Security Plugin, Firewall & Malware Scanner with Auto Removal
by CleanTalk Inc · Security
Also makes 3 other plugins · 240.2K+ installs across the portfolio →
Protect WordPress from malware, hackers, brute-force attacks & suspicious traffic. Includes firewall, login security, 2FA & vulnerability checks.
Try it live opens a temporary test site in your browser, which can take about 20 seconds to load. Plugins that rely on outside services or a full server may not work completely there.
Health
A 92/100
no flags
Active installs
40K+
≈41K estimated
Momentum
+1%
downloads vs prior 30d
Biggest opportunity: Swap “login” for “brute force attacks”. “login” isn't earning its slot: you're not in the first 24 results for its own search. “brute force attacks” sits at #4 untagged, close enough for a declared tag to move it up. All five slots are taken, so one has to go.
92 health vs 66 average across 1,778 Security plugins
Install conversion
How it's measured →1.3%
of downloads still active
At least 40K of 3.1M lifetime downloads are still running, in line with its category: the median Security plugin keeps 1.4%, across 1,061 plugins.
Downloads count every update, not just first installs, so older and more frequently released plugins read lower. Compare against other Security plugins, not across the directory. wp.org reports active installs as the bottom of a band, so the real rate is this or higher.
This plugin shipped 26 releases in the last 12 months, and every existing install that updated counted as another download. wp.org publishes no split between first installs and updates, so we show the raw rate rather than guess at one.
Details
Directory ranking optimization
How it's scored →How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.
Excellent listing optimization
Well tuned across the board
Updated 6 days ago
Tested up to WordPress 7.1.4, the current branch or newer
4.8★ over 397 reviews, smoothed to 4.72★
5 of 5 tags set · short description in place
34 of 40 support threads resolved in the last 2 months
Search visibility
How it's tracked →Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.
55
Momentum
Holding steady
+1.1
Velocity
places per keyword, 28d
53%
Breadth
of keywords climbing, 28d
+0.8
Acceleration
recent half vs earlier
wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.
| Keyword | wp.org | On merit | wp.org move, 90 days |
|---|---|---|---|
| removal | #1 | #1 | up 1 |
| auto | #1 | #1 | 0 |
| hackers | #1 | #1 | 0 |
| xss | #1 | #1 | 0 |
| cve | #1 | #1 | 0 |
| security plugin | #2 | #2 | 0 |
| firewall your tag | #2 | #2 | up 1 |
| malware your tag | #2 | #2 | 0 |
| scanner | #2 | #2 | 0 |
| malware scanner | #2 | #2 | 0 |
| plugin scanner | #1 | #1 | 0 |
| qr scanner | #1 | #1 | 0 |
| security audit | #2 | #2 | 0 |
| malware scan | #2 | #2 | 0 |
| malware detection | #2 | #2 | 0 |
| security headers | #2 | #2 | 0 |
| block hackers | #2 | #2 | up 1 |
| web application firewall | #2 | #2 | 0 |
| security scanner | #2 | #2 | 0 |
| vulnerability scanner | #2 | #2 | 0 |
| login your tag | Not in the top 24 | ||
1514 searches this plugin appeared in over the last 90 days, 20 listed. 1377 left out as unrelated or noise (years, numbers, stray words). 1 of its tags isn't in the top 24 for their own search.
What to do about it
- Swap “login” for “brute force attacks”. “login” isn't earning its slot: you're not in the first 24 results for its own search. “brute force attacks” sits at #4 untagged, close enough for a declared tag to move it up. All five slots are taken, so one has to go.
Daily downloads
Since 5 Oct 2022 · 1,490 days · wp.org + Plugin Pulse archive
30-day downloads
Rolling 30-day volume · peak 121.5K · peaks are release surges
Directory rank vs rivals
wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you
Rating trend
Star average over time · dips mark rough releases
Health trend
Composite health score, snapshotted daily
Update activity
How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.
Release cadence
Actively maintainedHow often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.
26
releases in the last 12 months
6d ago
latest release · v2.191 · 27 Oct 2026
311
tagged releases on record
Recent releases
What its installed base runs
via wordpress.orgShare of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.
Estimated active installs
The public count shows “40K+”. Our estimate pins where the real number sits.
Crossed into this band 3 months ago and the previous band took 2.2 years to cross, so the real count is still just over 40K.
At the current install trend, crossing 50K+ in roughly 122 days.
Install history since 21 Sep 2020
Recent reviews
All reviews on wp.org ↗- ★★★★★ alchemistthreadworks4mo ago
My website was attacked by malware. The Cleantalk team got it all cleaned up quickly, and they are still monitoring for any ongoing attacks. I highly recommend their service.
Read on wp.org ↗ - ★★★★★ suehallnet4mo ago
The team helped me sort out a few problems with my site. Very grateful
Read on wp.org ↗ - ★★★★★ l9ssowkn5tqnkn5mo ago
I’ve been client for many years. As a non-techy it took a while to find things out, but their support is great so it all worked out fine.
Read on wp.org ↗ - ★★★★★ cmikel5mo ago
The CleanTalk plugin alerted me to malware on my site and within a day CleanTalk’s technical support removed it from site. No downtime. Quick and efficient.
Read on wp.org ↗ - ★★★★★ nonasnonas5mo ago
A great plugin, realiable and updated. Excellent and quick assistance. Awesome!
Read on wp.org ↗ - ★★★★★ leverage11076mo ago
I have been using Security by CleanTalk (SPBCT) on a WordPress site for some time now and decided to leave a review because the plugin deserves more attention than it usually gets in WordPress security comparisons. What sold me initially was the scope. In one plugin you get a Web Application Firewall covering XSS and SQL injection, brute-force protection with configurable thresholds, a malware scanner that runs against both PHP files and database tables, automatic file cure/quarantine, two-factor authentication tied to user roles, the option to change the wp-login URL, IP and country blocking, traffic control with logging, a security audit log, and a leaked password check against known breach data. Most competing plugins push half of that into a paid tier. The architecture is worth mentioning. SPBCT itself is free and works together with the cloud service at cleantalk.org. There is no PRO upsell built into the admin UI, no nag screens, no banners trying to push me toward an upgrade. I find the pricing model honest. A flat fee per site, with the cloud dashboard giving you 45 days of visitor activity history and a clear view of what was blocked and why. In daily operation the plugin stays out of the way. I have not noticed any measurable performance impact, which matters because some security plugins quietly add hundreds of milliseconds to TTFB. Configuration takes a few minutes, defaults are reasonable, and the settings page is organised in a way that does not require hunting through nested tabs to find what you need. The release cadence is roughly every two weeks, which keeps the WAF rules and known-vulnerability database current without forcing me to update something every other day. The two-factor authentication implementation is simple. Email-based codes, configurable per role, with a 30-day browser remember option that only kicks in for new devices. Not the most sophisticated 2FA on the market, but it works and it is enough for most WordPress sites. I want to spend a sentence on the support team because that was the deciding factor for me. I have submitted a few tickets ranging from configuration questions to one slightly tricky compatibility issue, and the responses were quick, technically competent, and never copy-pasted. They actually read what I wrote, asked sensible follow-up questions, and resolved the issue. That kind of support is rare. If you are looking for a security plugin that handles malware scanning, firewall, login protection, and 2FA in one package without a permanent paywall in your admin panel, this one is worth installing. Recommended.
Read on wp.org ↗ - ★★★★★ Historic City News7mo ago
I like software that just works.
Read on wp.org ↗ - ★★★★★ Anonymous8mo ago
Hi, I’m writing to get some feedback. I have the Cleantalk antispam and security installed and my website got hacked via the password recovery hack. It seems there is no way to protect the wordpress login form with Cleantalk, no possibility to put a recaptcha on the login form. That’s why my bad low score for this plugin. After my website got hacked I went into the Cleantalk security panel to check if there was any anomalies and the plugin is not reporting any issues. This topic was modified 4 months, 1 week ago by enricooo.
Read on wp.org ↗
Latest updates
via wp.org changelogRecent releases and news for this plugin
- — Version 2.188 Fix. SecurityLog. Fixed ip column and timeline render. https://app.doboard.com/1/task/44430 Upd. Settings. Improve admins counter on settings page. https://app.doboard.com/1/task/42426 Upd. Firewall. Resolves the country 2.188
- — Version 2.187 Fix. Code. Remove unused code after react implemented. Fix. RemoteCalls. Improve flow to exclude freezing on local wp environment. Fix. Scanner. No extension files detection fixed. Fix. Settings. Improve psc detect in pl 2.187
- — Version 2.186 Mod. Settings. Transferring settings to React New. UserPassCheck. Debugging functionality using the cron task launch button Mod. UserPassCheck. Rendering the status of the check and its results Mod. PSCTab. Caching data 2.186
- — Version 2.185 Fix. Banners. Syncing trial and renew banners Fix. ScannerQueue. Increasing the chunk for parsing approved hashes Fix. Scanner. Removed the View suspicious code action for binary files and frontend infections Fix. Vulner 2.185
- — Version 2.184 New. BinaryCheck. Init module. New. BinaryCheck. Edits for the new module in the scanner Upd. Settings. Upload checker now is react-based. Upd. Settings. Traffic control now is react-based. Upd. Settings. Ip getting from 2.184
- — Version 2.183 Upd. Setup Wizard. Validate an AJAX access key via the API method before inserting. Upd. Banners. Trial banner promo texts fixed. Upd. Sync flow. Update sync flow. Fix. Upload checker. Logic fixed, nonce checking fixed. 2.183
Security history
via Wordfence IntelligenceAll 6 disclosed vulnerabilities are patched in the current version (2.191). Sites still on an older version should update.
- Patched High · 7.5 Security Plugin, Firewall & Malware Scanner with Auto Removal <= 2.184 - Unauthenticated SQL Injection ↗2026-08-19 CVE-2026-66593 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.184 Patched in 2.185
- Patched High · 7.2 Login Security, FireWall, Malware removal by CleanTalk <= 2.168 - Unauthenticated Stored Cross-Site Scripting via Page URL ↗2025-12-08 CVE-2025-13604 Improper Neutralization of Input During Web Page Generation Affects <= 2.168 Patched in 2.169
- Patched Critical · 9.8 Security & Malware scan by CleanTalk <= 2.149 - Unauthenticated Arbitrary File Upload ↗2025-02-11 CVE-2024-13365 Unrestricted Upload of File with Dangerous Type Affects <= 2.149 Patched in 2.150
- Patched High · 7.5 Security & Malware scan by CleanTalk <= 2.145 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated SQL Injection ↗2024-11-25 CVE-2024-10570 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.145 Patched in 2.145.1
Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.
CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.
Languages
via translate.wordpress.orgTranslated into 11 languages, 2 at 90% or more
AI assistants
How it's measured →Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.
Share of voice
How often each assistant names Security Plugin, Firewall & Malware Scanner with A when asked about this topic, where it comes in the answer, and how that compares with its wp.org search position. Latest run 1 Nov 2026.
- Assistants
- ChatGPT, Claude
- Topics tracked
- Security
Readme readiness
7 of 8 pass · checked 27 Oct 2026Can an assistant quote this readme? Eight deterministic checks over the wp.org listing, no model involved.
- ✓ Says what it does "Protect WordPress from malware, hackers, brute-force attacks & suspicious traffic. Includes firewall, login..."
- ✓ Has a FAQ 17 questions in the FAQ.
- ✓ FAQ asks real questions 16 of 17 read like questions a user would type.
- ! Names who it is for One audience phrase ("if you want"); say who the plugin is for and what they use it for.
- ✓ Names what it works with Mentions Ninja Forms, REST API.
- ✓ Headings and lists 13 headings and 12 lists.
- ✓ Enough to quote 14,797 characters of description.
- ✓ Tags match the text All 5 tags appear in the text.
Growth timeline
Install-tier crossings we have observed, and how long each tier took to outgrow
- 2026-07-29 30K+ → 40K+ up after 788 days in tier
- 2024-06-01 20K+ → 30K+ up after 494 days in tier
- 2023-01-24 10K+ → 20K+ up after 433 days in tier
- 2021-11-17 8K+ → 10K+ up after 186 days in tier
- 2021-05-15 7K+ → 8K+ up after 73 days in tier
- 2021-03-03 6K+ → 7K+ up after 124 days in tier
- 2020-10-30 5K+ → 6K+ up after 148 days in tier
- 2020-06-04 4K+ → 5K+ up after 217 days in tier
Competes with
The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).
-
Wordfence Security – Firewall, Malware Scan, and Login Security 5M+ installs · 4.7★ · 4 shared tags A -
Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention 1M+ installs · 4.8★ · 3 shared tags A -
Security Optimizer – The All-In-One Protection Plugin 1M+ installs · 4.5★ · 3 shared tags A -
Sucuri Security – Auditing, Malware Scanner and Security Hardening 600K+ installs · 4.2★ · 3 shared tags A -
NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall 100K+ installs · 4.8★ · 3 shared tags A -
Hide My WP Ghost – Security & Firewall 100K+ installs · 4.5★ · 3 shared tags A
Embed this report card
Drop a live Pulse card for Security Plugin, Firewall & Malware Scanner with Auto Removal into a readme, a review or a deck. It updates itself.
<iframe src="https://plugins.wpmayor.com/embed/security-malware-firewall" width="480" height="300" style="border:0" loading="lazy" title="Security Plugin, Firewall & Malware Scanner with Auto Removal — Plugin Pulse"></iframe> Security Plugin, Firewall & Malware Scanner with Auto Removal: 40K+ active installs, 4.8★ (397 reviews). Plugin Pulse (WP Mayor), as of 2026-11-02. https://plugins.wpmayor.com/plugin/security-malware-firewall
Spotted a number that looks wrong? Report a data issue and we'll check it against the source.