BulletProof Security

81 Quality Score

Active Installs

19/30

With roughly 20,000 active installs and a low popularity score of 64 out of 30, this is a niche plugin compared to alternatives like Wordfence at 5 million installs or Really Simple Security at 3 million.

Update Freshness

25/25

Maintenance is a perfect 100, reflecting the very recent update on 2026-05-20 and confirmed compatibility with WordPress 7.0.

User Rating

14/15

User ratings are exceptionally strong at 96 out of 100 across 674 reviews, indicating high satisfaction from the existing user base.

Support Health

8/15

Support health is mediocre at 50 out of 100, based on only 2 resolved threads; the tiny support volume makes it hard to judge responsiveness.

WP Compatibility

15/15

Compatibility scores 100 out of 100, covering WordPress 5.0 through 7.0 and PHP 7.0 and above.

Scores higher than 84% of indexed plugins

About

WordPress Security Protection: Malware scanner, Firewall, Login Security, DB Backup, Anti-Spam...

Active Installs 20k+

Rating ★★★★½ 4.8/5

Last Updated 2026-08-19 9:23pm GMT

Requires WordPress 5.0+

Tested Up To 7.1

Requires PHP 7.0+

Security History

12 known vulnerabilities, all patched

2 High 10 Medium

Most recent: January 6, 2026

View details ▸

BulletProof Security <= 6.9 - Unauthenticated Sensitive Information Exposure Medium

January 6, 2026 Patched in ["7.0"] CVE-2025-67931

BulletProof Security <= 6.0 - Stored Cross-Site Scripting Medium

April 19, 2022 Patched in ["6.1"] CVE-2022-1265

BulletProof Security <= 5.7 - Admin+ Stored Cross-Site Scripting Medium

February 22, 2022 Patched in ["5.8"] CVE-2022-0590

BulletProof Security <= 5.1 - Sensitive Information Disclosure Medium

September 16, 2021 Patched in ["5.2"] CVE-2021-39327

BulletProof Security <= .53.3 - Authenticated Cross-Site Scripting Medium

May 11, 2016 Patched in [".53.4"]

BulletProof Security <= .53.2 - Cross-Site Scripting High

March 17, 2016 Patched in [".53.3"]

BulletProof Security < .51.1 - Cross-Site Scripting Medium

November 5, 2014 Patched in [".51.1"] CVE-2014-7958

BulletProof Security < .51.1 - Server-Side Request Forgery Medium

November 5, 2014 Patched in [".51.1"] CVE-2014-8749

BulletProof Security < .51.1 - SQL Injection High

October 7, 2014 Patched in [".51.1"] CVE-2014-7959

BulletProof Security < .52.5 - Cross-Site Scripting Medium

September 30, 2014 Patched in [".52.5"] CVE-2015-9230

BulletProof Security <= .48.9 - Cross-Site Scripting Medium

August 1, 2014 Patched in [".49"] CVE-2013-3487

BulletProof Security < .47.1 - Reflected Cross-Site Scripting Medium

May 11, 2012 Patched in [".47.1"] CVE-2012-4268

What It Does

BulletProof Security bundles a .htaccess-based firewall, malware scanner, login hardening, database backups, and anti-spam tools into a single WordPress security plugin. It focuses on server-level protection through Apache configuration files rather than relying solely on PHP-level filtering. The plugin also includes idle session logout, security logs, and a one-click setup wizard for non-technical users.

Who It's For

This plugin fits site owners on Apache hosting who want an all-in-one security toolkit without paying for a SaaS subscription like Wordfence or Sucuri. It is well suited to small business sites, membership sites, and multi-author blogs that need login protection, backups, and a firewall in one package. Developers comfortable editing .htaccess files directly will get the most out of it.

Who Should Skip It

If you run Nginx or a managed WordPress host that already handles firewall and backup at the infrastructure layer, the .htaccess-centric design adds little value and can cause conflicts. Sites needing real-time malware signature updates and a deep IP reputation database should look at Wordfence or a hosted WAF instead.

The Bottom Line

BulletProof Security earns a solid 81.16 out of 100 thanks to recent maintenance, strong user ratings, and full WordPress 7.0 compatibility. Its smaller install base, Apache-only focus, and limited support volume mean it is a sensible choice for technical users on Apache hosts but a riskier pick for those needing deep community resources. Overall it is a capable, budget-friendly security bundle, though most users will find more polished alternatives in Wordfence or All-In-One Security.

Pick this if your main concern is forcing HTTPS across the site with minimal configuration, and you want broader community support.

Wordfence Security – Firewall, Malware Scan, and Login Security 97/100

Pick this for a much larger install base, a constantly updated malware signature database, and a more active support forum.

Jetpack – WP Security, Backup, Speed, & Growth 94/100

Pick this if you also want backups, performance, and stats bundled with security from a well-known Automattic-backed team.

All-In-One Security (AIOS) – Security and Firewall 91/100

Pick this for a friendlier UI, more detailed documentation, and a larger user community without the .htaccess focus.

Safe SVG 89/100

Pick this as a complementary plugin specifically for sanitizing SVG uploads rather than a full security suite.