Why we built it
Why a maintenance team
built a security plugin.
We clean hacked WordPress sites and look after them afterwards. A security plugin's settings screen tells you what you switched on. It doesn't tell you whether your server actually blocks the attack, and that gap is where sites get broken into. Read how we built it →
Attack Simulation
Fifteen real attacks,
tested on your own site.
One button runs fifteen real attacks against SecureLite's own protections inside WordPress, so it's safe on a live site and leaves nothing behind, and confirms that a real request to your site actually reaches those protections. It reports, for each protection, whether it would block the attack, is switched off, or failed. Where a setting would fix it, an Enable & re-test button sits right next to the result.
| What it tests | How |
|---|---|
| Firewall | SQL injection, cross-site scripting, directory traversal and known scanner signatures. |
| Login | User enumeration, brute-force lockout, XML-RPC abuse and password bots that don't run a real browser. |
| Comments | Comment spam sent by bots. |
| Uploads | Malicious and executable uploads, including PHP disguised as an image, and whether your server runs PHP in the uploads folder. |
| Malware scanner | A malware sample held in memory, to prove the scanner flags it. |
| Exposed files | Whether anyone can download your .git folder or readme.html. |
Why it matters to anyone who looks after sites: the result is a printable report. An agency can hand it to a client as evidence of what is protected, instead of a list of plugin names. Every report also says what it doesn't test: your host's or CDN's own firewall.
What it protects
What SecureLite does
on your site.
Watch it set up
Install to first scan,
in one video.
The whole setup, recorded on a real WordPress site: install SecureLite from WordPress.org, activate it and run the first scan. No account to create and no API key to paste.
Install
In your WordPress dashboard go to Plugins, Add New, search for SecureLite Security and install it, or download it from WordPress.org.
Activate
Activate the plugin. The firewall, login protection and comment spam protection block from the moment it's active, with nothing to set up first.
Run the first scan
Run a scan to check core files against WordPress.org's official checksums and look for injected scripts in the database.
How it's built
Rules SecureLite
doesn't break.
These are the same rules we work to when we look after a client's site. They're stated in the plugin's own documentation, so you can hold us to them.
Honest limits
What a security plugin
can't do.
Any plugin that runs inside WordPress shares the same limits. SecureLite says so instead of implying otherwise.
Beyond the plugin
When a plugin
isn't enough.
Free support for SecureLite is on its WordPress.org forum. Some problems need a person working on the site, and that's what PixelGravitas does.
At a glance
SecureLite Security,
the facts.
| Price | Free. Every feature, no account. |
|---|---|
| Requires | WordPress 6.2 or later, PHP 7.4 or later. |
| Licence | GPLv2 or later. |
| Works with | WooCommerce, Elementor and page builders (administrators bypass request filtering), Cloudflare and other proxies. |
| Planned next | An emailed unlock link on the lockout screen, optional alerts for plugins with known vulnerabilities, and a dashboard for agencies looking after many sites. No dates promised. |
| Download | wordpress.org/plugins/securelite-security |
Naveen Kumar
Founder & lead engineer, PixelGravitas · Designs and builds SecureLite
I build SecureLite and I clean hacked WordPress sites, so what I find in a cleanup goes into the plugin. The core-checksum scan was added after the backdoor cleanup in our case studies, and it's free for everyone who installs it. More about how I work →
Questions, answered
SecureLite:
common questions.
Is SecureLite free?
Yes. Every feature in SecureLite is free, there is no account or API key, and nothing that is in the plugin today will ever move behind a paywall. Download it from WordPress.org like any other plugin.
Who makes SecureLite?
PixelGravitas, the WordPress maintenance and security team behind this site. It is designed and built by Naveen Kumar, our founder and lead engineer. Questions on the WordPress.org support forum are answered by the people who build it.
Does SecureLite send my site's data anywhere?
No. There is no telemetry, no account and no third-party service, and your security events stay in your own database. The only outbound request is to WordPress.org itself: the malware scan downloads the official checksums for your WordPress version and for wordpress.org plugins it needs to verify. That request names the version and locale, or the plugin folder and version, never your site address.
Will SecureLite slow my site down?
The firewall checks each request before WordPress renders anything and adds well under a millisecond in normal use. Malware scans are scheduled and budgeted and never run during a page load, and logged-in administrators are never filtered or rate limited.
What if I lock myself out?
Lockouts end on their own (15 minutes by default). You can also add your own IP address to wp-config.php with one line, or rename the plugin's folder over FTP to switch it off. A locked username still opens for the correct password, so knowing your login name isn't enough for someone to keep you out of your own site.
Does SecureLite stop spam comments?
Yes, from bots, without sending your comments anywhere. A bot that posts without loading your comment form, or fills in a box people never see, is refused, and one person can post only a few comments an hour (and one address 20, whoever posts them). It does not judge what a person writes by hand; for that, keep comment moderation on. Comments from logged-in users are never checked.
Does SecureLite work behind Cloudflare?
Yes. SecureLite recognises Cloudflare automatically, so lockouts and limits see each visitor's real address instead of Cloudflare's. For other proxies, switch on Behind a proxy/CDN in the settings and add them to the trusted-proxy list. Forwarded IP headers are only trusted when the connection really comes from a trusted proxy, so they can't be forged to dodge a lockout.
Can I run SecureLite alongside another security plugin?
It is built to coexist: it never overrides a wp-config.php setting that another plugin manages, and its system report lists every plugin that handles your login, in the order they run. Two plugins both enforcing login lockouts or firewall rules make it hard to tell which one answered, though, so pick one to own each job.
Does SecureLite clean a site that's already hacked?
It finds and reports what doesn't belong, including changed WordPress core files and injected scripts in the database, and its recovery tools log everyone out, regenerate salts and reset passwords. Removing the malware and closing the way the attacker got in is hands-on work. If that's where you are, our WordPress malware removal service does it for a fixed fee agreed before work starts.
Built from a real incident
285,000 spam comments,
and the fix we built.
A site we look after received 285,000 spam comments, about one a minute, most of them published automatically. SecureLite was installed and counted none of them, because nothing in it watched comments yet. So we built comment protection that stops bots without bothering people.
Honest limit: it stops bots, not what a person types by hand. For that, keep comment moderation on. A bot that drives a full browser can pass the browser check, but the hidden box, the per-person limits and the lockouts still apply to it.