Security Plugin, Firewall & Malware Scanner with Auto Removal

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

At the current install trend, crossing 50K+ in roughly 229 days.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

1. ★★★★★ alchemistthreadworks

   1mo ago

   My website was attacked by malware. The Cleantalk team got it all cleaned up quickly, and they are still monitoring for any ongoing attacks. I highly recommend their service.

   Read on wp.org ↗
2. ★★★★★ suehallnet

   2mo ago

   The team helped me sort out a few problems with my site. Very grateful

   Read on wp.org ↗
3. ★★★★★ l9ssowkn5tqnkn

   2mo ago

   I’ve been client for many years. As a non-techy it took a while to find things out, but their support is great so it all worked out fine.

   Read on wp.org ↗
4. ★★★★★ cmikel

   3mo ago

   The CleanTalk plugin alerted me to malware on my site and within a day CleanTalk’s technical support removed it from site. No downtime. Quick and efficient.

   Read on wp.org ↗
5. ★★★★★ nonasnonas

   3mo ago

   A great plugin, realiable and updated. Excellent and quick assistance. Awesome!

   Read on wp.org ↗
6. ★★★★★ leverage1107

   4mo ago

   I have been using Security by CleanTalk (SPBCT) on a WordPress site for some time now and decided to leave a review because the plugin deserves more attention than it usually gets in WordPress security comparisons. What sold me initially was the scope. In one plugin you get a Web Application Firewall covering XSS and SQL injection, brute-force protection with configurable thresholds, a malware scanner that runs against both PHP files and database tables, automatic file cure/quarantine, two-factor authentication tied to user roles, the option to change the wp-login URL, IP and country blocking, traffic control with logging, a security audit log, and a leaked password check against known breach data. Most competing plugins push half of that into a paid tier. The architecture is worth mentioning. SPBCT itself is free and works together with the cloud service at cleantalk.org. There is no PRO upsell built into the admin UI, no nag screens, no banners trying to push me toward an upgrade. I find the pricing model honest. A flat fee per site, with the cloud dashboard giving you 45 days of visitor activity history and a clear view of what was blocked and why. In daily operation the plugin stays out of the way. I have not noticed any measurable performance impact, which matters because some security plugins quietly add hundreds of milliseconds to TTFB. Configuration takes a few minutes, defaults are reasonable, and the settings page is organised in a way that does not require hunting through nested tabs to find what you need. The release cadence is roughly every two weeks, which keeps the WAF rules and known-vulnerability database current without forcing me to update something every other day. The two-factor authentication implementation is simple. Email-based codes, configurable per role, with a 30-day browser remember option that only kicks in for new devices. Not the most sophisticated 2FA on the market, but it works and it is enough for most WordPress sites. I want to spend a sentence on the support team because that was the deciding factor for me. I have submitted a few tickets ranging from configuration questions to one slightly tricky compatibility issue, and the responses were quick, technically competent, and never copy-pasted. They actually read what I wrote, asked sensible follow-up questions, and resolved the issue. That kind of support is rare. If you are looking for a security plugin that handles malware scanning, firewall, login protection, and 2FA in one package without a permanent paywall in your admin panel, this one is worth installing. Recommended.

   Read on wp.org ↗
7. ★★★★★ Historic City News

   5mo ago

   I like software that just works.

   Read on wp.org ↗
8. ★★★★★ Anonymous

   6mo ago

   Hi, I’m writing to get some feedback. I have the Cleantalk antispam and security installed and my website got hacked via the password recovery hack. It seems there is no way to protect the wordpress login form with Cleantalk, no possibility to put a recaptcha on the login form. That’s why my bad low score for this plugin. After my website got hacked I went into the Cleantalk security panel to check if there was any anomalies and the plugin is not reporting any issues. This topic was modified 4 months, 1 week ago by enricooo.

   Read on wp.org ↗

6 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. High · 7.5 Security Plugin, Firewall & Malware Scanner with Auto Removal <= 2.184 - Unauthenticated SQL Injection ↗
   2026-08-19 CVE-2026-66593 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.184 Patched in 2.185
2. High · 7.2 Login Security, FireWall, Malware removal by CleanTalk <= 2.168 - Unauthenticated Stored Cross-Site Scripting via Page URL ↗
   2025-12-08 CVE-2025-13604 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.168 Patched in 2.169
3. Critical · 9.8 Security & Malware scan by CleanTalk <= 2.149 - Unauthenticated Arbitrary File Upload ↗
   2025-02-11 CVE-2024-13365 Unrestricted Upload of File with Dangerous Type Affects <= 2.149 Patched in 2.150
4. High · 7.5 Security & Malware scan by CleanTalk <= 2.145 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated SQL Injection ↗
   2024-11-25 CVE-2024-10570 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.145 Patched in 2.145.1
5. Medium · 5.3 Security & Malware scan by CleanTalk <= 2.120 - IP Spoofing to Protection Mechanism Bypass ↗
   2023-11-06 CVE-2023-5239 Use of Less Trusted Source Affects <= 2.120 Patched in 2.121
6. High · 8.8 Security & Malware scan by CleanTalk <= 2.50 - Missing Authorization ↗
   2020-07-06 CVE-2020-36698 Missing Authorization Affects <= 2.50 Patched in 2.51

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 11 languages, 1 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-07-29 30K+ → 40K+ up after 788 days in tier
2. 2024-06-01 20K+ → 30K+ up after 494 days in tier
3. 2023-01-24 10K+ → 20K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Wordfence Security – Firewall, Malware Scan, and Login Security 5M+ installs · 4.7★ · 4 shared tags A
• Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention 1M+ installs · 4.8★ · 3 shared tags A
• Security Optimizer – The All-In-One Protection Plugin 1M+ installs · 4.5★ · 3 shared tags A
• Sucuri Security – Auditing, Malware Scanner and Security Hardening 600K+ installs · 4.2★ · 3 shared tags A
• NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall 100K+ installs · 4.8★ · 3 shared tags A
• WP Ghost (Hide My WP Ghost) – Security & Firewall 100K+ installs · 4.5★ · 3 shared tags A

Embed this report card

Drop a live Pulse card for Security Plugin, Firewall & Malware Scanner with Auto Removal into a readme, a review or a deck. It updates itself.

Security Plugin, Firewall & Malware Scanner with Auto Removal: 40K+ active installs, 4.8★ (389 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/security-malware-firewall