Everything you need to run SecureLite.

Get started

There's no setup wizard and nothing to sign up for. The firewall, login protection, spam protection and rate limiting start working the moment you activate SecureLite.

1. In your WordPress dashboard, go to Plugins > Add New, search for SecureLite Security, then click Install Now and Activate.
2. Go to SecureLite > Verification and click Run Attack Simulation.
3. If anything is switched off, click Enable & re-test beside it.
4. Optional: under SecureLite > Settings, add your own internet address as trusted so you can never be locked out, and hide your login page if you'd like.

Safe on a live site. Attack Simulation runs inside WordPress. Nothing is sent over the internet, nobody's login is tried, and nothing is left behind, not even in your security log. You don't need a copy of your site to test on.

Reading your report

The first check confirms that a normal request to your site actually reaches SecureLite's protections. Then each of the 15 attacks gets one of three results:

A few checks depend on your web server rather than on SecureLite, such as whether code can run from your uploads folder. If one of those fails, the report shows the exact rule your host needs to add. SecureLite never edits your server's configuration itself.

Every report says what it covers: SecureLite's own protections, and the path real visitors take to reach them. If your site uses Cloudflare or a similar service, the report names it, but that service's own firewall isn't part of the test. A report lists which checks passed. It never says your site is "secure", because no test can promise that.

Click Print / save report to keep a copy or send it to a client.

Locked out of your site?

Any one of these gets you back in without logging in:

1. Wait

Login pauses for 15 minutes by default, then opens again. An address that keeps getting locked waits longer, up to 24 hours. The lockout message shows how long is left.

2. Trust your address

Open wp-config.php with your host's file manager or FTP, and add this line above the one that says "That's all, stop editing!". Use your own internet address in place of the example.

If the site runs on your own computer (XAMPP, Local and similar), list those addresses too:

3. Switch SecureLite off

Rename the folder wp-content/plugins/securelite-security to securelite-security-off with your host's file manager or FTP. The normal login page comes back straight away. Rename it back after you've logged in.

4. With SSH access

Be ready before it happens. Under Settings > Login protection, click Add my IP to wp-config.php. Your own address is then never locked out.

Forgot your hidden login address?

It was emailed to the site's administrator when you set it. If you can't find that email, option 3 above brings back the normal login page.

Knowing your username isn't enough to lock you out. If someone attacks your account, your username can be locked, but entering the correct password still lets you in and clears it.

Two-factor login

1. Go to Users > Profile and scroll to SecureLite Two-Factor.
2. Scan the QR code with an authenticator app such as Google Authenticator, Microsoft Authenticator, Authy or 2FAS. Can't scan? Open "Can't scan?" and type the key instead.
3. Type the 6-digit code your app shows, tick the box and click Update Profile. Two-factor only switches on once a real code has worked.
4. Save the ten recovery codes you're shown. They appear only once. Keep them somewhere other than your phone.

SecureLite doesn't send codes by text message or email. Your app makes a new code every 30 seconds, even offline, and each code works once. The QR code is drawn on your own server, so your key never leaves it.

Lost your phone?

Type any one of your recovery codes into the Authentication code box on the login page. Each code works once, and you can make a new set from your profile at any time.

Lost your phone and your recovery codes? Ask another administrator to edit your account and tick "Turn off two-factor authentication for this account". Or switch SecureLite off by renaming its folder (see Locked out?), log in with your password, rename it back and set two-factor up again. With SSH access:

Cloudflare and other proxies

If your site is behind Cloudflare or a similar service, every visitor seems to arrive from that service's addresses. Without telling SecureLite, a lockout meant for one attacker could lock out everyone using the same Cloudflare server.

Go to Settings > General, turn on Behind a proxy/CDN, and choose the Cloudflare preset. The settings screen tells you if it sees Cloudflare traffic while this is off, and shows which address SecureLite thinks you're connecting from.

SecureLite only believes a visitor's forwarded address when the connection really comes from a trusted proxy, so the address can't be faked to dodge a lockout.

SecureLite works alongside Cloudflare. It protects inside your site. For very large floods of traffic, Cloudflare or your host's protection in front of the site is the right tool.

Emails and alerts

Your own site sends SecureLite's emails. Apart from two one-time emails, one with the ways back in when you first turn on login protection and one when you change your login address, there are only three kinds:

• A daily summary, only on days something happened. A quiet day sends nothing.
• An urgent alert when the malware scan finds something serious.
• An urgent alert when an important file changes, such as wp-config.php or your theme's main file. For wp-config.php it lists what changed, such as a setting added or a line that loads another file. It shows only whether a value changed, never the value.

You'll never get one email per blocked attempt. Blocked requests are counted in the summary, and addresses are never listed.

Alerts can go to up to five email addresses. Each person gets their own copy, so nobody sees the others' addresses. You can also switch to urgent alerts only, or turn emails off, in SecureLite's settings.

Every feature

All of these are free, on as many sites as you like.

• FirewallTurns away database attacks, script injection, attempts to read private files, and known hacking tools, from the moment it's installed. Administrators are never filtered, and editors can write posts that explain code.
• Upload protectionRefuses program files, including ones disguised as images.
• Login protectionLimits password guessing per address and per username. Addresses that keep coming back are locked for longer, up to 24 hours. Guesses at "admin" count double, and login errors never say whether a username exists.
• Two-factor loginWorks with any authenticator app, with ten recovery codes. See Two-factor login.
• Hide loginMoves your login page to an address only you know. The new address is tested before it's kept, and emailed to you.
• Malware scannerCompares WordPress's own files with the official copies, scans your other files for backdoors and hidden code, and checks your database for injected scripts.
• File-change alertsWatches the files attackers usually touch, such as wp-config.php, theme files and files in your uploads folder, and tells routine updates apart.
• Rate limitingRefuses floods of requests from one address. Logged-in users are never limited, and genuine Google and Bing crawlers are let through.
• Smart protectionWhen SecureLite isn't sure a visitor is a person, it checks their browser instead of refusing them. A real browser passes in a moment, usually unnoticed. No puzzles and no outside service.
• Comment spam protectionTurns away comments from bots, and limits how many comments one person can post an hour. People sharing an internet connection aren't refused for each other's comments.
• Remote-login protectionRefuses the two things bots use WordPress's old remote-login feature (XML-RPC) for: guessing passwords and pingbacks. Jetpack and apps that use an application password keep working.
• Uploads folder checkShows the exact rule that stops code running from your uploads folder, and confirms your server applies it.
• Settings reviewChecks your settings and lists what to fix first, each with a one-click fix.
• Post-hack recoveryLog everyone out, renew your site's security keys, reset passwords, and rename the default admin account.
• Trusted addressesExempt your own address or office from lockouts and rate limits.
• Attack SimulationTests 15 attacks against SecureLite's protections on your live site, with a printable report. See Reading your report.

What it doesn't do: there's no live threat feed (protection rules are updated with each release), and no plugin can stop a very large flood of traffic. For that, use Cloudflare or your host's protection alongside SecureLite.

What it stores and sends

Nothing about your site, your users or your security events leaves your server. There's no account, no licence key and no tracking.

The one outbound request

During a malware scan, SecureLite asks WordPress.org for the official file checksums of your WordPress version, and of any WordPress.org plugin it needs to check. The request names only the WordPress version and language, or the plugin's folder name and version. It doesn't include your site's address.

What it keeps on your site

Security events, such as login attempts, account changes and firewall blocks, are stored in your own database with the visitor's address and browser name. The list keeps only the most recent entries, so it can't grow forever.

Cookies

Only for visitors who pass Smart protection's browser check: a signed pass that lasts a day (securelite_pass and securelite_passed), and briefly the check's answer (securelite_proof). They hold no personal information. Turning Smart protection off stops them.

Switching it off

Deactivating gives back the lines SecureLite added to wp-config.php. Your settings, trusted addresses and security log are kept, because deactivating is how people troubleshoot. Activate it again and everything comes back.

Deleting removes everything: the wp-config.php lines, its database tables, every setting, two-factor keys and recovery codes, and its scheduled jobs. It only ever removes its own work. A line another plugin added is left alone.

Getting help

Free support is on the WordPress.org support forum, answered by the developer. You never need to buy anything to get help.

Need hands-on help? SecureLite is made by PixelGravitas. If your site has been hacked, we remove the malware for a fixed fee agreed before work starts. If a check needs a server change, or you'd rather someone looked after the site, see maintenance and support.