Title: Ultimate Security – Vulnerability Scanner, 2FA, and Login Protection
Author: WP Ultimate Security
Published: <strong>22 مارس، 2025</strong>
Last modified: 14 سبتمبر، 2026

---

البحث عن الإضافات

![](https://ps.w.org/ultimate-security/assets/banner-772x250.png?rev=3695904)

![](https://ps.w.org/ultimate-security/assets/icon-256x256.gif?rev=3678713)

# Ultimate Security – Vulnerability Scanner, 2FA, and Login Protection

 بواسطة [WP Ultimate Security](https://profiles.wordpress.org/wpultimatesecurity/)

[تنزيل](https://downloads.wordpress.org/plugin/ultimate-security.1.0.29.zip)

 * [تفاصيل](https://ar.wordpress.org/plugins/ultimate-security/#description)
 * [المراجعات](https://ar.wordpress.org/plugins/ultimate-security/#reviews)
 *  [التنصيب](https://ar.wordpress.org/plugins/ultimate-security/#installation)
 * [التطوير](https://ar.wordpress.org/plugins/ultimate-security/#developers)

 [الدعم](https://wordpress.org/support/plugin/ultimate-security/)

## الوصف

Ultimate Security handles the traffic that actually reaches a WordPress site: automated
login attempts, brute-force runs, comment and form spam, and probes at well-known
paths. It covers two-factor authentication, login lockouts, CAPTCHA, a movable login
URL, session controls, vulnerability scanning, and Cloudflare edge rules — set up
from one admin screen, without editing files or writing firewall rules by hand.

There is no usage tracking and nothing phones home. The plugin contacts an outside
service only when you switch on a feature that needs one, and each is listed under
External Services below. Features that belong to the Pro add-on are labelled as 
such.

#### Setup wizard

The first run is a five-step wizard. You answer a few questions about the site, 
it runs a quick scan, and you pick one of seven starting templates: basic, moderate,
strict, agency, blog, membership, or WooCommerce. Before it changes anything it 
shows you a full diff, and you can undo everything it did later without losing edits
you made yourself. It also gives you an emergency access link — keep it somewhere
safe, and you can switch the plugin off from a browser if you ever lock yourself
out.

#### Two-factor authentication

 * Email one-time codes, no app required, for any user.
 * Authenticator apps (TOTP and HOTP) with QR enrolment — Google Authenticator, 
   Authy, Microsoft Authenticator and similar.
 * Per-role configuration: pick which roles use email codes and which use an app.
 * Rate limiting on code entry, with a configurable attempt limit and lockout.
 * Optional 2FA event logging.
 * Covers the WordPress, WooCommerce and Ultimate Member login forms, with a separate
   setting for XML-RPC.

#### Login access control

 * Move `wp-login.php` to a secret URL so bots can’t find it, with a configurable
   post-login redirect.
 * Show your own consent or policy text on the login form.

#### Password policies

 * Require a minimum length, mixed case, numbers and special characters, or start
   from a preset.
 * Expiry with advance warning, a grace period, and email notification.
 * Password history, so old passwords can’t be reused.
 * Force a password change on first login.
 * Reject compromised passwords, checked against the Have I Been Pwned range API
   by k-anonymity — the password itself never leaves the site.
 * Optionally turn off self-service password reset and point people at your own 
   process instead.

#### Brute-force protection

 * Limit failed logins and lock offenders out automatically.
 * Progressive lockouts, so repeat offenders wait longer each time.
 * Configurable retry-reset window, plus a permanent block list.
 * A recovery link an administrator can generate for a locked-out user, valid for
   15 minutes. For the sole administrator, the emergency deactivation link from 
   the wizard is the way back in.
 * Trusted proxies: list your CDN or load balancer so lockouts and logs see real
   visitor addresses. Cloudflare is recognised automatically, and Site Health tells
   you when this is needed.

#### Session management

 * Limit concurrent logins per user; block the new login or end the oldest session.
 * Idle timeout for inactive sessions.
 * HttpOnly, Secure and SameSite flags on auth cookies.
 * Optionally bind a session to its IP and/or browser to catch hijacking.

#### CAPTCHA and spam

 * Google reCAPTCHA v2 and v3, with a v3 score threshold, IP and user-agent allowlists,
   a bypass for logged-in users, and a verification log.
 * Cloudflare Turnstile, with theme, size, language and appearance options, deferred
   loading, custom failure messages, and its own log.
 * Both cover the WordPress login, registration, lost-password and comment forms,
   and the WooCommerce login, registration, lost-password and checkout forms.
 * No-conflict mode and provider priority keep two CAPTCHAs off the same form.
 * Validate your site and secret keys from the settings page before going live.
 * If the provider is unreachable, forms keep working.

#### Vulnerability scanning

 * Scans WordPress core, plugins and themes for known vulnerabilities.
 * No API key needed — it uses the keyless WPVulnerability database by default.
 * Add a WPScan or Patchstack key for more coverage, with automatic failover between
   providers.
 * Scheduled scans and email alerts, filtered by severity.
 * Flags plugins that haven’t been updated in a long time.
 * Scan history, run-to-run comparison, and an ignore list for findings you’ve accepted.
 * Results show up in Site Health, the dashboard widget, the plugins list, and menu
   counters.

#### Cloudflare WAF rules

Connect your own Cloudflare account and manage edge rules from wp-admin.

 * Let verified search, monitoring, backup, SEO and social crawlers through.
 * Block aggressive crawlers and sensitive WordPress paths.
 * Block data-center hosts and TOR exit nodes.
 * Challenge large cloud providers and specific countries.
 * Challenge VPN traffic and requests to `wp-login.php`.
 * Virtual patches that block requests exploiting known core CVEs at the edge until
   you can update.
 * Preview the generated expressions before deploying, review the live rules on 
   your zone, and read request, threat and bandwidth analytics.

#### Security keys (salts)

 * Rotate the keys and salts in `wp-config.php` on demand or on a schedule — daily,
   weekly, monthly, quarterly, or twice a year.
 * Advance notice before a scheduled rotation, so the forced re-login isn’t a surprise.
 * Quiet hours, plus pause and skip-next controls.
 * Rotation history, with the option to restore a previous set.

#### Update manager

 * Set auto-update policy for core, plugins and themes. Per-plugin and per-theme
   overrides and the update history are part of Pro.
 * Update windows, allowed days, and freeze periods for when you don’t want changes.
 * Delay updates by a set number of days to let others hit the bugs first.
 * Optional maintenance mode during updates, and detection of version-controlled
   installs.
 * Email notifications and a daily digest.

#### Monitoring, security score and logs

 * A security score with a per-check breakdown of what’s pulling it down.
 * Activity log for logins, logouts, lockouts, and 2FA and password events, with
   a retention period you set.
 * Session log for session events and anomalies.
 * A “who’s online” view of currently active users.
 * Core file-integrity check against the official WordPress.org checksums.
 * Site Health entries covering plugin, server, database, filesystem, theme and 
   WordPress diagnostics.
 * A dashboard widget summarising failed logins, issues found, outdated plugins 
   and the current score.

#### Test mode

Run your rules without blocking anyone and review a log of what would have been 
blocked before you enforce it. Choose which roles it applies to (or leave the list
empty for every role), keep admins excluded, and an admin-bar marker plus a dashboard
notice remind you it’s on. Login limits for visitors who are not signed in are always
enforced, even in Test Mode, and Test Mode switches itself off after seven days 
so a forgotten test cannot leave protections off.

#### Tools, migration and backup

 * Import from Wordfence Login Security — preview what comes across, run it, and
   roll it back if you change your mind.
 * Export and import settings as JSON for staging-to-production moves or recovery.
 * Reset all settings to defaults, and clear the plugin cache.
 * Diagnostics for REST API, cron (with a manual run trigger), and server status.
 * An emergency deactivation URL that switches the plugin off if you’re locked out.

#### Works with what you already run

Ultimate Security detects and adapts to WooCommerce, Ultimate Member, common page
builders, form plugins, caching plugins and SEO plugins, and warns you when another
security plugin is already doing the same job.

#### WP-CLI

    ```
    wp ultimate-security template list
    wp ultimate-security template apply <template> [--dry-run]
    wp ultimate-security template undo
    wp ultimate-security export [--file=<path>]
    wp ultimate-security import <file> [--dry-run]
    wp ultimate-security status
    wp ultimate-security unlock <user> | --ip=<address> | --all
    wp ultimate-security 2fa disable <user>
    wp ultimate-security captcha off
    wp ultimate-security login-url reset
    ```

#### Learn more

 * [Website](https://www.wpultimatesecurity.com) — features and articles.
 * [Documentation](https://docs.wpultimatesecurity.com/) — setup guides, troubleshooting
   and how-tos.
 * [YouTube](https://www.youtube.com/@wpultimatesecurity) — walkthroughs and tutorials.

### External Services

This plugin connects to the following third-party services, and only when you use
the related feature:

The free plugin never contacts an AI provider. The AI scanner settings you may see
are for Ultimate Security Pro; if you install Pro and enable that scanner, it sends
file excerpts to the AI provider you configure there.

#### Google reCAPTCHA

 * When: reCAPTCHA protection is enabled. The reCAPTCHA script is then loaded in
   your visitors’ browsers on the protected forms.
 * Data sent: the visitor’s reCAPTCHA response token, your site secret key, and 
   the visitor’s IP address for verification.
 * Endpoints: https://www.google.com/recaptcha/api.js (browser script, with a preconnect
   to https://www.gstatic.com) and https://www.google.com/recaptcha/api/siteverify(
   server-side verification).
 * Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/
   privacy

#### Cloudflare Turnstile

 * When: Cloudflare Turnstile protection is enabled. The Turnstile script is then
   loaded in your visitors’ browsers on the protected forms.
 * Data sent: the visitor’s Turnstile response token, your site secret key, and 
   the visitor’s IP address for verification.
 * Endpoints: https://challenges.cloudflare.com/turnstile/v0/api.js (browser script)
   and https://challenges.cloudflare.com/turnstile/v0/siteverify (server-side verification).
 * Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.
   com/privacypolicy/

#### WPVulnerability

 * When: the Vulnerability Scanner runs. This is the default vulnerability database
   and requires no API key.
 * Data sent: your WordPress version and the slugs of your installed plugins and
   themes.
 * Endpoint: https://www.wpvulnerability.net/
 * Privacy: https://www.wpvulnerability.net/

#### WPScan

 * When: the Vulnerability Scanner runs and you have configured a WPScan API key.
 * Data sent: your WPScan API key, your WordPress version, and the slugs of your
   installed plugins and themes.
 * Endpoint: https://wpscan.com/api/v3/
 * Terms: https://wpscan.com/terms-of-service/ — Privacy: https://wpscan.com/privacy-
   policy/

#### Patchstack

 * When: the Vulnerability Scanner runs and you have configured a Patchstack API
   key.
 * Data sent: your Patchstack API key, your WordPress version, and the slugs of 
   your installed plugins and themes.
 * Endpoint: https://patchstack.com/database/api/v2/
 * Terms: https://patchstack.com/terms-of-service/ — Privacy: https://patchstack.
   com/privacy-policy/

#### WordPress.org Plugin and Theme Information API

 * When: the Vulnerability Scanner checks whether an extension has been abandoned,
   and when the Update Manager gathers update information.
 * Data sent: the slugs of your installed plugins and themes (no user data).
 * Endpoints: https://api.wordpress.org/plugins/info/1.2/ and https://api.wordpress.
   org/themes/info/1.2/
 * Privacy: https://wordpress.org/about/privacy/

#### WordPress.org Core Version Check

 * When: the Update Manager checks for available WordPress core updates.
 * Data sent: a standard WordPress core version-check request (no user data).
 * Endpoint: https://api.wordpress.org/core/version-check/1.7/
 * Privacy: https://wordpress.org/about/privacy/

#### WordPress.org Core Checksums

 * When: you run the WordPress core file-integrity check.
 * Data sent: your WordPress version and locale, in order to retrieve the official
   file checksums for comparison.
 * Endpoint: https://api.wordpress.org/core/checksums/1.0/
 * Privacy: https://wordpress.org/about/privacy/

#### WordPress.org Secret-Key (Salt) API

 * When: you rotate WordPress security keys and salts, on demand or on a schedule.
 * Data sent: a request for randomly generated salt strings (no site or user data).
 * Endpoint: https://api.wordpress.org/secret-key/1.1/salt/
 * Privacy: https://wordpress.org/about/privacy/

#### Cloudflare API

 * When: you connect Cloudflare or preview, deploy, remove or analyse WAF rules.
 * Data sent: your Cloudflare credentials or API token, the selected zone and rule
   data, and the API requests needed for verification, deployment and analytics.
 * Endpoint: https://api.cloudflare.com/client/v4/
 * Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.
   com/privacypolicy/

#### Have I Been Pwned (Pwned Passwords)

 * When: the “refuse compromised passwords” password-policy option is enabled and
   a password is set or changed.
 * Data sent: the first 5 characters of the SHA-1 hash of the password (a k-anonymity
   range query). The password itself is never sent.
 * Endpoint: https://api.pwnedpasswords.com/range/
 * Privacy: https://haveibeenpwned.com/Privacy

#### Feedback and support email

 * When: only when an administrator explicitly submits contact, migration, or deactivation
   feedback. Choosing “Skip & Deactivate” sends nothing.
 * Data sent: the submitted message or deactivation reason and optional notes. Contact
   and migration requests also include diagnostic details shown with the form, such
   as the site URL, WordPress/PHP versions, active theme and plugin count, administrator
   profile, IP address, user agent, and referrer.
 * Destination: support@wpultimatesecurity.com, delivered through the site’s configured
   WordPress email service.
 * Privacy: https://www.wpultimatesecurity.com/privacy-policy/

## لقطات الشاشة

[⌊The dashboard gives a plain verdict, a security level out of 5, the next fixes
in order, and recent sign-ins. Nothing to decode.⌉⌊The dashboard gives a plain verdict,
a security level out of 5, the next fixes in order, and recent sign-ins. Nothing
to decode.⌉[

The dashboard gives a plain verdict, a security level out of 5, the next fixes in
order, and recent sign-ins. Nothing to decode.

[⌊The setup wizard asks what kind of site this is, runs a 30-second check, offers
seven ready-made templates, and lists every change before it applies. Undo any time.⌉⌊
The setup wizard asks what kind of site this is, runs a 30-second check, offers 
seven ready-made templates, and lists every change before it applies. Undo any time
.⌉[

The setup wizard asks what kind of site this is, runs a 30-second check, offers 
seven ready-made templates, and lists every change before it applies. Undo any time.

[⌊Brute-force protection you can read: attempts allowed, lockout length, escalating
lockouts, a retry-reset window, a permanent block list, and a one-time recovery 
link if you lock yourself out.⌉⌊Brute-force protection you can read: attempts allowed,
lockout length, escalating lockouts, a retry-reset window, a permanent block list,
and a one-time recovery link if you lock yourself out.⌉[

Brute-force protection you can read: attempts allowed, lockout length, escalating
lockouts, a retry-reset window, a permanent block list, and a one-time recovery 
link if you lock yourself out.

[⌊Test Mode runs your protections without enforcing them and logs what would have
been blocked, so you can review before anyone is locked out.⌉⌊Test Mode runs your
protections without enforcing them and logs what would have been blocked, so you
can review before anyone is locked out.⌉[

Test Mode runs your protections without enforcing them and logs what would have 
been blocked, so you can review before anyone is locked out.

[⌊Two-factor sign-in with email codes or an authenticator app (TOTP and HOTP), required
per role, on WordPress, WooCommerce and Ultimate Member login forms.⌉⌊Two-factor
sign-in with email codes or an authenticator app (TOTP and HOTP), required per role,
on WordPress, WooCommerce and Ultimate Member login forms.⌉[

Two-factor sign-in with email codes or an authenticator app (TOTP and HOTP), required
per role, on WordPress, WooCommerce and Ultimate Member login forms.

[⌊Move wp-login.php to a private address, set password rules, and check new passwords
against known breaches by k-anonymity. The password never leaves the site.⌉⌊Move
wp-login.php to a private address, set password rules, and check new passwords against
known breaches by k-anonymity. The password never leaves the site.⌉[

Move wp-login.php to a private address, set password rules, and check new passwords
against known breaches by k-anonymity. The password never leaves the site.

[⌊reCAPTCHA v2/v3 or Cloudflare Turnstile on the forms bots hit: login, registration,
password reset, comments and WooCommerce. No-conflict mode and fail-open included.⌉⌊
reCAPTCHA v2/v3 or Cloudflare Turnstile on the forms bots hit: login, registration,
password reset, comments and WooCommerce. No-conflict mode and fail-open included
.⌉[

reCAPTCHA v2/v3 or Cloudflare Turnstile on the forms bots hit: login, registration,
password reset, comments and WooCommerce. No-conflict mode and fail-open included.

[⌊The vulnerability scanner checks plugins, themes and core against the keyless 
WPVulnerability database, flags abandoned plugins, and runs on a schedule. WPScan
and Patchstack are optional.⌉⌊The vulnerability scanner checks plugins, themes and
core against the keyless WPVulnerability database, flags abandoned plugins, and 
runs on a schedule. WPScan and Patchstack are optional.⌉[

The vulnerability scanner checks plugins, themes and core against the keyless WPVulnerability
database, flags abandoned plugins, and runs on a schedule. WPScan and Patchstack
are optional.

[⌊Cloudflare WAF rules without writing expressions: six rule groups, virtual patches
for known core CVEs, and a preview of the generated expressions before you deploy
to your own Cloudflare account.⌉⌊Cloudflare WAF rules without writing expressions:
six rule groups, virtual patches for known core CVEs, and a preview of the generated
expressions before you deploy to your own Cloudflare account.⌉[

Cloudflare WAF rules without writing expressions: six rule groups, virtual patches
for known core CVEs, and a preview of the generated expressions before you deploy
to your own Cloudflare account.

[⌊See everyone signed in, with device, browser and IP, and end any session with 
one click. The security score breakdown shows which checks hold back the next level.⌉⌊
See everyone signed in, with device, browser and IP, and end any session with one
click. The security score breakdown shows which checks hold back the next level.⌉[

See everyone signed in, with device, browser and IP, and end any session with one
click. The security score breakdown shows which checks hold back the next level.

[⌊Every feature is a module with a switch. Checks run on login and form submission,
not on every page view, and pages with no forms, widgets or CAPTCHA load no plugin
CSS or JS.⌉⌊Every feature is a module with a switch. Checks run on login and form
submission, not on every page view, and pages with no forms, widgets or CAPTCHA 
load no plugin CSS or JS.⌉[

Every feature is a module with a switch. Checks run on login and form submission,
not on every page view, and pages with no forms, widgets or CAPTCHA load no plugin
CSS or JS.

[⌊Switching is safe: import 2FA and login settings from Wordfence Login Security
with a preview and rollback, and move your own settings between sites as JSON.⌉⌊
Switching is safe: import 2FA and login settings from Wordfence Login Security with
a preview and rollback, and move your own settings between sites as JSON.⌉[

Switching is safe: import 2FA and login settings from Wordfence Login Security with
a preview and rollback, and move your own settings between sites as JSON.

## التنصيب

**Requirements:** WordPress 5.6+ and PHP 7.1+. HTTPS is strongly recommended for
2FA and secure sessions.

📘 Full setup walkthrough: [Documentation](https://docs.wpultimatesecurity.com/)·
[Video tutorials](https://www.youtube.com/@wpultimatesecurity)

#### Install from your dashboard

 1. In WordPress, go to **Plugins  Add New** and search for “wpultimatesecurity”.
 2. Click **Install Now**, then **Activate**.
 3. Follow the **Security Wizard** that appears — it scans your site, recommends settings,
    and shows you every change before applying it.

#### Install manually

 1. Download the plugin ZIP.
 2. Go to **Plugins  Add New  Upload Plugin**, choose the ZIP, and click **Install 
    Now**.
 3. Click **Activate**, then follow the Security Wizard.

Or with WP-CLI: `wp plugin install ultimate-security --activate`

#### Recommended first 5 minutes

 1. Run the **Security Wizard** and apply a template that matches your site.
 2. Enable **2FA** for all administrator accounts.
 3. Set **login attempt limits** and a lockout duration.
 4. Add **CAPTCHA** (reCAPTCHA or Cloudflare Turnstile) to your login, registration
    and comment forms.
 5. Set a **custom login URL**, save it somewhere safe, and store the emergency access
    link the wizard showed you.
 6. Run a **vulnerability scan**, then review the **Security Score** and **Site Health**
    before enabling stricter rules.

## الأسئلة المتكررّة

### Will this slow down my site?

It is built to stay lightweight — security checks run on login and form submission,
not on every page view. Vulnerability scans run on a schedule in the background,
not during visitor requests.

### Do I need any technical or coding knowledge?

No. The setup wizard scans your site, recommends settings, and shows you every change
before it is applied — and you can undo all of it. Every setting is in plain English.

### I enabled 2FA or a custom login URL and locked myself out. How do I get back in?

Use the **emergency deactivation URL** the setup wizard showed you — open it in 
a browser and the plugin switches itself off. If you did not save it, deactivate
the plugin manually: over FTP/SFTP rename the folder `/wp-content/plugins/ultimate-
security`, or over SSH run `wp plugin deactivate ultimate-security`. Then log in
and reconfigure.

### CAPTCHA is blocking every login (wrong keys, or after changing my security keys). How do I recover?

Add `define( 'ULTIMATE_SECURITY_DISABLE_CAPTCHA', true );` to `wp-config.php` to
switch off both reCAPTCHA and Turnstile, or `ULTIMATE_SECURITY_DISABLE_TURNSTILE`/`
ULTIMATE_SECURITY_DISABLE_RECAPTCHA` for one provider. This fully disables rendering
and verification so you can log in. Then re-enter your Site Key and Secret Key in
the plugin settings and remove the constant. Site Health and an admin notice tell
you when a stored key has been rejected by the provider or has become unreadable
after a salt change. The constant requires server access, so it is never a public
bypass. Over SSH, `wp ultimate-security unlock --all` clears login lockouts, `wp
ultimate-security captcha off` switches CAPTCHA off on every form, `wp ultimate-
security 2fa disable <user>` removes a user’s two-factor methods and `wp ultimate-
security login-url reset` restores wp-login.php. A used login-recovery link also
lets that address through the login CAPTCHA for 15 minutes.

### I use Cloudflare or another CDN or proxy. Do I need to do anything?

Usually not for Cloudflare: requests arriving from Cloudflare’s published ranges
are recognised and the real visitor address is used. For any other proxy or load
balancer, add its address under Brute-force protection  Trusted proxies (hosts can
set the `ULTIMATE_SECURITY_TRUSTED_PROXIES` constant instead). Until you do, every
visitor looks like the proxy, so the plugin suspends site-wide IP lockouts to avoid
locking everyone out, and Site Health shows a critical notice telling you what to
add.

### Do I need an API key for vulnerability scanning?

No. The scanner works out of the box using the keyless WPVulnerability database.
WPScan and Patchstack API keys are optional and only add extra coverage.

### Does it work with WooCommerce?

Yes. Both reCAPTCHA and Cloudflare Turnstile can protect WooCommerce login, registration,
lost-password and checkout forms, and there is a WooCommerce setup template in the
wizard.

### Do I need a Cloudflare account to use this plugin?

Only for the WAF Rules section. Those rules are deployed to your own Cloudflare 
zone, so they need a Cloudflare account and an API token. Every other feature works
without one.

### Does it work with a persistent object cache (Redis, Memcached)?

Yes. Login lockouts, two-factor sign-in sessions and similar short-lived state are
stored as WordPress transients, so with a persistent object cache they live in that
cache instead of the database. Give the cache enough memory that it does not evict
entries early, or a lockout can end sooner than configured.

### Does it work on WordPress Multisite?

The plugin activates and runs on Multisite, and its uninstall routine is network-
aware. It has not been tested as extensively on Multisite as on single-site installs,
so validate on a staging network first and configure settings per site.

### Does the custom login URL work with caching and CDNs?

Yes. Exclude the login path from full-page caching (most caching plugins do this
for login and admin pages automatically) so the secret URL is never served from 
cache.

### Will it conflict with other security or CAPTCHA plugins?

It can if two plugins do the same job. Pick one plugin per function (one 2FA, one
CAPTCHA, one login limiter) and disable the overlapping feature in the other. Ultimate
Security detects common security plugins and warns you.

### I already use another security plugin. Can I bring my settings across?

Settings can be imported from Wordfence Login Security. You get a preview of exactly
what will be imported before anything is applied, and you can roll the import back
afterwards.

### Does the plugin track me or phone home?

No. Ultimate Security does not collect product-usage telemetry. It contacts third-
party services only when you use a feature that requires one, and every one of those
is listed under External Services below.

### What does the plugin store about my visitors?

IP addresses and user agents are recorded in the activity and session logs so you
can investigate login attempts, with a retention period you control (30 days by 
default). Test Mode keeps its own log of what would have been blocked. “Who’s online”
rows expire after 60 seconds. Nothing is sent off your site except through the services
listed below.

### Is it GDPR-friendly?

The plugin is self-hosted and stores its data in your own database. Outbound calls
are limited to the feature-specific services listed under External Services, such
as reCAPTCHA, Turnstile, the vulnerability databases and WordPress.org APIs.

### What happens to my data when I uninstall?

By default the plugin leaves its data in place. If you enable the “delete plugin
data” option in the plugin’s advanced settings before uninstalling, its database
tables, options and user meta are removed on uninstall.

### What is the difference between Free and Pro?

Everything described on this page is in the free plugin: the setup wizard, email
and app-based 2FA, brute-force lockout, custom login URL, password policies, session
management, reCAPTCHA and Turnstile, vulnerability scanning, Cloudflare WAF rules,
security-key rotation (on demand and scheduled), the Update Manager’s policies, 
windows and notifications, Security Score, activity logs, core file-integrity checking,
Site Health, Test Mode, Wordfence migration, and settings backup and restore. The
score counts only checks the free plugin can satisfy, so every level is reachable
without Pro. Ultimate Security Pro is a separate add-on that requires this free 
plugin and adds further authentication, monitoring, automation and maintenance features
not included here.

### How do I get support?

Use the plugin support forum on WordPress.org, or visit https://www.wpultimatesecurity.
com.

## المراجعات

لا توجد مراجعات لهذه الإضافة.

## المساهمون والمطوّرون

“Ultimate Security – Vulnerability Scanner, 2FA, and Login Protection” هو برنامج
مفتوح المصدر. وقد ساهم هؤلاء الأشخاص بالأسفل في هذه الإضافة.

المساهمون

 *   [ WP Ultimate Security ](https://profiles.wordpress.org/wpultimatesecurity/)

لقد تم ترجمة ”Ultimate Security – Vulnerability Scanner, 2FA, and Login Protection“
إلى لغة واحدة. شكراً إلى جميع [المُترجمين](https://translate.wordpress.org/projects/wp-plugins/ultimate-security/contributors)
لمُساهماتهم.

[ترجمة ”Ultimate Security – Vulnerability Scanner, 2FA, and Login Protection“ إلى لغتك.](https://translate.wordpress.org/projects/wp-plugins/ultimate-security)

### مُهتم بالتطوير؟

[تصفّح الشفرة](https://plugins.trac.wordpress.org/browser/ultimate-security/)، تحقق
من [مستودع SVN](https://plugins.svn.wordpress.org/ultimate-security/)، أو الاشتراك
في [سجل التطوير](https://plugins.trac.wordpress.org/log/ultimate-security/) بواسطة
[RSS](https://plugins.trac.wordpress.org/log/ultimate-security/?limit=100&mode=stop_on_copy&format=rss).

## سجل التغييرات

#### 1.0.29

This update includes everything since 1.0.28 and follows a full security review 
of
 the plugin. Most of that work happens behind the scenes; below is what you will
notice. If your site sits behind Cloudflare, a CDN or a proxy, or you use CAPTCHA
on your login form, update promptly.

Login protection
 * Sites behind Cloudflare, a load balancer or another proxy are
no longer at risk of locking everyone out after a few failed logins. Cloudflare 
is recognised automatically. For other proxies there is a new Trusted proxies setting
with a Detect button that fills in the right value for you, and Site Health tells
you if it needs attention. * When you are locked out, the login page now says how
many minutes remain and how to get back in with a recovery link from an administrator.*
Brute-force protection is stronger all round: failed sign-ins are always counted,
the login page gives nothing away about which usernames exist, and recovery links
cannot be guessed. * The emergency deactivation link now expires after 30 days. 
A fresh one is always shown on the plugin’s screens, so use the current one rather
than an old copy. * New WP-CLI commands let you clear a lockout, turn off two-factor
for a user, turn off CAPTCHA, or reset the login address from the command line if
you are ever locked out.

CAPTCHA
 * A wrong or rejected Secret Key can no longer lock everyone out. The plugin
warns you in Site Health and with an admin notice, and lets real people through 
for up to an hour while you fix it. * The reCAPTCHA and Turnstile pages ask you 
to verify your keys before login-form protection can be switched on. * The “strict”
setup template now keeps sign-in forms closed during a CAPTCHA outage. Other templates
are unchanged. * reCAPTCHA’s floating badge no longer shows on a login page where
Turnstile is in charge. * The WooCommerce CAPTCHA reminder can be dismissed and 
only appears on the Dashboard, Plugins and WooCommerce screens.

Two-factor authentication
 * The code box on the login screen is now six separate
digit boxes, and the same box is used when you set up two-factor on your profile.
Pasting a code with a space or a dash in it fills the whole box, browsers offer 
the code they just received, and a mistyped code no longer uses up one of your tries.*
If the two-factor email cannot be sent, the sign-in screen says so and points you
to Resend, a backup code or an administrator. * Email and SMS two-factor must be
confirmed with a code before they can be saved, the same as the authenticator app.*
New option, “Require authorization to reset 2FA”, for each method. When on, a user
must enter their password before that method can be reset. Off by default. * Two-
factor users can optionally keep using application passwords (the WordPress mobile
app, Jetpack). Off by default. * The login screen now works on sites with a strict
Content Security Policy.

Settings that now do what they say
 * Test Mode no longer switches off brute-force
protection for visitors, and it turns itself off seven days after you start it, 
with an email to the administrator. * Password expiry set in days now expires passwords
in days; it was counting months. People who joined before the rule get a full period
before they are asked to change their password. * The Maximum Security template 
signed non-administrators out after five idle minutes without saying so. It now 
sets 30 minutes, lists it, and the login page explains why you were signed out. 
New installs no longer get a short idle timeout when session limits are turned on.*
The security score can now reach the top level with the free plugin. The Hardening
card says its recommendations are applied by Pro instead of showing a percentage.*
Scheduled vulnerability scans no longer appear several times under Tools  Scheduled
Tasks.

Setup wizard
 * Setup ends with a short progress screen that runs your first checks
and fills in the dashboard, so it shows real numbers the first time you open it.
You can skip it. * The wizard lists every setting that starts to apply when a template
turns a module on.

Admin screens
 * Switches are never greyed out. On pages that need Pro, flipping
a switch opens the Pro dialog. Pro-only pages are shown read-only with a note at
the top. * The settings pages now fit a phone screen. * Settings that fail to load
are shown read-only with a Retry button. Leaving a page with unsaved changes asks
first, and so does Discard. Save errors name the fields that need attention. * Forcing
a password reset for all users now shows a progress bar and completes on large sites.*
The Dashboard’s failed sign-ins list matches its total, and the Server protection
panel no longer checks for fail2ban. * Updating a plugin or theme from the Update
Manager requires the normal WordPress permission to install updates. * Site Health
no longer shows a warning while measuring folder sizes, and its “writable” checks
work on Windows hosting. * Firewall rules the plugin creates in your Cloudflare 
account have a clearer name. Existing rules are updated in place, not duplicated.*
Messages that include a name or a number now translate correctly. * Smaller fixes:
the Upgrade to Pro button works, Give Feedback opens the feedback form, the review
prompt can be dismissed for good, WordPress’s own update notices show on plugin 
screens again, and the email blocklist page has a new address (old links still work).

#### 1.0.28

Includes everything from 1.0.27, which was never released.

Security
 * Bot protection hardening across CAPTCHA key verification, Test Mode,
the login lockout, provider outages and No-Conflict Mode. If you use reCAPTCHA or
Cloudflare Turnstile, update promptly. * The salt keys screen shows a masked preview
and a strength rating instead of the keys themselves. * Admin screens send less 
to the browser, and users who are not administrators no longer receive information
meant for administrators. * Further hardening around lockout recovery, the Maintenance
cron tools, Cloudflare zone IDs, password-expiry redirects and the review notice.

Speed
 * Admin pages are far lighter: the media library scripts are gone (about 
110 requests and 11 MB per page view), settings arrive with the page, and the main
script is about 40% smaller. * The dashboard opens with its numbers already in place,
prepared in the background every 15 minutes. Refresh now shows each check as it 
finishes. * Charts load only when one is about to be shown, and the sign-in trend
chart is back with its hover tooltips.

Fixed
 * A challenge that never loads no longer leaves a form with a permanently
disabled submit button. * The login page no longer shows a CAPTCHA error before 
anything is submitted, and a failed check on the password-reset form appears on 
the form instead of a blank error page. * Turning off Cloudflare Turnstile hides
only its own page, not the whole Bot Protection section, and comment protection 
no longer disables the Log In button. * Cloudflare Turnstile loads only on pages
that can show a protected form. * Key panels behave: clearing removes only the version
shown, Re-verify checks the keys you saved, the status matches the version in use,
and closing with unsaved keys asks first. * Score thresholds, whitelists, theme 
and size settings keep exactly what you enter, and there is now an editable message
for a form submitted without the challenge. * Debug Log columns sort and paging 
keeps your place. Wording and typo fixes across the Bot Protection screens. * A 
database update that stopped part-way is retried instead of being marked done, and
uninstall removes everything the plugin created. * Log times are stored in UTC, 
so retention and dashboard counts stay right in any time zone. * Audit log settings
take effect: retention, which events are recorded, and logout logging. * After a
salt reset you land on your real login page, including when a custom login URL is
active. * Number fields no longer lower the values chosen in the setup wizard, such
as a 180-hour lockout becoming 60.

Improvements
 * More on-screen text can be translated. * Requires PHP 7.1 or newer.
The plugin already needed it; the listing said 7.0.

#### 1.0.26

 * Fix: The session activity list and the failed sign-in count on the WordPress 
   dashboard now update as soon as something happens, instead of lagging behind 
   by up to an hour.
 * Fix: The failed sign-in count on the dashboard shows real numbers again. It was
   reading a table that no longer exists and always showed zero.
 * Fix: Cloudflare Turnstile no longer breaks the page when a challenge does not
   match the form it came from, when Cloudflare cannot be reached, or when its keys
   cannot be read.
 * Fix: The WordPress core file check now explains itself when it cannot reach WordPress.
   org, instead of failing with a PHP error.
 * Fix: Cached scan results are cleared properly on sites that use Redis or Memcached
   object caching, a cached dashboard status that could get stuck is refreshed, 
   and uninstalling now removes the last of the plugin’s temporary data.
 * Performance: Security logs are cleaned up automatically after 90 days, so the
   log tables no longer grow without limit. The clean-up runs in small batches, 
   and developers can change the retention period with a filter.
 * Performance: Searching session activity is faster, and it loads faster on sites
   with a long history.
 * Performance: Who’s Online no longer does any work for logged-out visitors, so
   ordinary page views are unaffected by it.
 * Performance: User and session lists load faster on sites with many users, and
   Test Mode records simulated blocks with less database work.
 * Performance: The lockout clean-up job runs hourly instead of every minute. Lockouts
   still end exactly when they are supposed to.
 * Improvement: The plugin now runs on MariaDB and on SQLite-based setups such as
   WordPress Playground and Local Studio, in addition to MySQL.
 * Docs: A new FAQ entry explains how object caching (Redis, Memcached) affects 
   login lockouts and two-factor sign-in sessions.
 * Docs: The plugin listing now has captions for its screenshots.

#### 1.0.25

 * Fixed: Session cookie hardening (SameSite, Secure) was overridden by WordPress
   core and never applied.
 * Fixed: Dashboard hijack and idle-timeout counters read the wrong table and always
   showed 0.
 * Fixed: Ending a session from Active Sessions could fail with a fatal error instead
   of a clear message.
 * Fixed: Header search listed Active Sessions as Pro and Session Automations as
   free.
 * Security: Ending a session from Active Sessions is now a POST request and is 
   recorded in the activity log.
 * Performance: Active Sessions only queries users who actually hold a session.
 * Improvement: Settings menus list free features first and Pro features last, and
   the header Scans menu marks Pro scanners.

#### 1.0.24

 * New: The redesigned admin interface is now the default for everyone — a cleaner
   dashboard, settings, and reporting, with light and dark modes that follow your
   system preference.
 * Fix: Scheduled security-key (salt) rotation is a free feature, but the setup 
   wizard displayed it as Pro and the Maximum Security template withheld its settings
   from free installs. Both corrected — applying that template now enables scheduled
   rotation.
 * Fix: Security headers and XML-RPC protection are Pro features and are no longer
   labelled as free in the setup wizard.
 * Docs: The readme now documents the complete free feature set and discloses every
   third-party service the plugin contacts.
 * Maintenance: Removed unreachable code — an unused salt-change extension, a duplicate
   session route registrar, an unscheduled cron entry, an unused settings group,
   and unused Pro-feature permission helpers.
 * Fix: The maintenance file written during plugin and theme updates was not valid
   PHP. On sites using that option it printed stray text at the top of every page,
   which broke logins and the plugin’s own admin screens, and it could be left behind
   if an update failed part way through. Maintenance mode itself never actually 
   engaged.
 * Fix: Changing your security keys and salts now verifies the new wp-config.php
   before replacing the old one. Previously a bad network response could be written
   into the file, leaving the site unable to start.
 * Fix: Saved API keys (reCAPTCHA, Turnstile, WPScan, Patchstack, Twilio) survive
   a key and salt change. They were previously left unreadable, so those integrations
   stopped working with no explanation.
 * Fix: Turning off automatic updates no longer stops WordPress from checking for
   updates or slows down the admin area. Update notices, including security releases,
   keep working.
 * Security: The two-factor code screen is now tied to the browser that signed in.
   It could previously be shown to another visitor who requested the login page 
   at the right moment.
 * Security: Two-factor authentication is now required over XML-RPC and for application
   passwords, which previously bypassed it.
 * Security: Login attempt limits now count by IP address as well as username, so
   attempts spread across many usernames are limited and one account can no longer
   be locked out on demand. Lockout messages no longer reveal whether an account
   exists.
 * Security: CAPTCHA can no longer be skipped by sending an authorization header
   with the login request.
 * Security: The plugin deactivation link is now confirmed with a form submission
   instead of acting on a plain link, its secret is kept encrypted, and it changes
   after each use.
 * Security: The compromised-password check is rate limited. It could previously
   be called repeatedly by anyone to exhaust the server.
 * Security: HTTP authentication now also covers xmlrpc.php, and no longer alters
   the submitted password before checking it, which could reject valid passwords.
 * Security: The login recovery link is kept out of settings exports and support
   reports, and credentials are removed on uninstall even when settings are kept.
 * Performance: Scan results and CAPTCHA debug logs are no longer loaded on every
   page request, and settings are read later in the load order.
 * Performance: Front-end assets now load only where a plugin feature is actually
   on the page — a page with no forms, widgets, or CAPTCHA loads no plugin CSS/JS
   and no jQuery.
 * Improvement: Reworked the Vulnerability Scanner scan-history view — full-width
   results table and a corrected trend chart.
 * Maintenance: Removed the previous interface and its opt-in switch, the now-unused
   styles behind it, and dead IP-switch AJAX handlers.

#### 1.0.23

 * Privacy: Removed unpublished product-usage analytics code and dependencies before
   release.
 * Privacy: Removed automatic dashboard blog-feed and remote country-flag requests.
 * Fix: Free mode no longer requests Pro-only blocklist routes or mounts Pro-only
   settings screens.
 * Compatibility: Restored the documented WordPress 5.6 and PHP 7.0 runtime floor
   without changing the database schema.
 * Maintenance: Removed repository GitHub Actions while preserving local release
   checks.

#### 1.0.22

 * Improvement: Added localized passkey login feedback supplied by Ultimate Security
   Pro.
 * Security: Render passkey login errors as text instead of interpolating error 
   content into HTML.

#### 1.0.21

 * New: WordPress Salt keys rotation option. Now you can schedule, skip and more
   when rotating keys.
 * New: Now you can see the reCaptcha Logs directly from the plugin’s setting page.
 * Improvement: Both reCaptcha and Cloudflare Turnstile follow a similar settings
   structure for consistency.
 * Fix: Cloudflare Turnstile and reCAPTCHA whitelist option was not working properly.

#### 1.0.20

 * New: Improved Session Management settings including concurrent login limits, 
   session cookie hardening and more,
 * New: Cloudflare Turnstile and reCAPTCHA CAPTCHA verifcation when applying their
   respective keys.
 * Improvement: Cloudflare WAF rules function improvement.
 * Improvement: Code optimization and performance improvements.

#### 1.0.19

 * Fix: 2FA User role was not working properly.
 * Fix: Login activity dashboard modal was showing wrong agent.
 * Improvement: Better user friendly Server Protection Card Design
 * Improvement: Code cleanup and optimization.

#### 1.0.18

 * New: One-click Cloudflare WAF rules apply
 * New: New Modal for Login activity with detailed information.
 * Improvement: Code cleanup and optimization
 * Fix: Login redirected URL was showing exisiting login for password reset

#### 1.0.17

 * Fix: Minor bug fixes and stability improvements
 * Improvement: Code cleanup and optimization

#### 1.0.16

 * Improvement: Code improvements to the ovearll plugin making it snappier.

#### 1.0.15

 * Improvement: Conflict management between applied settings.
 * Improvement: UI improvements to existing settings pages. Making it more intuitive
   to use.
 * Fix: Multiple bug fixes to dashboard. You should get more accurate results now.
 * Fix: New deactivation URL was not saving after deactiviting-activating plugin.

#### 1.0.14

 * Fix: Email 2FA codes were not being sent properly
 * Fix: 2FA code page flickering effect after login

#### 1.0.13

 * New: Completely redesigned user interface for better usability

#### 1.0.12

 * New: Security Score meter to track your site’s security level
 * Improvement: Enhanced modal design for better UI/UX

#### 1.0.11

 * Fix: Minor UI bug fixes

#### 1.0.10

 * Security: Removed unauthenticated AJAX actions
 * Security: REST routes now require admin permission

#### 1.0.9

 * Fix: Dashboard emergency deactivation URL display issue

#### 1.0.8

 * Improvement: Human-readable values in activity log
 * Improvement: Reduced plugin size with optimized code
 * Fix: 2FA reset issue for users
 * Fix: Password policy not applying to new users

#### 1.0.7

 * New: Activity Log feature
 * New: Improved dashboard design
 * Fix: Nonce validation issues
 * Fix: Turnstile not showing on comment forms

#### 1.0.6

 * Fix: Custom login setup issues
 * Fix: Email 2FA asking for OTP twice
 * Fix: Feedback form email delivery
 * Improvement: Reorganized menu navigation
 * Improvement: Performance optimizations

#### 1.0.5

 * Fix: Request logs page display issue
 * Fix: URL Guard SQL query display
 * Improvement: Performance optimizations

#### 1.0.4

 * Redesigned settings page interface

## ميتا Meta

 *  Version **1.0.29**
 *  Last updated **قبل 7 أيام**
 *  Active installations **10+**
 *  WordPress version ** 5.6 أو أعلى **
 *  Tested up to **7.1.1**
 *  PHP version ** 7.1 أو أعلى **
 *  Languages
 * [English (US)](https://wordpress.org/plugins/ultimate-security/) و [Lao](https://lo.wordpress.org/plugins/ultimate-security/).
 *  [ترجمة إلى لغتك](https://translate.wordpress.org/projects/wp-plugins/ultimate-security)
 * Tags
 * [captcha](https://ar.wordpress.org/plugins/tags/captcha/)[login security](https://ar.wordpress.org/plugins/tags/login-security/)
   [security](https://ar.wordpress.org/plugins/tags/security/)[two factor authentication](https://ar.wordpress.org/plugins/tags/two-factor-authentication/)
   [vulnerability scanner](https://ar.wordpress.org/plugins/tags/vulnerability-scanner/)
 *  [عرض متقدم](https://ar.wordpress.org/plugins/ultimate-security/advanced/)

## التقييم

لم يتم تقديم أي مراجعات بعد.

[Your review](https://wordpress.org/support/plugin/ultimate-security/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/ultimate-security/reviews/)

## المساهمون

 *   [ WP Ultimate Security ](https://profiles.wordpress.org/wpultimatesecurity/)

## الدعم

لديك شيء لتقوله؟ بحاجة الى مساعدة؟

 [عرض منتدى الدعم](https://wordpress.org/support/plugin/ultimate-security/)

## تبرع

هل ترغب في تقديم دعم متقدم لهذه الإضافة؟

 [ تبرع لهذه الإضافة ](https://www.wpultimatesecurity.com)