Join Agency Program today.

2x Leads & 50% Cost Savings on Hosting. Join Agency Program today.

Apply Now
Log In
Get Started
WordPress Plugins
All-In-One Security (AIOS) – Security and Firewall

All-In-One Security (AIOS) – Security and Firewall

Protect your website investment with All-In-One Security (AIOS) – a comprehensive and easy to use security plugin designed especially for WordPress.
Rating:
4.7
star-rating-1star-rating-2star-rating-3star-rating-4star-rating-5
Active Installations:
1000000+
Last Updated:
May 22, 2025
WordPress Version:
5.0 or higher
Tested up to:
6.8.1
Try Demo
Download

Ultimate Website Protection

Secure your website

Advanced Firewall Security

Block malicious requests

Comprehensive Content Protection

Prevent content theft

Premium Support Assistance

Get personalized help

Author’s Site Author Site view

5.4.1 – 21/May/2025

  • FIX: Call to undefined function AIOWPSFirewallsanitize_text_field() fatal error solved.
  • FIX: Resolved an issue where some information in the debugging report email was inconsistent with the information shown at Dashboard > Debugging
  • FIX: Fixed a “call to undefined function wp_strip_tags” error in wp-security-user-login.php
  • FIX: Resolved an issue where raw HTML was displaying in the info box under User Security > User Accounts > User Display Name
  • FIX: Renamed the login page when it was exposed via auth_redirect by other plugins (e.g., Gravity Forms preview)
  • FIX: Fixed an issue where the password reset functionality did not work with the renamed login page feature
  • FIX: Resolved missing translations on the login page after enabling the “Rename login page” feature
  • FIX: Updated the custom login page layout to match the new default WordPress login page design
  • FIX: Fixed the redirection issue occurring after plugin reactivation when the cookie brute force options are saved in the database
  • FIX: Fixed the undefined variable $error in wp-security-user-security-commands.php
  • FIX: Fixed the login lockout request issue
  • FIX: Bulk “Delete selected” action in the Audit Log list was not working
  • FIX: Corrected AIOWSPEC prefixes to AIOWPSEC
  • FIX: The 5G Firewall switch is behaving inversely, enabling it removes .htaccess rules, while disabling adds them.
  • FIX: Fixed the HTML code shown incorrectly on the .htaccess tab
  • TWEAK: Updated links to point to our new website

5.4.0 – 27/Mar/2025

  • FIX: Replaced firewall URI parsers with non-WordPress methods
  • FIX: Resolved PHP 5.6 compatibility issue caused by the ?? operator in 5.3.10

5.3.10 – 26/Mar/2025

  • FEATURE: Added commenting capability to IP whitelists
  • FEATURE: Added diagnostics reporting
  • FEATURE: Added a whitelist and user role-based access limit to the REST API firewall
  • FIX: “Undefined index: path” error when front-end HTTP Authentication is enabled.
  • FIX: Resolved dashboard translation issue where text lacked whitespace and was not properly translated
  • TWEAK: Remove uses of unserialize without restriction of allowed_classes
  • TWEAK: Refactored IP commands class to use response helper
  • TWEAK: Removed WP REST API tab
  • TWEAK: Switched “Critical Feature Status” toggle buttons on the dashboard to a status light system
  • TWEAK: Updated the security strength meter on the dashboard
  • TWEAK: Improved the dashboard widget to display a chart showing the number of logins over the last 7 days
  • TWEAK: Enhanced the maintenance mode switch on the dashboard for consistency with the rest of the plugin
  • TWEAK: Converted Brute Force menu actions to use AJAX
  • TWEAK: Updated seasonal notices

5.3.8 – 16/Dec/2024

  • FIX: Updated the plugin notices to fix translation related fatal errors.

5.3.7 – 5/Dec/2024

  • TWEAK: Change response code for blocked unauthorized REST requests to 403.
  • TWEAK: Temporarily removed firewall logging

5.3.6 – 3/Dec/2024

  • FIX: Resolved an issue with the AIOS_Firewall_Resource class

5.3.5 – 24/Nov/2024

  • FIX: Custom .htaccess rules are now properly escaped, with backslashes removed.
  • FIX: Import settings failed when visitor lockout messages had text alignment or other formatting applied
  • FIX: The audit log filter for event type now works correctly, even when the event type is translated into languages other than English
  • FIX: Resolved text overflow in the blue box on the Settings > WP Version Info page
  • FIX: Some user meta keys were not being removed after uninstalling the plugin
  • FIX: Subsites no longer incorrectly detect the Database Prefix feature as active
  • FIX: Prevented fatal errors from missing firewall resources, replacing them with debug log entries
  • FIX: WordPress database error: BLOB, TEXT, GEOMETRY, or JSON columns cannot have a default value set
  • FIX: The load_plugin_textdomain function is called during the init action, and translations are applied afterward
  • FIX: Renamed login page is now using the WordPress translations
  • TWEAK: Added a filter for PHP firewall rules templates
  • TWEAK: Updated the country code field for audit logs to be based on the IP address (Premium)
  • TWEAK: Improved the text in the 404 detection tab
  • TWEAK: Moved the allowlist into the blacklist tab, and renamed it to “Block & Allow Lists”
  • TWEAK: Moved the WP REST API feature to the PHP rules tab
  • TWEAK: Refactored multiple command classes to use the new AJAX response helper method: Tools, File scan, Files, Settings, and Log commands classes
  • TWEAK: Updated the UI for the .htaccess rules, Captcha settings and file protection tabs
  • TWEAK: Added a note in Settings > Delete plugin settings tab
  • TWEAK: Early calls to get_plugin_data() no longer require translations
  • TWEAK: Refactored the firewall command class to use the response helper method
  • TWEAK: Added a constant AIOS_DISABLE_HTTP_AUTHENTICATION. Define this in your wp-config.php to disable HTTP authentication

5.3.4 – 21/Oct/2024

  • FEATURE: Added a HTTP authentication feature that allows protecting the site with a username/password login.
  • FIX: Added a new method to reset the firewall rules under general settings
  • FIX: Resolved the issue with post cache which caused an issue with comment spam prevention
  • TWEAK: Added a helper class for API requests
  • TWEAK: Removed whitespaces at end of sentences

5.3.3 – 16/Sep/2024

  • FEATURE: Added captcha option for WooCommerce classic guest checkout page.
  • FIX: Fixed responsive layout issues with dashboard notice logo on mobile devices.
  • FIX: Turnstile captcha widget showing multiple times
  • FIX: Solved memory issue for reading larger host system log file
  • FIX: Removed .htaccess options from the Settings menu on Nginx, IIS and unsupported web servers
  • FIX: Resolved UX popup issue and firewall allowlist sanitization
  • FIX: Resolved an issue where bulk table actions were still executed even if the confirmation dialog was canceled.
  • FIX: Added a null check to prevent PHP warnings in firewall rules
  • TWEAK: Ajaxified the actions in the settings, filesystem security, spam prevention and user security menu
  • TWEAK: Added Ajax support to list tables and the audit log
  • TWEAK: Added CAPTCHA field to MemberPress forgot password and registration forms
  • TWEAK: Excluded .htaccess tabs from settings if the server is not supported
  • TWEAK: Updated the firewall rules UI and malware scanner description
  • TWEAK: Tweaked the htaccess backup method to generate the random filename
  • TWEAK: Removed ‘prevent access to default WP files’ from .htaccess and added ‘license.txt’ to deletion list.

5.3.2 – 06/Aug/2024

  • FIX: Bug that allowed subsite admins to delete audit logs of other subsites
  • FIX: Disabled blacklisting on subsites because the PHP-based firewall currently applies to the entire multisite
  • FIX: An issue with getting the google bot ip ranges
  • TWEAK: Added extra protections in place before modifying the .htaccess file
  • TWEAK: Actions in the tools, firewall and scanner menu are now processed via AJAX
  • TWEAK: Trimmed leading and trailing whitespace from inputs in the WHOIS lookup tab
  • TWEAK: Added a confirmation pop-up when users clear records in the Debug Logs table
  • TWEAK: Added captcha support for the MemberPress plugin
  • TWEAK: Improved the UX of the WP REST API options
  • TWEAK: Internal code improvements to improve maintainability
  • TWEAK: Updated the feature manager to improve performance
  • TWEAK: Fixed the issue of blank tables on mobile view

5.3.1 – 26/Jun/2024

  • FEATURE: Added CAPTCHA to password protected pages/posts
  • FIX: Captcha not showing on the BuddyPress registration page
  • FIX: WooCommerce logout issue when the renamed login page and login whitelist features are both enabled
  • FIX: Missing CAPTCHAs when multiple WooCommerce login and register forms are on the same page
  • FIX: Fixed an issue with the 404 detection actions
  • FIX: A UI issue with the 2FA QR code image
  • TWEAK: Added the attribute data-cfasync=”false” to the default captcha url to allow loading on Cloudflare Rocket Loader
  • TWEAK: Purge login lockdown table records after 90 days to restrict size. The AIOS_PURGE_LOGIN_LOCKOUT_RECORDS_AFTER_DAYS constant has been added to change the default.
  • TWEAK: Updated the malware scanner frequency text from daily to weekly
  • TWEAK: Updated the password strength meter UI for the password tool
  • TWEAK: Add a ‘Lock IP’ and ‘Blacklist IP’ link to the IP column of the audit log.
  • TWEAK: Enhance fake Googlebot detection. In the case where gethostbyaddr fails, the firewall will fallback to checking against known Googlebot IP ranges
  • TWEAK: Updated the column header for the “Permanent Blocked IP Addresses” table to be consistent with other tables
  • TWEAK: Prevent warning when DISALLOW_FILE_EDIT has already been defined
  • TWEAK: Fix instances of one translation function being used for multiple sentences
  • TWEAK: Improved the UX during AJAX calls
  • TWEAK: Removed Trash spam comments duplicated description

5.3.0 – 01/May/2024

  • FEATURE: Added bulk force logout features for logged in users
  • FIX: An issue with the WooCommerce my account page logout function when the cookie based brute force feature is turned on
  • FIX: Warning undefined array key SCRIPT_FILENAME
  • FIX: Custom redirection after login not working if url contains the redirect_to parameter
  • FIX: List of administrator accounts not showing on the user security page
  • FIX: Issue with cookie based bruteforce prevention solved if salt postfix feature is on.
  • FIX: Fixed country field not showing in the 404 event logs (Premium)
  • FIX: Fixed country field not showing in the smart 404 blocked IP log (Premium)
  • TWEAK: Fixed translation issue not showing as per admin user set language instead of site settings
  • TWEAK: Firewall upgrade changes are applied without access to the admin interface
  • TWEAK: Change the labels for the switches to a more appropriate wording
  • TWEAK: In the file scanner results show the file sizes in a human readable format
  • TWEAK: Updated the default message for attempts to access wp-admin
  • TWEAK: Internal refactor of the update code to improve code clarity.
  • TWEAK: Port the ‘Block fake Googlebots’ feature to the PHP-based firewall
  • TWEAK: Remove requirement for at least one IP for ‘Blacklist’, ‘Login whitelist’ and ‘Login lockout IP whitelist’ to be enabled.
  • TWEAK: Added error message when a user tries to block their own IP on registration approval
  • TWEAK: Added method to update badge on AJAX call
  • TWEAK: internal refactor of the AIOWPSecurity_Utility_File class to improve code clarity
  • TWEAK: Seasonal notice content update for 2024

5.2.9 – 06/Mar/2024

  • FIX: Remove call to update_event_table_column_to_timestamp in update routine
  • FIX: Remove call to wp_timezone() which is only available in WP 5.3+

5.2.8 – 05/Mar/2024

  • FIX: The user check that affects the Duo authentication plugin
  • FIX: Database update routine is now run without needing to visit the admin interface or each individual site in a multisite
  • FIX: Some settings in the firewall menu not resetting after deactivating and reactivating the plugin.
  • TWEAK: Audit log and 404 events CSV export file date time column is now in a human readable format not unix timestamp
  • TWEAK: Debug log table existing datetime field converted to timestamp to be timezone independent
  • TWEAK: Global meta table existing datetime field converted to timestamp to be timezone independent
  • TWEAK: Permanent block table existing datetime field converted to timestamp to be timezone independent
  • TWEAK: Refactor list item actions to further improve code clarity
  • TWEAK: Removed blacklist admin menu as previously announced
  • TWEAK: Removed miscellaneous admin menu as previously announced
  • TWEAK: Removed various admin menu tabs as previously announced
  • TWEAK: Store IP lookup result for other types of entries in the login lockdown table
  • TWEAK: Update the footer review prompt
  • TWEAK: Max file upload size limit to 250 MB by aiowps_max_allowed_upload_config filter removed
  • TWEAK: Improve comment spam detection to not interfere with other forms

5.2.7 – 06/Feb/2024

  • SECURITY: Added nonce checks to various list table actions to prevent a CSRF vulnerability. Thanks to dhakal_ananda for disclosing this defect. This would allow an attacker who persuaded a logged-in administrator to visit a specially crafted link to perform actions on the 404 event records.

5.2.6 – 06/Feb/2024

  • SECURITY: Removed unnecessary use of the “tab” query parameter on various admin menu pages to prevent a non-persistent XSS vulnerability. Thanks to Matthew Rollings for disclosing this defect. (This would allow an attacker who deliberately targets you whilst logged in as an administrator and persuades you to visit a link he controls to inject unwanted scripts on a single visit to your AIOS admin page).
  • FEATURE: Added logout event to the audit logs
  • FEATURE: Add ability to delete the default readme.html file and wp-config-sample.php file
  • FIX: Correct some translation calls that were using the wrong text domain
  • FIX: PHP notice caused by the file scanner being unable to read its data file
  • FIX: Unlock request button was not showing and redirects to 127.0.0.1
  • FIX: Database errors for the aiowps_login_lockdown table during plugin installation
  • TWEAK: Refactor the 6G UI
  • TWEAK: Added an option to set the Cloudflare Turnstile CAPTCHA theme
  • TWEAK: Added CSS styling for audit log details column
  • TWEAK: Dashboard critical feature status links fixed and only show features that can be enabled in a multisite subsite
  • TWEAK: Deactivating the plugin now removes stored login info so on the next activation users are not force logged out
  • TWEAK: Display json string instead of null if json_decode does not work for audit log details
  • TWEAK: Event table existing datetime field converted to timestamp to be timezone independent
  • TWEAK: Various tweaks to get codebase up to coding standards
  • TWEAK: Various tweaks to ensure multiple sentences are not passed to a single translation function
  • TWEAK: Fix the broken UI for RSS and Atom firewall settings and added a more info box
  • TWEAK: Fix the issue of unique ID in DOM
  • TWEAK: Merge Username and Display Name tabs in User Security Settings
  • TWEAK: Moved the ‘404 detection’ tab to the ‘Brute force’ admin menu
  • TWEAK: Moved the ‘PHP file editing’ tab into ‘File Protection’ tab
  • TWEAK: Moved the ‘User enumeration’ tab into the ‘User accounts’ tab in the User Security Menu
  • TWEAK: Moved the ‘WP Rest API’ tab into the Firewall Menu
  • TWEAK: Moved the ‘Copy protection’ and ‘Frames’ tab into the Filesystem security menu
  • TWEAK: Moved the ‘Salt’ tab into the User security menu
  • TWEAK: Moved ‘Blacklist Manager’ tab into the Firewall menu.
  • TWEAK: Password resets, removed and deleted users are now recorded in the audit log
  • TWEAK: Stop 404 IP from being locked if there’s a current lock on that IP
  • TWEAK: Unify date and time conversion with users timezone support
  • TWEAK: Changed how empty data in ip lookup result is stored in the database
  • TWEAK: Rework Firewall Menu page to have two tabs for PHP and .htaccess rules
  • TWEAK: Add captcha support for Contact Form 7
  • TWEAK: Added a AJAX save settings and get features details badge function as part of ongoing work to add AJAX support to the plugin settings
  • TWEAK: Enhance reset password email by adding IP info
  • TWEAK: Remove defunct imagetoolbar meta tag
  • TWEAK: Login lockout tables existing datetime field converted to timestamp to be timezone independent
  • TWEAK: Code improvements – utilising WP_Error objects instead of arrays

5.2.5 – 25/Oct/2023

  • SECURITY: On a multisite install, if using the AIOS feature for renaming and hiding the login page, a route existed for an attacker to discover the hidden login page, thus negating the usefulness of the feature. Thanks to Naveen Muthusamy for disclosing this defect.
  • FEATURE: Block POST requests that have a blank user-agent and referer
  • FEATURE: Added reverse IP Lookup data to the login lockdown notification email
  • FIX: Prevent a fatal error when setting up the firewall if the host has disabled the function parse_ini_file
  • FIX: Prevent the firewall message store from filling up with unused entries
  • FIX: Prevent legitimate Googlebot traffic being blocked on sites where the gethostbyaddr function fails or is disabled
  • FIX: An issue that prevented MainWP updates from being performed correctly
  • FIX: Prevent user enumeration via the REST API and oEmbed protocol
  • FIX: User agent blacklist not matching all strings correctly
  • FIX: Logged in user table not showing the correct information
  • TWEAK: Improve comment spam detection by using hidden fields and cookies
  • TWEAK: Login whitelist suggests both IPv4 and IPv6 addresses to whitelist
  • TWEAK: The menu actions in the dashboard admin menu are now processed via AJAX
  • TWEAK: Converted checkboxes in the admin menu pages to switches
  • TWEAK: Add network_id and site_id column to debug logs table for differentiating logs between sites on multisite
  • TWEAK: Combined various user admin menus into a new ‘User Security’ admin menu
  • TWEAK: Export configuration filename now reflects the local timezone.
  • TWEAK: Improve the UI/UX of the file scanner making way for future improvements
  • TWEAK: Redesign the feature manager badges
  • TWEAK: Removed various admin menu tabs as previously announced
  • TWEAK: Add features that depend on other plugins to the feature manager conditionally
  • TWEAK: Added a null check to function that removes wp meta info from scripts and styles src to prevent a PHP deprecation warning
  • TWEAK: Audit log date and time are now displayed in the sites timezone
  • TWEAK: PHP warning undefined array key REQUEST_METHOD in rule-proxy-comment-posting.php
  • TWEAK: When TranslatePress is active, logging out via WooCommerce should not show a 404 page if the “rename login page” setting is on.

5.2.4 – 16/Aug/2023

  • FIX: Ported firewall settings from disabling on upgrade

5.2.3 – 09/Aug/2023

  • FIX: Fatal error “set_value() on null” when the firewall config is missing
  • FIX: PHP notices when running under cron
  • FIX: Revert change that caused the Brute force login whitelist to show the server IPs and not the users
  • TWEAK: Add communication mechanism so that firewall can send data to WordPress
  • TWEAK: Remove incorrect mentions of the .htaccess file on PHP Firewall rules

5.2.2 – 04/Aug/2023

  • FEATURE: An allow list of IP addresses which bypass the firewall rules
  • FIX: Fix get_class() on null fatal error when updating via ManageWP
  • FIX: No such file or directory notice generated by the firewall’s config file
  • FIX: Only send the upgrade email if one or more of the ported rules had been enabled
  • FIX: Fake Google bots are now blocked if bot server IP address does not resolve to a hostname
  • FIX: Google reCaptcha now appears correctly on the WooCommerce checkout page
  • FIX: Prevent Woocommerce auto login if manual registration approval is turned on
  • FIX: Premium upgrade tab UI overlapping issue.
  • FIX: Allow maintenance mode to be controlled via WP-CLI (Premium)
  • FIX: Use the correct site id for login success events added to audit log table on Multisite
  • FIX: Added missing features to the feature manager list
  • FIX: A warning when using the update all command via WP-CLI
  • TWEAK: AIOS settings based IP address is now used instead of the REMOTE_ADDR server variable for multiple wrong 2FA code notification
  • TWEAK: Added ‘aios_audit_log_record_event’ filter to allow events to not be recorded
  • TWEAK: Improve the feature item manager code structure making way for future improvements
  • TWEAK: Login whitelist suggests both IPv4 and IPv6 addresses to whitelist.
  • TWEAK: Move the ‘Custom rules’ tab from the ‘Firewall’ section to its own tab in the ‘Tools’ section
  • TWEAK: Move the ‘Prevent hotlinking’ tab to the ‘File protection’ tab in the ‘Filesystem Security’ menu
  • TWEAK: Moved all CAPTCHA settings to the ‘CAPTCHA settings’ tab in the ‘Brute Force’ menu
  • TWEAK: Moved the ‘Password tool’ tab to the ‘Tools’ admin menu
  • TWEAK: Moved the ‘Visitor lockout’ tab to the ‘Tools’ admin menu
  • TWEAK: Moved the ‘User registration honeypot’ tab to the ‘Brute force’ admin menu
  • TWEAK: Remove ‘Account activity table’ as these entries are also recorded in the audit log
  • TWEAK: Removed the ‘Failed login records’ tab as previously announced, these are now recorded in the audit log
  • TWEAK: Improve list table code performance
  • TWEAK: Removed use of $_GET, $_POST, $_REQUEST from all template files making way for future improvements

5.2.1 – 12/Jul/2023

  • FIX: Include helper class file from loader
  • TWEAK: Conditionally load TFA block JavaScript

5.2.0 – 10/Jul/2023

  • SECURITY: Remove authentication data from the stacktrace before saving to the database. This defect meant that a site administrator had the potential, between releases 5.1.9 to 5.2.0 (which purges the existing data), to know what site users’ passwords are. This information has limited value (an admin can already reset anyone’s password) except insofar as the passwords may be re-used by users on other sites. In that “hostile admin” scenario, your site has other problems (since the hostile admin has a whole raft of equivalent ways of causing mischief to users, especially if not on multisite where a site admin is potentially not a super admin and may not be able to install or configure plugins). This changelog has been expanded in response to incorrect reports which suggested a wider problem (for example, they did not mention that the attacker needs to already be logged in as an admin to read the log, or that upgrading to 5.2.0 deletes the affected data).
  • SECURITY: Set tighter restrictions on what subsite admins can do in a multisite.
  • FIX: After editing a file reset permissions back to the original permissions
  • FIX: Corrected some broken links in the plugin
  • FIX: Fatal error: cannot declare class
  • FIX: Normalise all arguments in the stacktrace
  • FIX: Wrong login entries added to login activity table on multisite when user logs into subsite they don’t belong to.
  • FIX: Too many redirects error for forced logout users solved
  • TWEAK: For Cronjob, WP CLI and AIOS_DISABLE_EXTERNAL_IP_ADDR defined constant do not use external services for user IP addresses. Silenced api.ipify.org request failed warning.
  • TWEAK: Reset password page missing translation and generate password button added for renamed login page
  • TWEAK: Added ‘aios_audit_log_event_user_ip’ filter to allow filtering of IP addresses in the audit log
  • TWEAK: Added action hook “aios_reset_all_settings” for reset all settings.
  • TWEAK: Renamed login page to have language change dropdown and other tweaks as per the WordPress 6.2

5.1.9 – 09/May/2023

  • FEATURE: IP addresses – Blacklist manager functionality based on PHP instead of .htaccess rules. Added AIOS_DISABLE_BLACKLIST_IP_MANAGER constant, Define it in your wp-config.php to disable IP Blacklist manager.
  • FEATURE: Detect spambots posting comments and discard it completely or mark as spam.
  • FEATURE: Encrypt TFA secret keys that are stored in the database (extra protection in case of your database being hacked)
  • FEATURE: Added a “Delete all” and “Delete filtered” bulk action to the audit log table
  • FIX: Prevent Cloudflare Turnstile being added to login forms when no credentials where set
  • FIX: Change where the audit log event handler is loaded to prevent an error on plugin deletion
  • FIX: Fix context class checks to support cli
  • TWEAK: Multisite super admin can access the subsite dashboard without login again if salt postfix enabled
  • TWEAK: Captcha JavaScript file is unnecessarily loaded on some site pages if comment captcha or custom login captcha enabled
  • TWEAK: Change some nonce checks to use our internal function to check user capability and nonces
  • TWEAK: User registrations and successful logins are now recorded in the audit log
  • TWEAK: Added a commands class and refactored AJAX handlers
  • TWEAK: Captcha verification to prevent conflicts with some plugins that recall the WordPress authentication code
  • TWEAK: Improve database table prefix feature UI.
  • TWEAK: WordPress core updates are now recorded in the audit log
  • TWEAK: Translation updates are now recorded in the audit log
  • TWEAK: Add an entity changed event to the audit log when upgrader information is not available
  • TWEAK: Automated emails sent by AIOS that failed to send due to from address

5.1.8 – 11/April/2023

  • FIX: 404 detection – Individual record blacklisting, delete, temp block actions stopped working in 5.1.7
  • FIX: Uncaught fatal error on null ‘set_value’
  • FIX: Remove audit log event handler actions on plugin deletion to prevent an error
  • FIX: Remove some audit log event handler on plugin deletion to prevent an error
  • FIX: Get correct wp-config path when installed in a subdirectory
  • TWEAK: AIOS_Helper::request_remote timed out exception ignored.
  • TWEAK: Requests_IPv6 class name deprecated in WordPress 6.2.
  • TWEAK: Failed login attempts are now recorded in the audit log

5.1.7 – 24/March/2023

  • FIX: Prevent fatal error when calling get_server_detected_user_ip_address() when the firewall is not setup
  • TWEAK: Clarify dashboard notice title and change image.

5.1.6 – 21/March/2023

  • FEATURE: Added an audit log
  • FEATURE: Add salt postfix option to improve your site’s security
  • FEATURE: Shared library that can be used from the firewall.
  • FIX: Rename login slug used like wp-login-RANDOM_SUFFIX showing 404 page issue solved and code clean up for multisite activation.
  • FIX: Divi child theme conflict – Call to undefined function et_builder_get_fonts() in functions.php on line 208 solved.
  • FIX: Captcha settings tab in multisite installation for subsites not showing
  • FIX: Cron reschedule event error for hook aios_15_minutes_cron_event if plugin deactivated or uninstalled
  • TWEAK: Stop user enumeration now shows 403 forbidden error code instead of 500 server error
  • TWEAK: PHP 8.1 warning rawurldecode passing null instead type string is deprecated for block request string 6g rule
  • TWEAK: Code clean up for disable cookie based brute force constant as rule moved to firewall
  • TWEAK: Comment spam IP monitoring page UI
  • TWEAK: Updated seasonal notices
  • TWEAK: Improve internal code structure making way for future improvements
  • TWEAK: Remove mention of the 6g firewall rules being .htaccess based as they are now php based
  • TWEAK: Added new internal function to check user capability and nonces
  • TWEAK: Improve config code with inline saving.
  • TWEAK: Allow audit log to be filtered and exported to CSV

5.1.5 – 13/February/2023

  • FEATURE: Added Cloudflare Turnstile CAPTCHA support
  • FIX: Notices about undefined array key HTTP_USER_AGENT solved.
  • FIX: New v5 features not saved in export file and not properly reset after uninstallation.
  • FIX: File permission change being applied to the last record not selected one. Also, no longer change permissions when they are already tighter than the suggested.
  • FIX: Fatal error ‘Call to a member function contains_contents() on null’
  • TWEAK: Removed wrong information about login whitelist being implemented via htaccess.
  • TWEAK: Refactoring settings tasks for WP CLI AIOS premium commands.
  • TWEAK: Page load performance issue due to incompatible tfa premium plugin active check improved.
  • TWEAK: Make sure translation domain is registered before attempting to use it
  • TWEAK: Replaced click with press in text because users could be on mobile etc and not using a mouse.
  • TWEAK: Registration, comment, Buddypress and bbPress admin pages to show notice enable the captcha settings.
  • TWEAK: Improve the UI/UX for the 404 detection tab
  • TWEAK: Improve internal code structure making way for future improvements
  • TWEAK: PHP 8.2 deprecation warning for dynamic properties
  • TWEAK: Remove the unintended ability for directory traversal and lack of escaping when outputting files with the “view system log” feature. This facility is only available to an administrator (who can of course already do anything on the site, so this has no security implications) and allow them to view (the last 50 lines) from any file or list any directory on the system where the web server has read access.
  • FIX: Fatal error ‘Call to a member function contains_contents() on null’
  • TWEAK: Firewall gets constants from a single source.

5.1.4 – 14/December/2022

  • FEATURE: Add option to disable RSS and ATOM feeds.
  • FIX: The IP address blacklist manager wasn’t working.

5.1.3 – 09/December/2022

  • SECURITY: No longer save settings import files in a publicly accessible folder where they can be potentially indexed by search engines if the administrator does not actually import the settings (which deletes the import file)
  • FEATURE: Implement firewall events system
  • FIX: Protect subsites when firewall is loaded via plugins_hook
  • TWEAK: Improve the UX for uploading import files
  • TWEAK: Add a default CAPTCHA option making way for new CAPTCHAs in the future

5.1.2 – 07/December/2022

  • FEATURE: User Agent – Blacklist manager functionality should be based on PHP instead .htaccess rules.
  • FIX: Sorting by ‘status’ on the comment spam table
  • FIX: Copy protection feature not working on iPhone
  • FIX: Cookie based brute force prevention locks out if plugin deactivated and activated again.
  • FIX: The notice to reapply .htaccess rules after reactivating the plugin is displayed on subsites.
  • FIX: Various WordPress command line notices about undefined $_SERVER indexes
  • FIX: Deactivate and reactivate plugin firewall settings file sync issue solved.
  • TWEAK: 2FA setting page to show premium options for AIOS premium.
  • TWEAK: Remove characters that should not have been on the scanner page
  • TWEAK: Organise firewall rules into subdirectories
  • TWEAK: Added GDPR question answer to the AIOS WP org plugin’s FAQ section.
  • TWEAK: Allow AIOS management permission to be filtered via aios_management_permission filter
  • TWEAK: Make use of is_main_site() function.
  • TWEAK: Copy IP to clipboard when clicking on it at WP Security -> Brute Force -> Login whitelist.
  • TWEAK: Better context detection for the firewall

5.1.1 – 16/November/2022

  • SECURITY: Fixed a failure to check bulk action nonces, leading …

excellent support

By clueless4ever on June 21, 2025

excellent support and taking a lot of time to help me. In the End it was not a problem with the plugin as it seams. There was an interference with another one but this was solved.

Thank you so much !

Solid Security and Great Support

By worldmaker on June 2, 2025

If you want the reassurance of solid security for your web site, this is where you begin. With so many security options, switches for this and that and all the other elements of your site, this should be the first go-to product to add to your site's protection.

However, beware, you can be too enthusiastic in securing everything and, like me, find yourself locking yourself out. This is where the patience of Support comes in to help you back through any errors and mistakes you might have made when over-securing your site.

Take it calmly, carefully and note all the advice written throughout, and keep a log of everything you've set and this will remain a strong anchor for you site's security.

Works but sends Errors

By rodge on May 21, 2025

I keep getting this WP-Error emails from my customers sites where I use this great plugin. This is the error message:

E_ERROR at line 739 in: /var/www/vhosts/xxxxxxx.xx/httpdocs/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-user-login.php. Error: Uncaught Error: Call to undefined function wp_strip_tags() in /var/www/vhosts/xxxxxxx.xx/httpdocs/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-user-login.php:739
Stack trace:
#0 /var/www/vhosts/xxxxxxx.xx/httpdocs/wp-includes/class-wp-hook.php(324): AIOWPSecurity_User_Login->aiowps_login_message()
#1 /var/www/vhosts/xxxxxxx.xx/httpdocs/wp-includes/plugin.php(205): WP_Hook->apply_filters()
#2 /var/www/vhosts/xxxxxxx.xx/httpdocs/wp-login.php(231): apply_filters()
#3 /var/www/vhosts/xxxxxxx.xx/httpdocs/wp-login.php(1490): login_header()
#4 {main}
thrown

I hope this gets fixed in the next version...

Thanks!

// Rodge

It works fine and much assist me

By alexey6660 on May 18, 2025

It works fine and much assist me with security of the site

Complemento excelente para la seguridad de tu sitio web

By albertoarias on May 12, 2025

Utilizo siempre este complemento para dar seguridad al sitio web.

Dispone de opciones muy completas.

Excellent

By visionez11 on May 10, 2025

2 years running on the free version and all good so far. Thanks

Unable to login

By rodrignite on May 9, 2025

I was suddenly unable to log in to any of my websites due to this plugin.

Cannot login suddenly

By Shaun (abeshunya) on May 9, 2025

Loved this plugin for years but suddenly i cannot see login page that throws 403. so can't login.


I don't know what part of this plugin is cause

but it gets fixed when deleting plugin folder using FTP.

Look elsewhere for security

By mw2015 (mikewitt2015) on April 25, 2025

I've used this plugin for years on over 2 dozen websites. Lately it started to randomly lock out the login page for me and my clients. I've spent hours hacking back in, re configuring settings and wake up to the same bs. I'm removing the plugin from all my sites and installing an alternative. No need for support team reply as I'm not giving a second chance with this plugin.

This time WordPress found an error with one of the plu- All-In-One Security (AIO

By baf285 on April 15, 2025

Error details
===================================
An error with the E_ERROR type occurred on line 739 of the file /var/www/222/data/www/site.ru/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-user-login.php. Error message:Uncaught Error: Call to undefined function wp_strip_tags() in /var/www/u2866620/data/www/bafista.ru/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-user-login.php:739
Stack trace:
#0 /var/www/222/data/www/site.ru/wp-includes/class-wp-hook.php(324): AIOWPSecurity_User_Login->aiowps_login_message('')
#1 /var/www/222/data/www/site.ru/wp-includes/plugin.php(205): WP_Hook->apply_filters('', Array)
#2 /var/www/222/data/www/site.ru/wp-content/plugins/all-in-one-wp-security-and-firewall/other-includes/wp-security-rename-login-feature.php(219): apply_filters('login_message', '')
#3 /var/www/222/data/www/site.ru/wp-content/plugins/all-in-one-wp-security-and-firewall/other-includes/wp-security-rename-login-feature.php(1366): login_header('xD0x92xD0xBExD0xB9xD1x82xD0xB8', '', Object(WP_Error))
#4 /var/www/222/data/www/site.ru/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-process-renamed-login-page.php(217): require_o

More Reviews
Try other plugins too!
User Role Editor

User Role Editor

User Role Editor WordPress plugin makes user roles and capabilities changing easy. Edit/add/delete WordPress user roles and capabilities.

Try Demo More Details
HSTS Ready

HSTS Ready

Enable easily HSTS on your website.

Try Demo More Details
Captcha by BestWebSoft – Spam Protection, Security Plugin for WordPress Forms

Captcha by BestWebSoft – Spam Protection, Security Plugin for WordPress Forms

1 super security anti-spam captcha plugin for WordPress forms.

Try Demo More Details
Screenshots
Author Site Author Site

Try All-In-One Security (AIOS) – Security and Firewall With InstaWP

Try Demo

Contact Sales

Reach out to us to explore how InstaWP can benefit your business.