---
title: "All-In-One Security (AIOS)"
description: "AIOS free or Premium: strengths, limitations, pricing, login, two-factor and firewall settings, and the plugin's patched vulnerabilities."
language: "en"
locale: "en-US"
type: "plugin-sheet"
canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/all-in-one-security-aios/"
published: "2026-11-04T08:00:00+00:00"
modified: "2026-11-05T20:58:09+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/all-in-one-security-aios/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/all-in-one-security-aios/index.md"
  es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/all-in-one-security-aios/index.md"
  de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/all-in-one-security-aios/index.md"
  it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/all-in-one-security-aios/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/all-in-one-security-aios/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/all-in-one-security-aios/index.md"
---

# All-In-One Security (AIOS)

All-In-One Security (AIOS), from the UpdraftPlus team, brings login protection, a firewall, file security and spam filtering together in one menu. Our take on the free and Premium versions, the safe settings to turn on without locking yourself out, and the plugin's patched vulnerabilities.

## The essentials

- Best for blogs and business sites on Apache that want login, firewall and file settings in one place.
- Main caveat: the free version has no malware scanning.
- Free; Premium costs $89 a year before tax for 2 sites and adds malware scans and country blocking.

## What All-In-One Security does on your WordPress site

All-In-One Security (AIOS) is built by Team Updraft, the team behind UpdraftPlus. It puts everything under one menu: login protection (attempt limits, TOTP app-based two-factor authentication, a renamed login page, blocking of account enumeration), a [web application firewall](https://www.wp-masquerade.com/glossary/waf/) made of PHP and `.htaccess` rules, including the 6G rules from Perishable Press, file security (permissions, a disabled file editor, detection of changed files), comment spam filtering and an audit log.

Every feature is tagged basic, intermediate or advanced and raises the score of the "Security strength meter" on the plugin dashboard. A setup wizard offers to switch on a first batch of recommended settings. Once you "set up" the PHP firewall, it loads before WordPress through the `auto_prepend_file` directive. According to the plugin's privacy policy, the IP addresses and logs it collects stay on your server.

The free version covers login security and the firewall well. AIOS Premium, an add-on installed on top of the free plugin, adds malware scanning with uptime and response time monitoring, country blocking, blocking of IPs that pile up 404 errors, advanced two-factor authentication (mandatory for chosen roles, emergency codes, trusted devices, WooCommerce login forms) and ticket support. Annual plans, before tax: Personal at $89 for 2 sites, Business at $149 for 10 sites, Agency at $249 for 35 sites and Enterprise at $349 for unlimited sites.

![Diagram: All-In-One Security (AIOS) works on web server, wordpress, database and files. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro).](https://www.wp-masquerade.com/media/wpm-sheets/aios/diagram-en.svg?v=ff64c0a6)

## Which sites AIOS is a good fit for

- **Blogs and business sites on Apache or LiteSpeed** that want login, firewall and file settings in one place, for free.
- **Security beginners**: the feature levels and the score show where to start.
- **Sites already backed up with [UpdraftPlus](https://www.wp-masquerade.com/features/camouflaged-plugins/updraftplus/)**: AIOS can run a database backup through UpdraftPlus from its Database Security menu.
- **Freelancers with a handful of sites**: the entry Premium plan already covers 2 sites, the next one 10.

AIOS is a weaker fit for a site on Nginx or IIS, where the protections written to `.htaccess` don't apply, for a site that wants free malware scanning (the [Wordfence](https://www.wp-masquerade.com/features/camouflaged-plugins/wordfence/) scanner is free), or for a site that keeps another full security suite: two firewalls and two login limiters get in each other's way.

## All-In-One Security strengths and limitations

### Strengths

- **Lots of free features.** Two-factor authentication, login limits, the firewall, changed-file detection and the audit log need no license.
- **A guided setup.** The wizard, the basic-to-advanced levels and the security score keep you from switching on risky options on day one.
- **No account required.** The free firewall, login limits and logs run on your server, with no license or TeamUpdraft account.
- **Premium shared across sites.** The entry plan covers 2 sites and Enterprise an unlimited number.

### Limitations

- **No malware scanning on the free plan.** The free version detects changed files but doesn't look for malicious code.
- **Generic rules.** The firewall applies rule sets such as 6G, with no advertised virtual patching for a specific plugin vulnerability.
- **Tied to Apache.** On Nginx or IIS, the `.htaccess` rules have no effect.
- **Options that can lock you out.** Renaming the login page or blocking XML-RPC or the REST API breaks things if you enable them untested.
- **Mandatory 2FA and emergency codes cost extra.** On the free plan, each user decides whether to turn it on.

## The AIOS settings we recommend

Labels from AIOS 5.5. Back up the site before touching the firewall, and keep FTP or host file manager access so you can disable the plugin if you get locked out.

| Setting | Recommended value | Why |
| --- | --- | --- |
| **Enable login lockout feature**  AIOS > User Security > Login lockout | On; "Max login attempts" between 3 (default) and 5 | Off after install. Each new lockout triples in length, up to 60 minutes by default. |
| **Allow unlock requests**  Same tab | On | A legitimate user who gets locked out can request an unlock link by email. |
| **Make two factor authentication available**  AIOS > Settings > Two factor authentication | At least administrators and editors | Each user then turns on their code under AIOS > Two Factor Auth. Test the login from a private window. |
| **Disable PHP file editing**  AIOS > File Security > File protection | On | A stolen admin account can no longer inject code through the theme and plugin editor. |
| **Enable automated file change detection scan**  AIOS > Scanner > File change detection | On, once a day | Exclude cache and log folders, or the alerts turn into noise. |
| **IP address detection settings**  AIOS > Settings > Advanced settings | The variable that matches your setup (`HTTP_CF_CONNECTING_IP` behind Cloudflare) | A wrong value can get the proxy address blocked, and with it every visitor. |
| **Enable 6G firewall protection**  AIOS > Firewall > PHP rules > nG firewall rules | On, after testing on staging | Leave the PUT method allowed (the default): some WooCommerce extensions and REST requests use it. |
| **Disable pingback functionality from XMLRPC**  AIOS > Firewall > PHP rules > Security enhancements | On; "Completely block access to XMLRPC" only without Jetpack or mobile apps | Stops abused pingbacks without breaking services that rely on XML-RPC. |
| **Detect spambots posting comments**  AIOS > Spam Prevention > Comment spam | On if comments are open | A comment from a visitor without JavaScript or cookies is discarded or marked as spam; check your page cache too. |

Renaming the login page (AIOS > Brute Force > Rename login page) is useful, but don't combine it with another tool that already changes that URL. Write down the new address before saving. To pick lockout thresholds, see our guide to [limiting login attempts](https://www.wp-masquerade.com/limit-login-attempts-wordpress/).

- Your account logs in with the two-factor code from a private window.
- The IP address AIOS shows for you in the advanced settings is really yours.
- Forms, cart and checkout still work after turning on 6G.
- A first changed-file scan has finished and you have reviewed its results.

## Vulnerabilities patched in AIOS

Like any security plugin, AIOS has had its flaws. The most serious recent one, CVE-2026-8438, let an anonymous visitor inject JavaScript into the debug log when REST API blocking and that log were both enabled; it is fixed in 5.4.8. CVE-2024-1037, a reflected XSS through the `tab` parameter, is fixed in 5.2.6, and CVE-2022-4097, which allowed IP spoofing to get around blocks, in 5.0.8. Version 5.5.0, released in October 2026, further hardened two-factor authentication and account unlocking. The useful move: turn on automatic plugin updates for AIOS.

Hiding AIOS fixes no vulnerability, but it makes the plugin harder to spot for bots that target its vulnerable versions. Our [comparison of WordPress security plugins](https://www.wp-masquerade.com/best-wordpress-security-plugins/) sets AIOS against Wordfence, Solid Security and Sucuri.

## All-In-One Security FAQ

**Is the free version of AIOS enough for a small site?**

For an up-to-date blog or business site, often yes: login limits, two-factor authentication and the firewall are free. What's missing is malware scanning, which comes with Premium or another plugin.

**Can I run AIOS alongside Wordfence?**

It's not recommended: two firewalls and two login limiters overlap and make lockouts harder to troubleshoot. Pick one main suite and turn off the duplicate features.

**AIOS locked me out of my site. What now?**

Wait for the lockout to expire, or request the unlock link by email if that option is on. Otherwise, rename the `all-in-one-wp-security-and-firewall` folder over FTP to disable the plugin, then fix the setting at fault.

**Does AIOS work on an Nginx server?**

Yes for the features handled in PHP (login, two-factor authentication, PHP firewall rules). According to the vendor's FAQ, the protections written to `.htaccess` don't apply.

## Key facts

- Category: Security
- Vendor: Team Updraft
- Price: Free; Premium from $89 per year (before tax) for 2 sites
- Active installations (wordpress.org): 1 000 000+
- Version: 5.5.1
- Official page: https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/

## What WP Masquerade hides

- Handled by WP Masquerade Pro only
- With Pro: folder name, tag IDs