What All-In-One Security does on your WordPress site
All-In-One Security (AIOS) is built by Team Updraft, the team behind UpdraftPlus. It puts everything under one menu: login protection (attempt limits, TOTP app-based two-factor authentication, a renamed login page, blocking of account enumeration), a web application firewall made of PHP and .htaccess rules, including the 6G rules from Perishable Press, file security (permissions, a disabled file editor, detection of changed files), comment spam filtering and an audit log.
Every feature is tagged basic, intermediate or advanced and raises the score of the "Security strength meter" on the plugin dashboard. A setup wizard offers to switch on a first batch of recommended settings. Once you "set up" the PHP firewall, it loads before WordPress through the auto_prepend_file directive. According to the plugin's privacy policy, the IP addresses and logs it collects stay on your server.
The free version covers login security and the firewall well. AIOS Premium, an add-on installed on top of the free plugin, adds malware scanning with uptime and response time monitoring, country blocking, blocking of IPs that pile up 404 errors, advanced two-factor authentication (mandatory for chosen roles, emergency codes, trusted devices, WooCommerce login forms) and ticket support. Annual plans, before tax: Personal at $89 for 2 sites, Business at $149 for 10 sites, Agency at $249 for 35 sites and Enterprise at $349 for unlimited sites.
Which sites AIOS is a good fit for
- Blogs and business sites on Apache or LiteSpeed that want login, firewall and file settings in one place, for free.
- Security beginners: the feature levels and the score show where to start.
- Sites already backed up with UpdraftPlus: AIOS can run a database backup through UpdraftPlus from its Database Security menu.
- Freelancers with a handful of sites: the entry Premium plan already covers 2 sites, the next one 10.
AIOS is a weaker fit for a site on Nginx or IIS, where the protections written to .htaccess don't apply, for a site that wants free malware scanning (the Wordfence scanner is free), or for a site that keeps another full security suite: two firewalls and two login limiters get in each other's way.
All-In-One Security strengths and limitations
Strengths
- Lots of free features. Two-factor authentication, login limits, the firewall, changed-file detection and the audit log need no license.
- A guided setup. The wizard, the basic-to-advanced levels and the security score keep you from switching on risky options on day one.
- No account required. The free firewall, login limits and logs run on your server, with no license or TeamUpdraft account.
- Premium shared across sites. The entry plan covers 2 sites and Enterprise an unlimited number.
Limitations
- No malware scanning on the free plan. The free version detects changed files but doesn't look for malicious code.
- Generic rules. The firewall applies rule sets such as 6G, with no advertised virtual patching for a specific plugin vulnerability.
- Tied to Apache. On Nginx or IIS, the
.htaccessrules have no effect. - Options that can lock you out. Renaming the login page or blocking XML-RPC or the REST API breaks things if you enable them untested.
- Mandatory 2FA and emergency codes cost extra. On the free plan, each user decides whether to turn it on.
The AIOS settings we recommend
Labels from AIOS 5.5. Back up the site before touching the firewall, and keep FTP or host file manager access so you can disable the plugin if you get locked out.
| Setting | Recommended value | Why |
|---|---|---|
| Enable login lockout feature AIOS > User Security > Login lockout | On; "Max login attempts" between 3 (default) and 5 | Off after install. Each new lockout triples in length, up to 60 minutes by default. |
| Allow unlock requests Same tab | On | A legitimate user who gets locked out can request an unlock link by email. |
| Make two factor authentication available AIOS > Settings > Two factor authentication | At least administrators and editors | Each user then turns on their code under AIOS > Two Factor Auth. Test the login from a private window. |
| Disable PHP file editing AIOS > File Security > File protection | On | A stolen admin account can no longer inject code through the theme and plugin editor. |
| Enable automated file change detection scan AIOS > Scanner > File change detection | On, once a day | Exclude cache and log folders, or the alerts turn into noise. |
| IP address detection settings AIOS > Settings > Advanced settings | The variable that matches your setup (HTTP_CF_CONNECTING_IP behind Cloudflare) | A wrong value can get the proxy address blocked, and with it every visitor. |
| Enable 6G firewall protection AIOS > Firewall > PHP rules > nG firewall rules | On, after testing on staging | Leave the PUT method allowed (the default): some WooCommerce extensions and REST requests use it. |
| Disable pingback functionality from XMLRPC AIOS > Firewall > PHP rules > Security enhancements | On; "Completely block access to XMLRPC" only without Jetpack or mobile apps | Stops abused pingbacks without breaking services that rely on XML-RPC. |
| Detect spambots posting comments AIOS > Spam Prevention > Comment spam | On if comments are open | A comment from a visitor without JavaScript or cookies is discarded or marked as spam; check your page cache too. |
Renaming the login page (AIOS > Brute Force > Rename login page) is useful, but don't combine it with another tool that already changes that URL. Write down the new address before saving. To pick lockout thresholds, see our guide to limiting login attempts.
- Your account logs in with the two-factor code from a private window.
- The IP address AIOS shows for you in the advanced settings is really yours.
- Forms, cart and checkout still work after turning on 6G.
- A first changed-file scan has finished and you have reviewed its results.
Vulnerabilities patched in AIOS
Like any security plugin, AIOS has had its flaws. The most serious recent one, CVE-2026-8438, let an anonymous visitor inject JavaScript into the debug log when REST API blocking and that log were both enabled; it is fixed in 5.4.8. CVE-2024-1037, a reflected XSS through the tab parameter, is fixed in 5.2.6, and CVE-2022-4097, which allowed IP spoofing to get around blocks, in 5.0.8. Version 5.5.0, released in October 2026, further hardened two-factor authentication and account unlocking. The useful move: turn on automatic plugin updates for AIOS.
Hiding AIOS fixes no vulnerability, but it makes the plugin harder to spot for bots that target its vulnerable versions. Our comparison of WordPress security plugins sets AIOS against Wordfence, Solid Security and Sucuri.
What WP Masquerade hides for All-In-One Security (AIOS)
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to All-In-One Security (AIOS): without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
No known trace
All-In-One Security FAQ
Is the free version of AIOS enough for a small site?
For an up-to-date blog or business site, often yes: login limits, two-factor authentication and the firewall are free. What's missing is malware scanning, which comes with Premium or another plugin.
Can I run AIOS alongside Wordfence?
It's not recommended: two firewalls and two login limiters overlap and make lockouts harder to troubleshoot. Pick one main suite and turn off the duplicate features.
AIOS locked me out of my site. What now?
Wait for the lockout to expire, or request the unlock link by email if that option is on. Otherwise, rename the all-in-one-wp-security-and-firewall folder over FTP to disable the plugin, then fix the setting at fault.
Does AIOS work on an Nginx server?
Yes for the features handled in PHP (login, two-factor authentication, PHP firewall rules). According to the vendor's FAQ, the protections written to .htaccess don't apply.