Anti-Malware Security and Brute-Force Firewall

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 84% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

1. ★★★★★ computerinsight

   2mo ago

   I am so happy I found this. Nice clean UI, easy to install and run.Thank you….

   Read on wp.org ↗
2. ★★★★★ faydra_deon

   4mo ago

   My title pretty much says it all. The Anti-Malware Security and Brute-Force Firewall plugin is my go-to when I know there’s some issue on my site or a client’s site and Wordfence is indicating that there’s nothing wrong. I’ve donated several times and intend to donate multiple more times.

   Read on wp.org ↗
3. ★★★★★ bassivm

   4mo ago

   I used this fantastic plugin to clen a client website. I tried other famous plugin but I was surprise of the result of this one. So I suggest it.

   Read on wp.org ↗
4. ★★★★★ slawek7013

   6mo ago

   it works! 🙂 This topic was modified 4 months, 3 weeks ago by slawek7013.

   Read on wp.org ↗
5. ★★★★★ kjcomparaz

   7mo ago

   It works all the time!

   Read on wp.org ↗
6. ★★★★★ rimmer100

   7mo ago

   Highly recommened and well woth the donation, pulled me out of a hole wordfence didnt spot.

   Read on wp.org ↗
7. ★★★★★ greymouse

   8mo ago

   I can’t say enough good (be sure to donate to get even STRONGER protection) about Anti-Malware plugin. It has been able to clean up several of my sites over the past few yrs with very little effort after some malicious infiltrations. THANK YOU!!!

   Read on wp.org ↗
8. ★★★★★ ngmcadmin

   9mo ago

   Does the job better than another ‘more popular’ plugin failed to do! Great community and support too!

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 4.23.90 Incremented version number to force update of index file that was missing changes from the last update. 4.23.90
2. — Version 4.23.89 Fixed XSS vulnerability to prevent WP Administrators from inserting script into the REQUEST_URI. Checked code for compatibility with WordPress 7.0 and ClassicPress 2.7. 4.23.89
3. — Version 4.23.88 Fixed PHP Object Injection vulnerability with DB Scan. 4.23.88
4. — Version 4.23.87 Checked code for compatibility with WordPress 6.9.1 and ClassicPress 2.6. 4.23.87
5. — Version 4.23.85 Fixed the post_status field on custom post type for scan results and added log of all scan errors to the post_meta. 4.23.85
6. — Version 4.23.83 Fixed a missing capability check on an admin-ajax API endpoint. Changed URLs for better compatibility with both HTTPS sites and HTTP sites. Checked code for compatibility with WordPress 6.8.3. 4.23.83

11 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. High · 7.2 Anti-Malware Security and Brute-Force Firewall <= 4.23.89 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-07-09 CVE-2026-57691 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.23.89 Patched in 4.23.90
2. High · 7.5 Anti-Malware Security and Brute-Force Firewall <= 4.23.87 - Authenticated (Contributor+) PHP Object Injection ↗
   2026-04-20 CVE-2026-39478 Deserialization of Untrusted Data Affects <= 4.23.87 Patched in 4.23.88
3. Medium · 6.5 Anti-Malware Security and Brute-Force Firewall <= 4.23.81 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read ↗
   2025-10-28 CVE-2025-11705 Missing Authorization Affects <= 4.23.81 Patched in 4.23.83
4. Critical · 9.0 Anti-Malware Security and Brute-Force Firewall <= 4.21.96 - Unauthenticated Remote Code Execution ↗
   2024-03-12 CVE-2024-22144 Improper Control of Generation of Code ('Code Injection') Affects <= 4.21.96 Patched in 4.23.56
5. High · 7.2 Anti-Malware Security and Brute-Force Firewall <= 4.21.85 - Authenticated (Admin+) PHP Object Injection ↗
   2022-12-21 CVE-2022-4327 Deserialization of Untrusted Data Affects <= 4.21.85 Patched in 4.21.86
6. Medium · 6.1 Anti-Malware Security and Brute-Force Firewall <= 4.20.95 - Reflected Cross-Site Scripting ↗
   2022-04-11 CVE-2022-0953 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 4.20.96 Patched in 4.20.96
7. Medium · 6.1 Anti-Malware Security and Brute-Force Firewall <= 4.21.74 - Reflected Cross-Site Scripting ↗
   2022-02-08 CVE-2022-2599 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.21.74 Patched in 4.21.83
8. Medium · 6.1 Anti-Malware Security and Brute-Force Firewall <= 4.20.93 - Reflected Cross-Site Scripting ↗
   2022-01-24 CVE-2021-25101 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 4.20.94 Patched in 4.20.94
9. High · 7.2 Anti-Malware Security and Brute-Force Firewall <= 4.15.17 - Cross-Site Scripting ↗
   2016-05-10 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.15.17 Patched in 4.16.18
10. Low · 3.1 Anti-Malware Security and Brute-Force Firewall <= 4.15.22 - Cross-Site Request Forgery ↗
    2015-05-25 Cross-Site Request Forgery (CSRF) Affects < 4.15.23 Patched in 4.15.23
11. Medium · 6.1 Anti-Malware Security and Brute-Force Firewall <= 4.15.22 - Cross-Site Scripting ↗
    2015-05-25 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 4.15.23 Patched in 4.15.23

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 30 languages, 8 at 90% or more

Plus 6 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-03-14 200K+ → 100K+ down after 1 days in tier
2. 2025-03-13 100K+ → 200K+ up after 4 days in tier
3. 2025-03-09 200K+ → 100K+ down after 5 days in tier
4. 2025-03-04 100K+ → 200K+ up after 1 days in tier
5. 2025-03-03 200K+ → 100K+ down after 9 days in tier
6. 2025-02-22 100K+ → 200K+ up after 74 days in tier
7. 2024-12-10 200K+ → 100K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Wordfence Security – Firewall, Malware Scan, and Login Security 5M+ installs · 4.7★ · 3 shared tags A
• Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention 1M+ installs · 4.8★ · 3 shared tags A
• WP Ghost (Hide My WP Ghost) – Security & Firewall 100K+ installs · 4.5★ · 3 shared tags A
• IP Geo Block 8K+ installs · 4.1★ · 3 shared tags D
• BotBlocker Security – Complete security platform 3K+ installs · 4.4★ · 3 shared tags A
• Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… 2K+ installs · 4.6★ · 3 shared tags A

Embed this report card

Drop a live Pulse card for Anti-Malware Security and Brute-Force Firewall into a readme, a review or a deck. It updates itself.

Anti-Malware Security and Brute-Force Firewall: 100K+ active installs, 4.9★ (783 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/gotmls