Stop attacks before your plugins even load.
DefendMyWP checks every request to your website and turns away the ones carrying an attack, before they reach your plugins and theme. It runs on your own server, with no cloud account, and keeps your logs private.
Everything a WordPress website needs to stay clean.
One focused plugin: a real firewall, login defences, file checks and a full activity trail, in an interface that stays calm instead of overwhelming you.
Close the common doors, reversibly.
Disable the file editor, XML-RPC, user enumeration, the version string and pingbacks with a single checkbox each. Every change is made through WordPress only, no files edited, so turning it off restores the default with nothing left behind.
- No wp-config.php or .htaccess edits, so there is nothing to break and nothing to clean up later.
- A plain-English note on each toggle, so you know exactly what it does before you flip it.
Every blocked attack, written down.
Each attack the firewall turns away is recorded with the time, the IP address and a safe snippet of the request. Filter by type, search by IP, and keep the history for as long as you want.
- Catches disguised attempts. Attacks hidden with encoding tricks are uncovered and blocked, not waved through.
- Private by design. Logs stay in your own database and are never sent to anyone else.
Never locked out by a false alarm.
A real firewall sometimes stops legitimate work by mistake. DefendMyWP keeps exceptions precise: allow one rule on one page, not your whole website. And it shuts down attempts to grab admin access.
- Scoped exceptions. Allow a single rule on a single page, only when you actually need it.
- Admin-takeover guard. Blocks low-level accounts from creating or promoting administrators. Watch first, then block.
Know your files have not been touched.
Every plugin, theme and core file is compared against its official WordPress.org version. Your own custom code is watched against a baseline and only flagged when it changes unexpectedly.
- On your server. Files are checked locally; only file names and fingerprints are compared, never the contents of your files.
- No false alarms. If it cannot verify something, it tells you plainly instead of inventing a scare.
Lock down every login.
Require a second step at login for the roles that matter, slow down repeated password guessing automatically, and keep intruders out even if a password leaks. Setup is one scan of a QR code.
- Required two-factor for the roles you choose, with recovery codes and an emergency reset.
- Automatic lockout that stops repeated password guessing before the password is even checked.
A full record of who did what.
User changes, plugin and theme actions, security events and lockouts, each recorded with who did it, when, and from which IP. Filter by category and find what you need in seconds.
- Answer “what changed?” after any incident or handover.
- Tuned to stay quiet by default, so the log stays easy to read.
Built differently from the big suites.
Most security plugins are either heavy local scanners or thin agents for someone else’s cloud. DefendMyWP is a focused firewall you fully own.
It proves it works
A one-click check sends a harmless test attack at your own website and confirms the firewall stops it, and warns you if another plugin is sitting in front of it.
It never takes your website down
If anything inside the firewall ever goes wrong, the request simply passes through and the problem is logged. It can only ever block a real, matched attack, never your own visitors.
Your data stays yours
No required account, no uploading your files to a vendor, no sending your traffic off-site. Blocked-request logs live in your database and never leave your server. Rules arrive over a verified feed, and nothing of yours goes back.
Protect your WordPress website today
Set it up in minutes and verify it works with one click.
Screens shown are from a demonstration website with example data.
