All-In-One Security (AIOS) – Security and Firewall

Reviewers are broadly happy and call it a reliable, feature-rich security plugin with helpful support, though one recent reviewer is annoyed by the setup wizard taking over first login and another says spam control didn't work.

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

2617 searches this plugin appeared in over the last 90 days, 20 listed. 2534 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 4.8 years ago; the previous band took 16 months to cross, which places it about 80% of the way through.

1. ★★★★★ tsor10

   4mo ago

   Efficient and reliable.

   Read on wp.org ↗
2. ★★★★★ Oleg Chuvakin

   4mo ago

   I have been using the AIOS plugin since around 2016, and working with WordPress since 2014. This means I have trusted AIOS with the core security of my projects for a very long time. I especially value the firewall, which is the very heart of this plugin. Without this shield, my sites would feel fragile and vulnerable. The AIOS plugin comes with exceptional technical support: their responses are fast, concise, and accurate. Outstanding work and excellent service!

   Read on wp.org ↗
3. ★★★★★ WSANADA

   4mo ago

   Helped me to keep my websites safe.

   Read on wp.org ↗
4. ★★★★★ Scott

   5mo ago

   I tried out a few AIOS plugins and wasn’t really satisfied with any of them. Then I installed this AIOS and was pleasantly surprised, because there was a wizard for the most important settings that opened right away. I then went through every tab in this plugin. Everywhere I looked, there were detailed explanations of what the available settings do. There’s also a scoring system that indicates the level of security. And all of this without even using the paid version—it’s basically basic protection. The paid version offers even more options, but even the Basic version alone is great for keeping yourself locked out! 🙂 The support team was friendly and patient; they helped me get back into the system quickly and even had some advice for me at the end. You can’t ask for more from an AIOS. I won’t be using the subscription service—I simply can’t afford it. :-/

   Read on wp.org ↗
5. ★★★★★ babysavers

   5mo ago

   Decided to try this instead of moderating all comments. Nope nope nope. Hundreds of spam comments to parse through in just a few days. This is not even close to “spam prevention” even with every option enabled for both Comment Spam and Comment Spam IP monitoring. Do not rely on this plugin for spam control.

   Read on wp.org ↗
6. ★★★★★ juanmag

   5mo ago

   Easy setup, clear logs, and it blocked suspicious traffic without breaking my site.

   Read on wp.org ↗
7. ★★★★★ m0n0mind

   5mo ago

   We’re using AIOS for quite some years now already as our basic go-to solution for adding some extra-layers of security hardening features to our wordpress installs. In my opinion it’s one of the best freely available plugins in this category, actively developed and maintained and we have never been disappointed. We’re not using the whole set of available features, though. The support staff is also very helpful and the developers are open to feature and improvement requests as well. Keep up the good work!

   Read on wp.org ↗
8. ★★★★★ WPHostee

   5mo ago

   At WPHostee.com, we host thousands of WordPress websites, and one thing they all have in common is AIOS. Quite simply, we would not feel comfortable running WordPress websites without it. We have tried many security plugins over the years, but AIOS remains our preferred choice thanks to its excellent protection, reliability, ease of use, and continuous improvements. It gives us confidence that our clients’ websites are protected against many of the most common security threats. For us, AIOS is not just another plugin—it is an essential part of every WordPress website we host. We highly recommend it to anyone serious about WordPress security. Thank you to the AIOS team for building such an outstanding product. Keep up the excellent work!

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 5.4.9 TWEAK: Added a filter that validates POST requests containing UDRPC messages TWEAK: Update the internal common libs package to latest version 5.4.9
2. — Version 5.4.8 SECURITY: Escaped debug log messages before rendering them in the admin area to prevent a stored XSS vulnerability. Thanks to Dmitrii Ignatyev for disclosing this defect. (This issue required both the debug logging featu 5.4.8
3. — Version 5.4.7 FEATURE: Added a dashboard widget for the top 5 failed login attempts by IP & username and a chart for the number of failed logins over the last 7 days. FIX: WordPress 7.0 admin UI compatibility issues resolved. FIX: Bla 5.4.7
4. — Version 5.4.6 FIX: PHP Fatal error: Uncaught Error: Call to a member function get_user_otp_algorithm() on null. FIX: Prevent redirection to settings when AIOS is installed through the onboarding wizard of another plugin. 5.4.6
5. — Version 5.4.5 FEATURE: Added onboarding wizard on activation of the plugin. FEATURE: Added reports function for UDC. FEATURE: Added additional commands for interoperability with UDC FIX: Logged in users table not correctly tracking mu 5.4.5
6. — Version 5.4.4 FEATURE: Added new and improved existing modules for UpdraftCentral. FIX: The theme’s custom 404 page does not parse and instead displays the shortcodes for wp-login.php, due to the login page having been renamed. FIX: 4 5.4.4

All 28 disclosed vulnerabilities are patched in the current version (5.5.1). Sites still on an older version should update.

1. Patched Medium · 6.3 All-In-One Security (AIOS) – Security and Firewall <= 5.4.8 - Authenticated (Subscriber+) Security Control Bypass ↗
   2026-09-24 CVE-2026-96825 Protection Mechanism Failure Affects <= 5.4.8 Patched in 5.4.9
2. Patched High · 7.2 All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path ↗
   2026-06-05 CVE-2026-8438 Improper Neutralization of Input During Web Page Generation Affects <= 5.4.7 Patched in 5.4.8
3. Patched Medium · 4.3 All In One WP Security <= 5.2.6 - Cross-Site Request Forgery to IP Blocking ↗
   2024-02-08 CVE-2024-30468 Cross-Site Request Forgery Affects <= 5.2.6 Patched in 5.2.7
4. Patched Medium · 6.1 All-In-One Security (AIOS) – Security and Firewall <= 5.2.5 - Reflected Cross-Site Scripting ↗
   2024-02-06 CVE-2024-1037 Improper Neutralization of Input During Web Page Generation Affects <= 5.2.5 Patched in 5.2.6
5. Patched Medium · 5.3 All In One WP Security <= 5.2.4 - Protection Bypass of Renamed Login Page via URL Encoding ↗
   2023-10-25 CVE-2023-52147 Protection Mechanism Failure Affects < 5.2.5 Patched in 5.2.5
6. Patched Medium · 5.9 All In One WP Security 5.1.9 - Plaintext Storage of Credentials ↗
   2023-07-11 Plaintext Storage of a Password Affects 5.1.9 Patched in 5.2.0
7. Patched Medium · 4.4 All-In-One Security (AIOS) <= 5.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
   2023-03-20 CVE-2023-0157 Improper Neutralization of Input During Web Page Generation Affects <= 5.1.4 Patched in 5.1.5
8. Patched Medium · 4.9 All-In-One Security (AIOS) <= 5.1.4 - Authenticated(Admin+) Directory Traversal ↗
   2023-02-14 CVE-2023-0156 Improper Limitation of a Pathname to a Restricted Directory Affects <= 5.1.4 Patched in 5.1.5
9. Patched Medium · 5.3 All-In-One Security <= 5.1.2 - Information Disclosure ↗
   2022-12-09 CVE-2022-4346 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 5.1.2 Patched in 5.1.3
10. Patched High · 8.8 All In One WP Security & Firewall <= 5.1.0 - Cross-Site Request Forgery ↗
    2022-11-22 CVE-2022-44737 Cross-Site Request Forgery Affects <= 5.1.0 Patched in 5.1.1
11. Patched Medium · 6.5 All-In-One Security (AIOS) – Security and Firewall <= 5.0.8 - IP Spoofing to Protection Mechanism Bypass ↗
    2022-11-21 CVE-2022-4097 Use of Less Trusted Source Affects <= 5.0.7 Patched in 5.0.8
12. Patched High · 8.8 All In One WP Security & Firewall <= 5.1.0 - Cross-Site Request Forgery ↗
    2022-11-17 Cross-Site Request Forgery Affects <= 5.1.0 Patched in 5.1.1
13. Patched Medium · 6.5 All In One WP Security & Firewall 5.0.0 - 5.0.7 - Protection Bypass via IP Spoofing ↗
    2022-09-30 Use of Less Trusted Source Affects 5.0.0 - 5.0.7 Patched in 5.0.8
14. Patched Medium · 6.1 All In One WP Security & Firewall <= 4.4.10 - Open Redirect and Reflected Cross-Site Scripting ↗
    2022-04-11 CVE-2021-25102 Improper Neutralization of Input During Web Page Generation Affects < 4.4.11 Patched in 4.4.11
15. Patched Medium · 6.1 All In One WP Security & Firewall <= 4.4.5 - Cross-Site Scripting ↗
    2020-12-24 CVE-2020-29171 Improper Neutralization of Input During Web Page Generation Affects < 4.4.6 Patched in 4.4.6
16. Patched Medium · 4.7 All In One WP Security & Firewall <= 4.4.3 - Reflected Cross-Site Scripting ↗
    2020-09-08 Improper Neutralization of Input During Web Page Generation Affects <= 4.4.3 Patched in 4.4.4
17. Patched Critical · 9.8 All In One WP Security & Firewall <= 4.0.8 - SQL Injection ↗
    2019-08-14 CVE-2016-10887 Improper Neutralization of Special Elements used in an SQL Command Affects < 4.0.9 Patched in 4.0.9
18. Patched Medium · 6.1 All In One WP Security & Firewall <= 4.1.9 - Reflected Cross-Site Scripting ↗
    2016-11-11 CVE-2016-10866 Improper Neutralization of Input During Web Page Generation Affects < 4.2.0 Patched in 4.2.0
19. Patched Medium · 5.3 All In One WP Security & Firewall <= 4.1.2 - Captcha Bypass ↗
    2016-07-31 Guessable CAPTCHA Affects <= 4.1.2 Patched in 4.1.3
20. Patched Critical · 9.8 All In One WP Security & Firewall <= 4.0.6 - SQL Injection ↗
    2016-04-06 CVE-2016-10888 Improper Neutralization of Special Elements used in an SQL Command Affects < 4.0.7 Patched in 4.0.7
21. Patched Medium · 6.1 All In One WP Security & Firewall <= 4.0.5 - Cross-Site Scripting ↗
    2016-02-23 CVE-2016-10867 Improper Neutralization of Input During Web Page Generation Affects < 4.0.6 Patched in 4.0.6
22. Patched Medium · 6.1 All In One WP Security & Firewall <= 4.0.4 - Cross-Site Scripting ↗
    2016-02-22 CVE-2016-10868 Improper Neutralization of Input During Web Page Generation Affects < 4.0.5 Patched in 4.0.5
23. Patched Medium · 6.1 All In One WP Security & Firewall <= 3.9.7 - Cross-Site Scripting ↗
    2015-08-15 CVE-2015-9293 Improper Neutralization of Input During Web Page Generation Affects < 3.9.8 Patched in 3.9.8
24. Patched Medium · 6.1 All In One WP Security & Firewall <= 3.9.4 - Reflected Cross-Site Scripting ↗
    2015-04-20 CVE-2015-9294 Improper Neutralization of Input During Web Page Generation Affects < 3.9.5 Patched in 3.9.5
25. Patched Critical · 9.8 All In One WP Security & Firewall <= 3.9.0 - SQL Injection ↗
    2015-04-06 CVE-2015-9310 Improper Neutralization of Special Elements used in an SQL Command Affects < 3.9.1 Patched in 3.9.1
26. Patched Low · 3.1 All In One WP Security & Firewall <= 3.8.9 - Cross-Site Request Forgery ↗
    2015-03-06 CVE-2015-0895 Cross-Site Request Forgery Affects <= 3.8.9 Patched in 3.9.0
27. Patched Critical · 9.0 All In One WP Security & Firewall <= 3.8.7 - SQL Injection ↗
    2015-03-06 CVE-2015-0894 Improper Neutralization of Special Elements used in an SQL Command Affects < 3.8.8 Patched in 3.8.8
28. Patched High · 7.4 All In One WP Security & Firewall <= 3.8.2 - Authenticated Access or Cross-Site Request Forgery leading to SQL Injection via orderby, order Parameters ↗
    2014-09-24 CVE-2014-6242 Improper Neutralization of Special Elements used in an SQL Command Affects < 3.8.3 Patched in 3.8.3

Translated into 58 languages, 13 at 90% or more

Plus 34 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2022-01-01 900K+ → 1M+ up after 487 days in tier
2. 2020-09-01 800K+ → 900K+ up after 488 days in tier
3. 2019-05-02 700K+ → 800K+ up after 243 days in tier
4. 2018-09-01 600K+ → 700K+ up after 333 days in tier
5. 2017-10-03 500K+ → 600K+ up after 244 days in tier
6. 2017-02-01 400K+ → 500K+ up after 208 days in tier
7. 2016-07-08 300K+ → 400K+ up after 189 days in tier
8. 2016-01-01 200K+ → 300K+ up after 226 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for All-In-One Security (AIOS) – Security and Firewall into a readme, a review or a deck. It updates itself.

All-In-One Security (AIOS) – Security and Firewall: 1M+ active installs, 4.7★ (1,720 reviews). Plugin Pulse (WP Mayor), as of 2026-11-03. https://plugins.wpmayor.com/plugin/all-in-one-wp-security-and-firewall