Vigilant

Premium Security. Zero Cost.

Vigilant provides enterprise-level WordPress security features completely free. No premium version, no upsells, no hidden features behind paywalls.

Protect your site with a complete security suite: firewall, two-factor authentication, brute force protection, security headers, file integrity monitoring, closed plugin detection, malware detection, user management, security audit logging, under attack mode and much more.

Once activated, Vigilant immediately applies firewall rules against common attacks (SQL injection, XSS, file inclusion), security headers, login attempt monitoring, XML-RPC blocking, WordPress version hiding and sensitive file protection (.htaccess, wp-config.php), after automatically backing up your existing configuration files.

One-Click Security Presets

Choose a preset and get protected instantly:

Standard – Balanced security suitable for most websites. Enables all modules with sensible defaults that won’t interfere with normal site operation.

Maximum Security – Strictest settings for high-security sites. Tighter rate limits, stronger CSP rules, mandatory admin notifications. May require fine-tuning for some setups.

You can always customize individual settings after applying a preset.

Under Attack Mode

Is your site under active attack? Activate Under Attack mode with one click and stop malicious traffic instantly:

• JavaScript challenge – Every visitor must pass an automatic browser verification before accessing your site. Real browsers solve it in seconds, bots get blocked completely
• Aggressive rate limiting – Requests limited to 30 per minute with 15-minute blocks for offenders
• HTTP method restriction – Only GET, POST and HEAD allowed; PUT, DELETE, PATCH, OPTIONS and TRACE are blocked
• Empty user agent blocking – Requests without a user agent header are rejected
• Full XML-RPC lockdown during the attack
• REST API restriction – Only authenticated users can access the REST API
• Auto-deactivation – Mode turns off after 4 hours so you never forget it’s on
• Email notifications when the mode activates and deactivates
• HMAC-signed cookies – Verified visitors get a signed cookie so they only see the challenge once

Under Attack mode works independently from your preset configuration. Your regular settings are preserved and restored when the mode deactivates.

Two-Factor Authentication (2FA)

Add a second verification step to your WordPress login:

• Authenticator app (TOTP) – Google Authenticator, Authy, Microsoft Authenticator or any TOTP-compatible app
• Email codes – One-time 6-digit verification codes sent via email
• QR code setup directly in user profiles
• 10 backup codes for emergency access if you lose your device
• Configurable grace period for users to set up their authenticator app
• Trusted devices – optionally let users skip 2FA on recognized devices for 30 days
• Role-based enforcement – require 2FA for administrators, editors or any role
• Exclude specific users from 2FA requirements
• Admin tool to reset TOTP for users who lost their authenticator
• Configurable code expiry, attempt limits and email sender name
• User notification emails when 2FA is enabled or the method changes

Read the full description on the official page →