SecureLite

Free WordPress security plugin

The security plugin that proves its protections work.

Most security plugins ask you to trust them. SecureLite shows you. One click runs 16 checks against its protections on your live site, then tells you plainly what held, what is switched off, and how to fix it.

Get it free on WordPress.org Watch the 2-minute demo
  • Listed on WordPress.org
  • Passed WordPress.org plugin review
  • Tested up to WordPress 7.1
  • Open source · GPLv2

Attack Simulation

yoursite.com · inside WordPress

16 of 16 passed
  • Real visitors reach SecureLite's protections
  • Database attacks
  • Script injection
  • Private file access
  • Hacking tools
  • Login name discovery
  • Password guessing
  • Password bots
  • Old remote-login abuse
  • Fake image uploads
  • Program uploads
  • Hidden malware
  • Code in uploads folder
  • Comment spam bots
  • Exposed code history
  • WordPress version shown
Covers SecureLite's protections, not your host's or CDN's firewall.Print / save report
An example report. Yours shows what holds on your own site, including anything that doesn't.

What Attack Simulation tests

15 real attacks, in four groups you'll recognise.

Each attack is handed to SecureLite's real protections, and the report says, one by one, whether it would be stopped, is switched off, or failed.

First, it checks that your real visitors pass through SecureLite. One ordinary request confirms that the protections being tested are the ones your traffic actually meets.

Break-in attempts

Getting in through your pages and forms.

  • Database attacks
  • Scripts planted in pages
  • Private files read
  • Known hacking tools

Login attacks

Getting into your admin account.

  • Login names found out
  • Password guessing
  • Password bots
  • Old remote-login feature

Harmful files

Putting dangerous files on your site.

  • Fake image uploads
  • Program file uploads
  • Hidden malware
  • Code run from uploads

Spam and exposure

Bots, and details your site gives away.

  • Spam comment bots
  • Code history exposed
  • WordPress version shown

Safe on your live site. The tests run inside WordPress, so nothing is sent over the internet, nobody's login is tried, and nothing is left behind. You don't need a copy of your site to test on. If your site uses Cloudflare or a similar service, the report mentions it, but it doesn't test that service's own protection.

In writing, for good

Four promises that won't change.

  1. Nothing in the plugin will ever need an account or a key to keep working.
  2. No protection will ever work differently because you haven't connected SecureLite to anything.
  3. No feature in the plugin will ever move behind a paywall.
  4. Nothing it finds will be hidden to sell you a fix.
Naveen KumarDeveloper of SecureLite · PixelGravitas · Chennai

Calm and private

Protection that doesn't turn on you.

People rarely give up on a security plugin because of a hack. Far more often it locked them out, or kept asking them to pay. SecureLite is built so that doesn't happen, and everything runs on your own site.

  • Two-factor that's tested firstIt can't switch on until a code from your app has worked, and it gives you ten recovery codes at the same time.
  • A new login address that's checkedWhen you hide the login page, the new address is tested before it's kept, and emailed to you.
  • Your username can't be used against youSomeone who knows your login name can't lock you out. The right password still opens the door.
  • Ways back in, written downShown on the Support screen and emailed to you before you ever need them.
  • Nothing about your site sent anywhereNo account, no licence key, no tracking. Its only request goes to WordPress.org for official file checksums, and that's disclosed.
  • Clean to removeSwitch it off and the settings it added are given back. Delete it and everything it stored goes with it.

What's included

Everything a good free security plugin does. All of it free.

No upgrade nags in your dashboard.

  • FirewallTurns away common attacks from the moment it's installed, without getting in the way of people writing posts.
  • Malware scannerChecks WordPress's own files against the official copies, and looks for hidden backdoors in your files and database.
  • Login protectionLimits password guessing, adds two-factor sign-in, and can hide your login page.
  • Spam and bot protectionTurns away spam bots without puzzles. When unsure, it checks the browser instead of refusing the person.
  • File-change alertsTells you when important files change, and tells routine updates apart.
  • Calm notificationsA daily summary and two urgent alerts, sent by your own site. Never one email per blocked attempt.

Free for agencies, today

  • Install on every client site, with no keys to manage
  • Hand clients a printable report of what's protected
  • Show your own support contact on client sites instead of ours

See every feature

Works alongside Cloudflare. SecureLite protects inside your site. For very large floods of traffic, Cloudflare or your host's protection in front of the site is the right tool. Protection rules are updated with each plugin release.

Built in the open

A real person, and every change written down.

Naveen Kumar

Developer · Chennai, India

I run PixelGravitas, a WordPress maintenance and security team. Before writing SecureLite I read more than a thousand reviews of security plugins. Most people who left weren't hacked: they were locked out, slowed down or asked to pay. So SecureLite proves what it does, stays out of your way, and keeps every feature free.

Recent changes, in plain words

Every release says what changed and why, including when an earlier release got something wrong.

  1. 0.2.3130 OctAlerts now say what changed inside wp-config.php, and can go to several email addresses, each person getting their own copy.
  2. 0.2.3030 OctSecureLite no longer warns you about its own changes to wp-config.php, which had been making real alerts easier to ignore.
  3. 0.2.2929 OctMembers' posts and comments that mention things like ../ or javascript: are no longer blocked. Real attacks still are.
  4. 0.2.2829 OctAfter a theme update, the theme's main file is accepted only when it exactly matches the update package.
Read the full changelog

SecureLite Cloud · coming

Know the moment something goes wrong.

A site that has gone down, or been taken over, can't warn you itself. SecureLite Cloud will watch your sites from outside, 24/7, whether you look after one or a hundred.

Planned, no dates promised:

  • An alert when a site goes down or stops checking in
  • Every site you look after, in one place
  • Off-site backup, later

The plugin stays free, and protects exactly the same way whether it's connected or not.

Join the Cloud waitlist

Need it fixed for you?

Already hacked, or rather not deal with it?

SecureLite is made by PixelGravitas, a WordPress maintenance and security team. We remove malware and close the way in, for a fixed fee agreed before work starts, or look after your site for you.

Malware removal Site care plans

Help shape what we build next

Tell us what has actually gone wrong on the sites you look after. Two minutes, no sign-up.

Take the 2-minute survey

Don't take security on faith.

Install SecureLite, run the simulation, and see what holds on your own site. Free, on as many sites as you like.

Get it free on WordPress.org Read the docs