
HT Security requires PHP 8.2 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was HT Security last updated?
The latest version, 1.7.1, was released on August 10, 2026 (2 months ago).
Who makes HT Security?
HT Security is developed and maintained by WPFastSec.
What are the best alternatives to HT Security?
The most popular alternatives to HT Security are Catcher24 Connector (<10 installs), CodeMedic SupplyScope (<10 installs) and Haq Security CVE Monitor (<10 installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
