Title: Ultimate Security
Author: WP Ultimate Security
Published: মাৰ্চ 22, 2025
Last modified: আগষ্ট 18, 2026
---
প্লাগিনৰ সন্ধান কৰক
# Ultimate Security
[WP Ultimate Security](https://profiles.wordpress.org/wpultimatesecurity/)-ৰ দ্বাৰা
[ডাউনল’ড কৰক](https://downloads.wordpress.org/plugin/ultimate-security.1.0.23.zip)
[লাইভ পূৰ্বদৰ্শন](https://as.wordpress.org/plugins/ultimate-security/?preview=1)
* [বিশদ বিৱৰণ](https://as.wordpress.org/plugins/ultimate-security/#description)
* [পৰ্য্যালোচনা](https://as.wordpress.org/plugins/ultimate-security/#reviews)
* [ইনষ্টলেশ্যন](https://as.wordpress.org/plugins/ultimate-security/#installation)
* [বিকাশ](https://as.wordpress.org/plugins/ultimate-security/#developers)
[সাহায্য](https://wordpress.org/support/plugin/ultimate-security/)
## বৰ্ণনা
Automated bots probe WordPress logins and forms around the clock. Ultimate Security
shuts that down — with two-factor authentication, brute-force lockouts, anti-spam
CAPTCHA, a hidden login URL, session controls, vulnerability scanning and Cloudflare
edge rules — all from a clean dashboard you do not need to be a security expert
to run.
🎥 **Watch a 2-minute intro:**
🛡️ **Lightweight. Privacy-first. No bloat.**
#### Why Ultimate Security?
* **It just works.** Sensible defaults out of the box — turn it on, you are safer
in minutes.
* **Nothing is guessed.** A guided setup scans your site first, shows you every
change before it happens, and can undo all of it.
* **Built for real attacks.** Stops the automated login, brute-force and spam traffic
that actually hits WordPress sites.
* **Zero learning curve.** Plain-English settings, and a Test Mode to preview rules
before they go live.
* **Privacy-respecting.** No product-usage telemetry and no hidden phone-home tracking.
Pro features are clearly labelled.
#### 🚀 Guided setup in about 3 minutes
* **Five short steps** — tell us about the site, we run a quick automatic check,
you pick one protection template, then review and apply.
* **See every change before it happens.** The wizard shows a full diff of what
it will change.
* **Undo all setup changes** afterwards, without overwriting edits you made yourself.
* **Seven templates** to start from: basic, moderate, strict, agency, blog, membership
and WooCommerce.
* **An emergency access link** is shown during setup — save it, and you can deactivate
the plugin from a browser if you ever lock yourself out.
#### 🔐 Two-Factor Authentication
* **Email one-time codes** — no app required, works for every user.
* **Authenticator apps** — TOTP and HOTP, compatible with Google Authenticator,
Authy, Microsoft Authenticator and others, with QR-code enrolment.
* **Per-user setup with role-based configuration** — decide which roles use email
codes and which use an authenticator app.
* **Built-in rate limiting** on code entry, with a configurable attempt limit and
lockout.
* **2FA event logging** you can switch on or off.
* **Works with your login flow** — WordPress, WooCommerce and Ultimate Member login
forms, plus a setting for XML-RPC requests.
#### 🚪 Login access control
* **Custom login URL** — move `wp-login.php` to a secret address so bots cannot
find it, with a configurable post-login redirect.
* **HTTP Basic Authentication** — put a second password wall in front of `wp-login.
php` and `wp-admin`, with no `.htaccess` editing. The password is stored hashed,
repeated failures trigger a lockout, and you can allow trusted IP addresses straight
through.
* **Login page consent notice** — display your own consent or policy text on the
login form.
#### 🔑 Password policies
* Enforce minimum length, mixed case, numbers and special characters, or start
from a preset.
* **Password expiry** with advance warning, a grace period and email notification.
* **Password history** so old passwords cannot be recycled.
* **Force a password change on first login.**
* **Refuse compromised passwords** — checked against the Have I Been Pwned Pwned
Passwords range API using k-anonymity, so the password itself never leaves your
site.
* Optionally disable self-service password reset and point users at your own instructions
instead.
#### 🛑 Brute-force protection
* Limit failed login attempts and lock offenders out automatically.
* **Progressive lockouts** — repeat offenders get longer lockouts.
* Configurable retry-reset window, and a permanent block list for persistent offenders.
* **One-time recovery link** so a lockout never leaves you stranded.
#### 👥 Session management
* Limit **concurrent logins per user**, and choose whether to block the new login
or sign out the oldest session.
* **Idle timeout** for inactive sessions.
* Harden auth cookies with HttpOnly, Secure and SameSite flags.
* **Bind a session to its IP address and/or browser** to detect session hijacking.
#### 🤖 Bot & spam protection
* **Google reCAPTCHA v2 and v3** — including a v3 score threshold, IP and user-
agent allowlists, a bypass for logged-in users, and a log of recent verifications.
* **Cloudflare Turnstile** — with theme, size, language and appearance options,
deferred script loading, custom failure messages and its own log.
* **Form coverage for both providers**: WordPress login, registration, lost-password
and comment forms, plus WooCommerce login, registration, lost-password and checkout
forms.
* **No-conflict mode and provider priority** so two CAPTCHAs never render on the
same form.
* **Key verification** — validate your site and secret keys from the settings page
before going live.
* **Outage handling** — if the CAPTCHA provider is unreachable, your forms keep
working.
#### 🔎 Vulnerability scanning
* Scan **WordPress core, plugins and themes** for publicly known vulnerabilities.
* **No API key required.** The scanner uses the keyless WPVulnerability database
by default.
* Optionally add a **WPScan** or **Patchstack** API key for additional coverage,
with automatic failover between providers.
* **Scheduled scans** with email alerts, filtered by the severity you care about.
* **Abandoned plugin detection** — flags extensions that have not been updated
in a long time.
* **Scan history, comparison between runs, and an ignore list** for findings you
have accepted.
* Results surface where you already look: Site Health, the WordPress dashboard
widget, the plugins list table and menu counters.
#### ☁️ Cloudflare WAF rules
Connect your own Cloudflare account and manage edge rules from wp-admin:
* **Allow good bots** — keep verified search, monitoring, backup, SEO and social
crawlers working.
* **Block aggressive crawlers and sensitive WordPress paths.**
* **Block web hosts and TOR exit nodes.**
* **Challenge large cloud providers and selected countries.**
* **Challenge VPN traffic and requests to `wp-login.php`.**
* **Virtual patches** — block requests exploiting known WordPress core CVEs at
the edge until you can update.
* **Preview the generated rule expressions before you deploy anything**, review
the live rules on your zone, and see request, threat and bandwidth analytics.
#### 🧂 WordPress security keys (salts)
* Rotate the security keys and salts in `wp-config.php` **on demand or on a schedule**—
daily, weekly, monthly, quarterly or twice a year.
* **Advance notification** before a scheduled rotation, so a forced re-login is
never a surprise.
* **Quiet hours**, plus pause and skip-next controls.
* **Rotation history** with the ability to restore a previous set of keys.
#### 🔄 Update Manager
* Set auto-update policy for WordPress core, plugins and themes, with **per-plugin
and per-theme overrides**.
* **Update windows and allowed days**, plus **freeze periods** for the times you
do not want anything changing.
* Delay updates by a set number of days to let others find the bugs first.
* Optional **maintenance mode during updates**, and detection of version-controlled
installs.
* Email notifications and a daily digest.
#### 📊 Monitoring, Security Score & logs
* **Security Score** — a scored posture with a per-check breakdown showing exactly
what is holding the score down.
* **Activity log** — successful and failed logins, logouts, lockouts, 2FA events
and password events, with a configurable retention period.
* **Session log** for session events and anomalies.
* **Who’s online** — see which users are active right now.
* **WordPress core file integrity check** — verify core files against the official
WordPress.org checksums.
* **Site Health integration** — plugin, server, database, filesystem, theme and
WordPress diagnostics added to the Site Health screen.
* **Dashboard widget** summarising failed logins, issues found, outdated plugins
and your current score.
#### 🧪 Test Mode
* Simulate your security rules **without blocking anyone**.
* Review a log of exactly what _would_ have been blocked before you enforce it.
* Choose which roles are affected, and keep administrators excluded.
* An admin-bar indicator and dashboard notice make sure you never forget it is
on.
#### 🧰 Tools, migration & backup
* **Migrate from Wordfence Login Security** — preview what will be imported, run
it, and roll it back if you change your mind.
* **Export and import settings as JSON** for staging-to-production moves or disaster
recovery.
* **Reset all settings** back to defaults, and clear the plugin cache.
* **Diagnostics** — REST API status, cron status with a manual run trigger, and
server status.
* **Emergency deactivation URL** — a secret link that switches the plugin off if
you are locked out.
#### 🧩 Works with what you already run
Ultimate Security detects and adapts to WooCommerce, Ultimate Member, popular page
builders, form plugins, caching plugins and SEO plugins, and warns you when another
security plugin is doing the same job.
#### ⌨️ WP-CLI
```
wp ultimate-security template list
wp ultimate-security template apply [--dry-run]
wp ultimate-security template undo
wp ultimate-security export [--file=]
wp ultimate-security import [--dry-run]
wp ultimate-security status
```
👉 **[Check Out »](https://www.wpultimatesecurity.com)**
#### 🛠️ Recommended setups by use case
Different sites face different threats. Start with the profile that matches you,
then layer on more from the [documentation](https://docs.wpultimatesecurity.com/).
* **Solo blogger / personal site** — Enable Email 2FA on the admin account, set
a 5-attempt login lockout with a 15-minute cooldown, set a custom login URL,
and add Cloudflare Turnstile to the comment form.
* **Small agency / multi-author site** — Require authenticator-app 2FA per role
for editor and above, enforce password length + history, cap concurrent logins
per user, and enable Test Mode before tightening rules.
* **WooCommerce store** — Add reCAPTCHA or Turnstile to login, registration, lost-
password and checkout forms, set a custom login URL, enable brute-force lockout,
and run a vulnerability scan weekly.
* **Membership / community site** — Per-user 2FA enabled site-wide, strong password
policy, session limits to block account sharing, and CAPTCHA on registration
to keep bot signups out.
Every setup above uses only free features. See the [full setup guides](https://docs.wpultimatesecurity.com/)
for step-by-step instructions.
#### 📖 Security terms in plain English
New to WordPress security? Here is what the jargon means and why each one matters.
* **[Two-Factor Authentication](https://docs.wpultimatesecurity.com/docs/login-authentication/email-otp/)(
[2FA](https://docs.wpultimatesecurity.com/docs/login-authentication/authentication-apps/))**—
A second proof of identity (a one-time code) on top of your password, so a stolen
password alone cannot log in.
* **[Brute force](https://docs.wpultimatesecurity.com/docs/brute-force-protection/login-attempts/)**—
Automated tools that guess thousands of password combinations against your login
form; lockouts cut them off after a few failures.
* **CAPTCHA** — A [small puzzle](https://docs.wpultimatesecurity.com/docs/bot-protection/google-recaptcha/)
or [invisible check](https://docs.wpultimatesecurity.com/docs/bot-protection/cloudflare-turnstile/)
that confirms a real human is filling out a form, blocking most spam bots.
* **[Custom login URL](https://docs.wpultimatesecurity.com/docs/login-authentication/custom-login-url/)**—
Moving your login page from the well-known `/wp-login.php` to a secret path so
automated scanners cannot find it.
* **Vulnerability scanning** — Checking your installed plugins, themes and WordPress
version against public databases of known security flaws, so you learn about
a problem before an attacker uses it.
* **Virtual patching** — Blocking the specific requests that exploit a known flaw
at the network edge, which buys you time when an update is not available yet.
* **[Salt rotation](https://docs.wpultimatesecurity.com/docs/security-keys/wordpress-security-keys/)**—
Replacing the random secret keys in `wp-config.php` to invalidate stolen sessions
and force re-login everywhere.
* **Session control** — Limiting how many places one account can be logged in at
once and hardening the auth cookie.
* **Test Mode** — Previewing which requests a new rule would have blocked, before
the rule starts blocking anything for real.
Each term links to deeper reading in the [documentation](https://docs.wpultimatesecurity.com/).
#### 📚 Learn more
* 🌐 [Website](https://www.wpultimatesecurity.com) — features, articles and more.
* 📘 [Documentation](https://docs.wpultimatesecurity.com/) — setup guides, troubleshooting,
and how-tos.
* 🎥 [YouTube channel](https://www.youtube.com/@wpultimatesecurity) — video walkthroughs
and tutorials.
#### 🎯 Featured guides
Short, focused reads that get most sites secure in under an hour. All link into
the [documentation](https://docs.wpultimatesecurity.com/).
* **Set up Email 2FA for your admin account** — the fastest single thing you can
do to block account takeover.
* **Add an authenticator app (TOTP/HOTP) for stronger 2FA** — Google Authenticator,
Authy, Microsoft Authenticator.
* **Pick a safe custom login URL** — what to choose, what to avoid, how to recover
if you forget it.
* **Add reCAPTCHA or Cloudflare Turnstile to your forms** — including WooCommerce
login, registration and checkout.
* **Tune brute-force lockout without locking yourself out** — sane attempt limits,
lockout duration, allowlists.
* **Run your first vulnerability scan** — reading the results, and what to do about
an abandoned plugin.
* **Rotate WordPress security keys (salts) safely** — when to rotate, what it logs
everyone out of, and how to schedule it.
### External Services
This plugin connects to the following third-party services, and only when you use
the related feature:
#### Google reCAPTCHA
* When: reCAPTCHA protection is enabled. The reCAPTCHA script is then loaded in
your visitors’ browsers on the protected forms.
* Data sent: the visitor’s reCAPTCHA response token, your site secret key, and
the visitor’s IP address for verification.
* Endpoints: https://www.google.com/recaptcha/api.js (browser script, with a preconnect
to https://www.gstatic.com) and https://www.google.com/recaptcha/api/siteverify(
server-side verification).
* Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/
privacy
#### Cloudflare Turnstile
* When: Cloudflare Turnstile protection is enabled. The Turnstile script is then
loaded in your visitors’ browsers on the protected forms.
* Data sent: the visitor’s Turnstile response token, your site secret key, and
the visitor’s IP address for verification.
* Endpoints: https://challenges.cloudflare.com/turnstile/v0/api.js (browser script)
and https://challenges.cloudflare.com/turnstile/v0/siteverify (server-side verification).
* Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.
com/privacypolicy/
#### WPVulnerability
* When: the Vulnerability Scanner runs. This is the default vulnerability database
and requires no API key.
* Data sent: your WordPress version and the slugs of your installed plugins and
themes.
* Endpoint: https://www.wpvulnerability.net/
* Privacy: https://www.wpvulnerability.net/
#### WPScan
* When: the Vulnerability Scanner runs and you have configured a WPScan API key.
* Data sent: your WPScan API key, your WordPress version, and the slugs of your
installed plugins and themes.
* Endpoint: https://wpscan.com/api/v3/
* Terms: https://wpscan.com/terms-of-service/ — Privacy: https://wpscan.com/privacy-
policy/
#### Patchstack
* When: the Vulnerability Scanner runs and you have configured a Patchstack API
key.
* Data sent: your Patchstack API key, your WordPress version, and the slugs of
your installed plugins and themes.
* Endpoint: https://patchstack.com/database/api/v2/
* Terms: https://patchstack.com/terms-of-service/ — Privacy: https://patchstack.
com/privacy-policy/
#### WordPress.org Plugin and Theme Information API
* When: the Vulnerability Scanner checks whether an extension has been abandoned,
and when the Update Manager gathers update information.
* Data sent: the slugs of your installed plugins and themes (no user data).
* Endpoints: https://api.wordpress.org/plugins/info/1.2/ and https://api.wordpress.
org/themes/info/1.2/
* Privacy: https://wordpress.org/about/privacy/
#### WordPress.org Core Version Check
* When: the Update Manager checks for available WordPress core updates.
* Data sent: a standard WordPress core version-check request (no user data).
* Endpoint: https://api.wordpress.org/core/version-check/1.7/
* Privacy: https://wordpress.org/about/privacy/
#### WordPress.org Core Checksums
* When: you run the WordPress core file-integrity check.
* Data sent: your WordPress version and locale, in order to retrieve the official
file checksums for comparison.
* Endpoint: https://api.wordpress.org/core/checksums/1.0/
* Privacy: https://wordpress.org/about/privacy/
#### WordPress.org Secret-Key (Salt) API
* When: you rotate WordPress security keys and salts, on demand or on a schedule.
* Data sent: a request for randomly generated salt strings (no site or user data).
* Endpoint: https://api.wordpress.org/secret-key/1.1/salt/
* Privacy: https://wordpress.org/about/privacy/
#### Cloudflare API
* When: you connect Cloudflare or preview, deploy, remove or analyse WAF rules.
* Data sent: …
## স্ক্ৰীনশ্বট
[[
[[
[[
[[
[[
[[
[[
[[
[[
[[
[[
[[
[[
## ইনষ্টলেশ্যন
**Requirements:** WordPress 5.6+ and PHP 7.0+. HTTPS is strongly recommended for
2FA and secure sessions.
📘 Full setup walkthrough: [Documentation](https://docs.wpultimatesecurity.com/)·
[Video tutorials](https://www.youtube.com/@wpultimatesecurity)
#### Install from your dashboard
1. In WordPress, go to **Plugins Add New** and search for “wpultimatesecurity”.
2. Click **Install Now**, then **Activate**.
3. Follow the **Security Wizard** that appears — it scans your site, recommends settings,
and shows you every change before applying it.
#### Install manually
1. Download the plugin ZIP.
2. Go to **Plugins Add New Upload Plugin**, choose the ZIP, and click **Install
Now**.
3. Click **Activate**, then follow the Security Wizard.
Or with WP-CLI: `wp plugin install ultimate-security --activate`
#### Recommended first 5 minutes
1. Run the **Security Wizard** and apply a template that matches your site.
2. Enable **2FA** for all administrator accounts.
3. Set **login attempt limits** and a lockout duration.
4. Add **CAPTCHA** (reCAPTCHA or Cloudflare Turnstile) to your login, registration
and comment forms.
5. Set a **custom login URL**, save it somewhere safe, and store the emergency access
link the wizard showed you.
6. Run a **vulnerability scan**, then review the **Security Score** and **Site Health**
before enabling stricter rules.
## সঘনাই উত্থাপিত প্ৰশ্ন
### Will this slow down my site?
It is built to stay lightweight — security checks run on login and form submission,
not on every page view. Vulnerability scans run on a schedule in the background,
not during visitor requests.
### Do I need any technical or coding knowledge?
No. The setup wizard scans your site, recommends settings, and shows you every change
before it is applied — and you can undo all of it. Every setting is in plain English.
### I enabled 2FA or a custom login URL and locked myself out. How do I get back in?
Use the **emergency deactivation URL** the setup wizard showed you — open it in
a browser and the plugin switches itself off. If you did not save it, deactivate
the plugin manually: over FTP/SFTP rename the folder `/wp-content/plugins/ultimate-
security`, or over SSH run `wp plugin deactivate ultimate-security`. Then log in
and reconfigure.
### Do I need an API key for vulnerability scanning?
No. The scanner works out of the box using the keyless WPVulnerability database.
WPScan and Patchstack API keys are optional and only add extra coverage.
### Does it work with WooCommerce?
Yes. Both reCAPTCHA and Cloudflare Turnstile can protect WooCommerce login, registration,
lost-password and checkout forms, and there is a WooCommerce setup template in the
wizard.
### Do I need a Cloudflare account to use this plugin?
Only for the WAF Rules section. Those rules are deployed to your own Cloudflare
zone, so they need a Cloudflare account and an API token. Every other feature works
without one.
### Does it work on WordPress Multisite?
The plugin activates and runs on Multisite, and its uninstall routine is network-
aware. It has not been tested as extensively on Multisite as on single-site installs,
so validate on a staging network first and configure settings per site.
### Does the custom login URL work with caching and CDNs?
Yes. Exclude the login path from full-page caching (most caching plugins do this
for login and admin pages automatically) so the secret URL is never served from
cache.
### Will it conflict with other security or CAPTCHA plugins?
It can if two plugins do the same job. Pick one plugin per function (one 2FA, one
CAPTCHA, one login limiter) and disable the overlapping feature in the other. Ultimate
Security detects common security plugins and warns you.
### I already use another security plugin. Can I bring my settings across?
Settings can be imported from Wordfence Login Security. You get a preview of exactly
what will be imported before anything is applied, and you can roll the import back
afterwards.
### Does the plugin track me or phone home?
No. Ultimate Security does not collect product-usage telemetry. It contacts third-
party services only when you use a feature that requires one, and every one of those
is listed under External Services below.
### What does the plugin store about my visitors?
IP addresses and user agents are recorded in the activity and session logs so you
can investigate login attempts, with a retention period you control (30 days by
default). Test Mode keeps its own log of what would have been blocked. “Who’s online”
rows expire after 60 seconds. Nothing is sent off your site except through the services
listed below.
### Is it GDPR-friendly?
The plugin is self-hosted and stores its data in your own database. Outbound calls
are limited to the feature-specific services listed under External Services, such
as reCAPTCHA, Turnstile, the vulnerability databases and WordPress.org APIs.
### What happens to my data when I uninstall?
By default the plugin leaves its data in place. If you enable the “delete plugin
data” option in the plugin’s advanced settings before uninstalling, its database
tables, options and user meta are removed on uninstall.
### What is the difference between Free and Pro?
Everything described on this page is in the free plugin: the setup wizard, email
and app-based 2FA, brute-force lockout, custom login URL, HTTP Basic Auth, password
policies, session management, reCAPTCHA and Turnstile, vulnerability scanning, Cloudflare
WAF rules, security-key rotation (on demand and scheduled), the Update Manager,
Security Score, activity logs, core file-integrity checking, Site Health, Test Mode,
Wordfence migration, and settings backup and restore. Ultimate Security Pro is a
separate add-on that requires this free plugin and adds further authentication,
monitoring, automation and maintenance features not included here.
### How do I get support?
Use the plugin support forum on WordPress.org, or visit https://www.wpultimatesecurity.
com.
## পৰ্য্যালোচনা
এই প্লাগিনৰ বাবে কোনো পৰ্য্যালোচনা নাই।
## অৱদানকাৰী আৰু বিকাশকাৰীসকল
“Ultimate Security” হৈছে মুক্ত উৎসৰ ছফ্টৱেৰ। এইসকল লোকে এই প্লাগিনত অৱদান আগবঢ়াইছে।
অৱদানকাৰীসকল
* [ WP Ultimate Security ](https://profiles.wordpress.org/wpultimatesecurity/)
[আপোনাৰ ভাষাত “Ultimate Security” অনুবাদ কৰক।](https://translate.wordpress.org/projects/wp-plugins/ultimate-security)
### বিকাশৰ প্ৰতি আগ্ৰহী?
[ক’ড ব্ৰাউজ কৰক](https://plugins.trac.wordpress.org/browser/ultimate-security/),
[SVN ৰিপজিটৰী](https://plugins.svn.wordpress.org/ultimate-security/) চাওক নাইবা
[RSS](https://plugins.trac.wordpress.org/log/ultimate-security/?limit=100&mode=stop_on_copy&format=rss)-
দ্বাৰা [বিকাশৰ পঞ্জী](https://plugins.trac.wordpress.org/log/ultimate-security/)
ছাবস্ক্ৰাইব কৰক।
## সলনি-পঞ্জী
#### 1.0.23
* Maintenance: Removed unreachable code — an unused salt-change extension, a duplicate
session route registrar, an unscheduled cron entry, an unused settings group,
and unused Pro-feature permission helpers.
* Update: The readme now documents the complete free feature set and discloses
every third-party service the plugin contacts.
* Compatibility: The plugin should now be compatible with WordPress 5.6 and PHP
7.0 runtime.
#### 1.0.22
* New: One click Migration from Wordfence Login Security to Ultimate Security.
* New: Revamped Google reCAPTCHA and Cloudflare Turnstile settings for consistency.
* Improvement: Added localized passkey login feedback supplied by Ultimate Security
Pro.
* Security: Render passkey login errors as text instead of interpolating error
content into HTML.
#### 1.0.21
* New: WordPress Salt keys rotation option. Now you can schedule, skip and more
when rotating keys.
* New: Now you can see the reCaptcha Logs directly from the plugin’s setting page.
* Improvement: Both reCaptcha and Cloudflare Turnstile follow a similar settings
structure for consistency.
* Fix: Cloudflare Turnstile and reCAPTCHA whitelist option was not working properly.
#### 1.0.20
* New: Improved Session Management settings including concurrent login limits,
session cookie hardening and more,
* New: Cloudflare Turnstile and reCAPTCHA CAPTCHA verifcation when applying their
respective keys.
* Improvement: Cloudflare WAF rules function improvement.
* Improvement: Code optimization and performance improvements.
#### 1.0.19
* Fix: 2FA User role was not working properly.
* Fix: Login activity dashboard modal was showing wrong agent.
* Improvement: Better user friendly Server Protection Card Design
* Improvement: Code cleanup and optimization.
#### 1.0.18
* New: One-click Cloudflare WAF rules apply
* New: New Modal for Login activity with detailed information.
* Improvement: Code cleanup and optimization
* Fix: Login redirected URL was showing exisiting login for password reset
#### 1.0.17
* Fix: Minor bug fixes and stability improvements
* Improvement: Code cleanup and optimization
#### 1.0.16
* Improvement: Code improvements to the ovearll plugin making it snappier.
#### 1.0.15
* Improvement: Conflict management between applied settings.
* Improvement: UI improvements to existing settings pages. Making it more intuitive
to use.
* Fix: Multiple bug fixes to dashboard. You should get more accurate results now.
* Fix: New deactivation URL was not saving after deactiviting-activating plugin.
#### 1.0.14
* Fix: Email 2FA codes were not being sent properly
* Fix: 2FA code page flickering effect after login
#### 1.0.13
* New: Completely redesigned user interface for better usability
#### 1.0.12
* New: Security Score meter to track your site’s security level
* Improvement: Enhanced modal design for better UI/UX
#### 1.0.11
* Fix: Minor UI bug fixes
#### 1.0.10
* Security: Removed unauthenticated AJAX actions
* Security: REST routes now require admin permission
#### 1.0.9
* Fix: Dashboard emergency deactivation URL display issue
#### 1.0.8
* Improvement: Human-readable values in activity log
* Improvement: Reduced plugin size with optimized code
* Fix: 2FA reset issue for users
* Fix: Password policy not applying to new users
#### 1.0.7
* New: Activity Log feature
* New: Improved dashboard design
* Fix: Nonce validation issues
* Fix: Turnstile not showing on comment forms
#### 1.0.6
* Fix: Custom login setup issues
* Fix: Email 2FA asking for OTP twice
* Fix: Feedback form email delivery
* Improvement: Reorganized menu navigation
* Improvement: Performance optimizations
#### 1.0.5
* Fix: Request logs page display issue
* Fix: URL Guard SQL query display
* Improvement: Performance optimizations
#### 1.0.4
* Redesigned settings page interface
## মেটা
* **1.0.23** সংস্কৰণ
* **5 দিন আগত** শেষবাৰ আপডে’ট হৈছিল
* সক্ৰিয় ইনষ্টলেশ্যন **10+**
* WordPress-ৰ সংস্কৰণ ** 5.6 বা তাতকৈ ওপৰৰ **
* ইমানলৈকে পৰীক্ষা কৰা হৈছে **7.0.4**
* PHP-ৰ সংস্কৰণ ** 7.0 বা তাতকৈ ওপৰৰ **
* ভাষা
* [English (US)](https://wordpress.org/plugins/ultimate-security/)
* [Brute Force](https://as.wordpress.org/plugins/tags/brute-force/)[captcha](https://as.wordpress.org/plugins/tags/captcha/)
[login security](https://as.wordpress.org/plugins/tags/login-security/)[security](https://as.wordpress.org/plugins/tags/security/)
[two factor authentication](https://as.wordpress.org/plugins/tags/two-factor-authentication/)
* টেগবোৰ
* [উচ্চখাপৰ ভিউ](https://as.wordpress.org/plugins/ultimate-security/advanced/)
## ৰে’টিংবোৰ
এতিয়ালৈ কোনো পৰ্য্যালোচনা দাখিল কৰা হোৱা নাই।
[Your review](https://wordpress.org/support/plugin/ultimate-security/reviews/#new-post)
[সকলো পৰ্য্যালোচনা চাওক](https://wordpress.org/support/plugin/ultimate-security/reviews/)
## অৱদানকাৰীসকল
* [ WP Ultimate Security ](https://profiles.wordpress.org/wpultimatesecurity/)
## সাহায্য
কিবা ক’বলগীয়া আছে? সহায় লাগে?
[সাহায্যৰ ফ’ৰাম চাওক](https://wordpress.org/support/plugin/ultimate-security/)
## দান কৰক
আপুনি এই প্লাগিনৰ উন্নতিৰ প্ৰতি সাহায্য আগবঢ়াব বিচাৰেনে?
[ এই প্লাগিনক অনুদান দিয়ক ](https://www.wpultimatesecurity.com)