Protector – Malware Removal, Firewall & Core Repair
Every day, thousands of WordPress sites are hacked. Most security plugins offer protection, but they come with a massive cost: they slow down your server with bloated features and complex settings.
Use with caution
Protector works, but test it on a staging site before relying on it in 2026. It runs on 200+ sites, is rated 5/5 and was last updated 5 months ago, and scores 54/100 on our health check.
- Small user base (200+ active installs)
- Very few reviews so far
- Only tested up to WordPress 6.9 (latest is 7.1)
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where Protector stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| Brute Force | #86 |
| firewall | #31 |
| malware scanner | #33 |
| repair core | #3 |
| security | >100 |
Version adoption
Share of active sites per release.
Rating breakdown
★★★★★★★★★★ 5 from 3 reviews
About Protector
From the official readme · v4.0.4Description
Every day, thousands of WordPress sites are hacked. Most security plugins offer protection, but they come with a massive cost: they slow down your server with bloated features and complex settings.
Protector is different. It is a lightweight, AI-ready security layer that turns your WordPress site into a digital fortress without compromising speed. Whether you are trying to recover a hacked site or proactively defend your business, Protector delivers enterprise-grade security that anyone can configure.
With our new 1-Click Security Overview Dashboard, you can activate all recommended protections and block 98% of automated attacks in under 8 seconds.
📖 Read the Official Documentation here
🦠 Malware Threat Scanner & Auto-Repair
Don’t just find malware; destroy it. Our deep, recursive local scanner verifies your WordPress integrity without crashing your server:
* Core Integrity Verification: Cross-references all Core files against the official WordPress.org checksums.
* Advanced Pattern Detection: Detects suspicious code patterns (like eval, base64_decode, shell_exec) hidden in your files.
* 1-Click Auto-Repair: Found a modified core file? Click “Repair” and Protector will automatically fetch a clean, original version directly from the official WP SVN and overwrite the infected file.
🛡️ Login Fortress (Brute-Force Protection)
Hackers relentlessly target the wp-login.php page. We make it disappear.
* Secret Login URL: Hide wp-login.php completely. Any unauthorized attempt will be instantly redirected to a custom URL of your choice.
* Smart Honeypots: Inject invisible fields into your login and comment forms to trap and block spam/brute-force bots automatically.
* Block Username Scanning: Prevent attackers from discovering your admin usernames via ?author=1 enumeration.
🔒 1-Click Site Hardening
Lock down common vulnerabilities instantly:
* Security Headers: Protect against XSS, Clickjacking, and MIME-Sniffing attacks with a single toggle.
* XML-RPC Control: Disable XML-RPC completely to eliminate one of the biggest brute-force attack vectors on WordPress.
* Version Obfuscation: Hide your WordPress version from the source code so hackers can’t target known exploits.
* Restrict REST API: Block public access to endpoints that expose sensitive user data.
📊 Live Attack Log
Peace of mind you can actually see. Monitor every blocked attack, triggered honeypot, and deleted malware in real-time straight from your dashboard.
🚀 Upgrade to KloxStudios Pro
Need absolute maximum power? Protector integrates seamlessly with the KloxStudios Cloud AI. Pro users unlock Cloud AI Malware Verification for 3rd-party plugins/themes, Automatic IP Lockouts, Instant Admin Login Alerts (Email & Webhook), and 2FA.
Installation
You don’t need a PhD in cybersecurity to secure your site.
1. Upload the protector-security folder to the /wp-content/plugins/ directory (or install directly via the WP Plugin directory).
2. Activate the plugin through the ‘Plugins’ menu in WordPress.
3. Navigate to the new “Protector” menu in your dashboard.
4. Click the massive yellow “Activate Full Protection Now” button on the dashboard for instant, 1-click security.
For detailed configuration guides, visit our Official Documentation.
Frequently asked questions
How do I use the secret login URL?
Go to the “Protector” menu > “Login Fortress” tab. Toggle the ‘Change your secret login URL’ option. Set your ‘Secret Login Term’ (e.g., mysecretaccess). Save changes and use your new login URL: yoursite.com/wp-login.php?mysecretaccess.
What if I forget my secret term and get locked out?
Don’t panic! You can temporarily disable the plugin by renaming the protector-security folder inside wp-content/plugins/ via FTP or your hosting File Manager. This will instantly restore the default wp-login.php access.
Will the Malware Scanner slow down my site?
No! The scanner uses AJAX-based asynchronous batch processing. This means it scans your files in small chunks, preventing server timeouts and CPU spikes, even on massive websites with thousands of files.
Changelog
Version 4.0.0 is a massive upgrade! We've transformed Protector into a full-featured security suite with a built-in Malware Scanner, Bot Honeypots, and 1-Click Site Hardening.
4.0.4
- New: “Military Scan” mode – Expanded recursive scanning to the entire WordPress installation (Root, Admin, Includes, Vendor).
- Security: Hard-linked Anti-Piracy architecture for Pro features, ensuring engine integrity.
- Security: Refined Secret Login URL redirection logic to prevent false-positives during POST requests.
- Performance: Optimized AJAX batching for large-scale file processing.
- Tweak: Updated translations and documentation links.
4.0.3
- Fix: Resolved an issue where the Secret Login URL feature would incorrectly redirect valid users during form submission (POST request). The secret term is now securely validated during the login process.
- Tweak: Minor internal code refactoring for authentication hooks.
4.0.2
- Fix: Resolved a bug in the Settings API where saving one tab disabled the options in other tabs.
- Tweak: Separated option groups to improve form modularity and save actions.
4.0.0
- Major Overhaul: Complete UI/UX redesign with a new Security Overview Dashboard.
- New: Malware Threat Scanner (verifies WP core files and detects suspicious patterns).
- New: Auto-Repair modified Core files directly from WordPress.org SVN.
- New: Login & Comment Honeypots to trap spam and brute-force bots.
- New: Site Hardening options (Security Headers, Disable XML-RPC, Restrict REST API).
- New: Live Attack Log to monitor blocked threats in real-time.
- New: Quick Setup – Secure your site in 1-click.
- Performance: AJAX-based batch scanning to prevent server timeouts on large sites.
- Security: Added Pro Add-on architecture readiness.
2.7.3
- Fix: Resolved “Too Many Redirects” error by switching to wp_redirect.
- Security: Added data sanitization and escaping for all inputs.
- Performance: Removed all external CSS/JS dependencies (FontAwesome/Grids).
2.6.0
- New Security Algorithm.
Screenshots
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best Protector alternatives
All Brute Force plugins →
FAQ
Protector: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 1, 2026
Is Protector free?
Yes. Protector is free to download and use from the official WordPress.org plugin directory.
Is Protector safe to use in 2026?
Protector works, but test it on a staging site before relying on it in 2026. It runs on 200+ sites, is rated 5/5 and was last updated 5 months ago, and scores 54/100 on our health check.
How many websites use Protector?
Protector is active on 200+ WordPress websites and has been downloaded 6,232 times since it launched in April 2017. It was downloaded 147 times in the last 30 days.
Does Protector work with WordPress 7.1?
Protector is officially tested up to WordPress 6.9.9, while the latest release is 7.1.2. It may still work, but try it on a staging site first.
What PHP version does Protector need?
Protector requires PHP 7.4 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was Protector last updated?
The latest version, 4.0.4, was released on April 30, 2026 (5 months ago).
Who makes Protector?
Protector is developed and maintained by Marcello Ruoppolo.
What are the best alternatives to Protector?
The most popular alternatives to Protector are Limit Login Attempts Securi… (1M+ installs), CloudSecure WP Security (100K+ installs) and Anti-Malware Security and B… (100K+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
