All-In-One Security (AIOS) – Security and Firewall

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 74% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Modeled within the band wp.org reports; tightens as we track daily.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

Reviewers keep calling AIOS reliable for hardening and firewall work, with praise for the setup wizard and fast support, though one recent reviewer says its comment spam blocking let hundreds through.

1. ★★★★★ tsor10

   1mo ago

   Efficient and reliable.

   Read on wp.org ↗
2. ★★★★★ Oleg Chuvakin

   1mo ago

   I have been using the AIOS plugin since around 2016, and working with WordPress since 2014. This means I have trusted AIOS with the core security of my projects for a very long time. I especially value the firewall, which is the very heart of this plugin. Without this shield, my sites would feel fragile and vulnerable. The AIOS plugin comes with exceptional technical support: their responses are fast, concise, and accurate. Outstanding work and excellent service!

   Read on wp.org ↗
3. ★★★★★ WSANADA

   2mo ago

   Helped me to keep my websites safe.

   Read on wp.org ↗
4. ★★★★★ Scott

   2mo ago

   I tried out a few AIOS plugins and wasn’t really satisfied with any of them. Then I installed this AIOS and was pleasantly surprised, because there was a wizard for the most important settings that opened right away. I then went through every tab in this plugin. Everywhere I looked, there were detailed explanations of what the available settings do. There’s also a scoring system that indicates the level of security. And all of this without even using the paid version—it’s basically basic protection. The paid version offers even more options, but even the Basic version alone is great for keeping yourself locked out! 🙂 The support team was friendly and patient; they helped me get back into the system quickly and even had some advice for me at the end. You can’t ask for more from an AIOS. I won’t be using the subscription service—I simply can’t afford it. :-/

   Read on wp.org ↗
5. ★★★★★ babysavers

   2mo ago

   Decided to try this instead of moderating all comments. Nope nope nope. Hundreds of spam comments to parse through in just a few days. This is not even close to “spam prevention” even with every option enabled for both Comment Spam and Comment Spam IP monitoring. Do not rely on this plugin for spam control.

   Read on wp.org ↗
6. ★★★★★ juanmag

   3mo ago

   Easy setup, clear logs, and it blocked suspicious traffic without breaking my site.

   Read on wp.org ↗
7. ★★★★★ m0n0mind

   3mo ago

   We’re using AIOS for quite some years now already as our basic go-to solution for adding some extra-layers of security hardening features to our wordpress installs. In my opinion it’s one of the best freely available plugins in this category, actively developed and maintained and we have never been disappointed. We’re not using the whole set of available features, though. The support staff is also very helpful and the developers are open to feature and improvement requests as well. Keep up the good work!

   Read on wp.org ↗
8. ★★★★★ WPHostee

   3mo ago

   At WPHostee.com, we host thousands of WordPress websites, and one thing they all have in common is AIOS. Quite simply, we would not feel comfortable running WordPress websites without it. We have tried many security plugins over the years, but AIOS remains our preferred choice thanks to its excellent protection, reliability, ease of use, and continuous improvements. It gives us confidence that our clients’ websites are protected against many of the most common security threats. For us, AIOS is not just another plugin—it is an essential part of every WordPress website we host. We highly recommend it to anyone serious about WordPress security. Thank you to the AIOS team for building such an outstanding product. Keep up the excellent work!

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 5.4.9 TWEAK: Added a filter that validates POST requests containing UDRPC messages TWEAK: Update the internal common libs package to latest version 5.4.9
2. — Version 5.4.8 SECURITY: Escaped debug log messages before rendering them in the admin area to prevent a stored XSS vulnerability. Thanks to Dmitrii Ignatyev for disclosing this defect. (This issue required both the debug logging featu 5.4.8
3. — Version 5.4.7 FEATURE: Added a dashboard widget for the top 5 failed login attempts by IP & username and a chart for the number of failed logins over the last 7 days. FIX: WordPress 7.0 admin UI compatibility issues resolved. FIX: Bla 5.4.7
4. — Version 5.4.6 FIX: PHP Fatal error: Uncaught Error: Call to a member function get_user_otp_algorithm() on null. FIX: Prevent redirection to settings when AIOS is installed through the onboarding wizard of another plugin. 5.4.6
5. — Version 5.4.5 FEATURE: Added onboarding wizard on activation of the plugin. FEATURE: Added reports function for UDC. FEATURE: Added additional commands for interoperability with UDC FIX: Logged in users table not correctly tracking mu 5.4.5
6. — Version 5.4.4 FEATURE: Added new and improved existing modules for UpdraftCentral. FIX: The theme’s custom 404 page does not parse and instead displays the shortcodes for wp-login.php, due to the login page having been renamed. FIX: 4 5.4.4

27 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. High · 7.2 All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path ↗
   2026-06-05 CVE-2026-8438 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.4.7 Patched in 5.4.8
2. Medium · 4.3 All In One WP Security <= 5.2.6 - Cross-Site Request Forgery to IP Blocking ↗
   2024-02-08 CVE-2024-30468 Cross-Site Request Forgery (CSRF) Affects <= 5.2.6 Patched in 5.2.7
3. Medium · 6.1 All-In-One Security (AIOS) – Security and Firewall <= 5.2.5 - Reflected Cross-Site Scripting ↗
   2024-02-06 CVE-2024-1037 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.2.5 Patched in 5.2.6
4. Medium · 5.3 All In One WP Security <= 5.2.4 - Protection Bypass of Renamed Login Page via URL Encoding ↗
   2023-10-25 CVE-2023-52147 Protection Mechanism Failure Affects < 5.2.5 Patched in 5.2.5
5. Medium · 5.9 All In One WP Security 5.1.9 - Plaintext Storage of Credentials ↗
   2023-07-11 Plaintext Storage of a Password Affects 5.1.9 Patched in 5.2.0
6. Medium · 4.4 All-In-One Security (AIOS) <= 5.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
   2023-03-20 CVE-2023-0157 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.4 Patched in 5.1.5
7. Medium · 4.9 All-In-One Security (AIOS) <= 5.1.4 - Authenticated(Admin+) Directory Traversal ↗
   2023-02-14 CVE-2023-0156 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 5.1.4 Patched in 5.1.5
8. Medium · 5.3 All-In-One Security <= 5.1.2 - Information Disclosure ↗
   2022-12-09 CVE-2022-4346 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 5.1.2 Patched in 5.1.3
9. High · 8.8 All In One WP Security & Firewall <= 5.1.0 - Cross-Site Request Forgery ↗
   2022-11-22 CVE-2022-44737 Cross-Site Request Forgery (CSRF) Affects <= 5.1.0 Patched in 5.1.1
10. Medium · 6.5 All-In-One Security (AIOS) – Security and Firewall <= 5.0.8 - IP Spoofing to Protection Mechanism Bypass ↗
    2022-11-21 CVE-2022-4097 Use of Less Trusted Source Affects <= 5.0.7 Patched in 5.0.8
11. High · 8.8 All In One WP Security & Firewall <= 5.1.0 - Cross-Site Request Forgery ↗
    2022-11-17 Cross-Site Request Forgery (CSRF) Affects <= 5.1.0 Patched in 5.1.1
12. Medium · 6.5 All In One WP Security & Firewall 5.0.0 - 5.0.7 - Protection Bypass via IP Spoofing ↗
    2022-09-30 Use of Less Trusted Source Affects 5.0.0 - 5.0.7 Patched in 5.0.8
13. Medium · 6.1 All In One WP Security & Firewall <= 4.4.10 - Open Redirect and Reflected Cross-Site Scripting ↗
    2022-04-11 CVE-2021-25102 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 4.4.11 Patched in 4.4.11
14. Medium · 6.1 All In One WP Security & Firewall <= 4.4.5 - Cross-Site Scripting ↗
    2020-12-24 CVE-2020-29171 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 4.4.6 Patched in 4.4.6
15. Medium · 4.7 All In One WP Security & Firewall <= 4.4.3 - Reflected Cross-Site Scripting ↗
    2020-09-08 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.4.3 Patched in 4.4.4
16. Critical · 9.8 All In One WP Security & Firewall <= 4.0.8 - SQL Injection ↗
    2019-08-14 CVE-2016-10887 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 4.0.9 Patched in 4.0.9
17. Medium · 6.1 All In One WP Security & Firewall <= 4.1.9 - Reflected Cross-Site Scripting ↗
    2016-11-11 CVE-2016-10866 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 4.2.0 Patched in 4.2.0
18. Medium · 5.3 All In One WP Security & Firewall <= 4.1.2 - Captcha Bypass ↗
    2016-07-31 Guessable CAPTCHA Affects <= 4.1.2 Patched in 4.1.3
19. Critical · 9.8 All In One WP Security & Firewall <= 4.0.6 - SQL Injection ↗
    2016-04-06 CVE-2016-10888 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 4.0.7 Patched in 4.0.7
20. Medium · 6.1 All In One WP Security & Firewall <= 4.0.5 - Cross-Site Scripting ↗
    2016-02-23 CVE-2016-10867 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 4.0.6 Patched in 4.0.6
21. Medium · 6.1 All In One WP Security & Firewall <= 4.0.4 - Cross-Site Scripting ↗
    2016-02-22 CVE-2016-10868 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 4.0.5 Patched in 4.0.5
22. Medium · 6.1 All In One WP Security & Firewall <= 3.9.7 - Cross-Site Scripting ↗
    2015-08-15 CVE-2015-9293 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.9.8 Patched in 3.9.8
23. Medium · 6.1 All In One WP Security & Firewall <= 3.9.4 - Reflected Cross-Site Scripting ↗
    2015-04-20 CVE-2015-9294 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.9.5 Patched in 3.9.5
24. Critical · 9.8 All In One WP Security & Firewall <= 3.9.0 - SQL Injection ↗
    2015-04-06 CVE-2015-9310 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 3.9.1 Patched in 3.9.1
25. Low · 3.1 All In One WP Security & Firewall <= 3.8.9 - Cross-Site Request Forgery ↗
    2015-03-06 CVE-2015-0895 Cross-Site Request Forgery (CSRF) Affects <= 3.8.9 Patched in 3.9.0
26. Critical · 9.0 All In One WP Security & Firewall <= 3.8.7 - SQL Injection ↗
    2015-03-06 CVE-2015-0894 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 3.8.8 Patched in 3.8.8
27. High · 7.4 All In One WP Security & Firewall <= 3.8.2 - Authenticated Access or Cross-Site Request Forgery leading to SQL Injection via orderby, order Parameters ↗
    2014-09-24 CVE-2014-6242 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 3.8.3 Patched in 3.8.3

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 55 languages, 9 at 90% or more

Plus 31 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

No tier crossings observed yet.

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention 1M+ installs · 4.8★ · 3 shared tags A
• Defender Security – Malware Scanner, Login Security & Firewall 80K+ installs · 4.8★ · 3 shared tags A
• Wordfence Login Security 60K+ installs · 3.9★ · 3 shared tags B
• BulletProof Security 20K+ installs · 4.8★ · 3 shared tags A
• Wordfence Security – Firewall, Malware Scan, and Login Security 5M+ installs · 4.7★ · 2 shared tags A
• Security Optimizer – The All-In-One Protection Plugin 1M+ installs · 4.5★ · 2 shared tags A

Embed this report card

Drop a live Pulse card for All-In-One Security (AIOS) – Security and Firewall into a readme, a review or a deck. It updates itself.

All-In-One Security (AIOS) – Security and Firewall: 1M+ active installs, 4.7★ (1,715 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/all-in-one-wp-security-and-firewall