Anti-Malware Security and Brute-Force Firewall

85 Quality Score

Active Installs

23/30

100,000 active installs is a respectable middle-tier footprint, far below Wordfence's 5 million but well above niche security tools, indicating solid word-of-mouth adoption.

Update Freshness

25/25

Last updated June 2026 with claimed compatibility through WordPress 7.0, which is exceptional forward-compatibility for a plugin that still lists a 3.3 minimum requirement.

User Rating

15/15

A 98 out of 100 across 783 reviews is an unusually high average, suggesting the user base skews positive, though the sample size is smaller than top-tier competitors.

Support Health

8/15

Only 4 support threads with 3 resolved (75%) signals very low support volume, which is either a sign of a stable plugin or simply a user base that does not engage the support forums.

WP Compatibility

15/15

Compatible up to WordPress 7.0 with PHP 5.6 minimum gives it one of the widest compatibility ranges in the security category, working on legacy stacks where newer plugins refuse to load.

Scores higher than 95% of indexed plugins

About

This Anti-Malware scanner searches for Malware, Viruses, and other security threats and vulnerabilities on your server and it helps you fix them.

Active Installs 100k+

Rating ★★★★½ 4.9/5

Last Updated 2026-06-29 5:58pm GMT

Requires WordPress 3.3+

Tested Up To 7.0.4

Requires PHP 5.6+

Security History

11 known vulnerabilities, all patched

1 Critical 4 High 5 Medium 1 Low

Most recent: July 9, 2026

View details ▸

Anti-Malware Security and Brute-Force Firewall <= 4.23.89 - Unauthenticated Stored Cross-Site Scripting High

July 9, 2026 Patched in ["4.23.90"] CVE-2026-57691

Anti-Malware Security and Brute-Force Firewall <= 4.23.87 - Authenticated (Contributor+) PHP Object Injection High

April 20, 2026 Patched in ["4.23.88"] CVE-2026-39478

Anti-Malware Security and Brute-Force Firewall <= 4.23.81 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read Medium

October 28, 2025 Patched in ["4.23.83"] CVE-2025-11705

Anti-Malware Security and Brute-Force Firewall <= 4.21.96 - Unauthenticated Remote Code Execution Critical

March 12, 2024 Patched in ["4.23.56"] CVE-2024-22144

Anti-Malware Security and Brute-Force Firewall <= 4.21.85 - Authenticated (Admin+) PHP Object Injection High

December 21, 2022 Patched in ["4.21.86"] CVE-2022-4327

Anti-Malware Security and Brute-Force Firewall <= 4.20.95 - Reflected Cross-Site Scripting Medium

April 11, 2022 Patched in ["4.20.96"] CVE-2022-0953

Anti-Malware Security and Brute-Force Firewall <= 4.21.74 - Reflected Cross-Site Scripting Medium

February 8, 2022 Patched in ["4.21.83"] CVE-2022-2599

Anti-Malware Security and Brute-Force Firewall <= 4.20.93 - Reflected Cross-Site Scripting Medium

January 24, 2022 Patched in ["4.20.94"] CVE-2021-25101

Anti-Malware Security and Brute-Force Firewall <= 4.15.17 - Cross-Site Scripting High

May 10, 2016 Patched in ["4.16.18"]

Anti-Malware Security and Brute-Force Firewall <= 4.15.22 - Cross-Site Request Forgery Low

May 25, 2015 Patched in ["4.15.23"]

Anti-Malware Security and Brute-Force Firewall <= 4.15.22 - Cross-Site Scripting Medium

May 25, 2015 Patched in ["4.15.23"]

What It Does

Anti-Malware Security and Brute-Force Firewall scans your WordPress installation for known malware signatures, backdoors, and suspicious code patterns, then offers one-click removal for matched threats. It also adds a firewall layer that blocks common brute-force login attempts before they reach wp-login.php. The plugin pulls definition updates from its own server so newly discovered threat signatures get added over time.

Who It's For

This plugin is a good fit for site owners running older or budget hosting where server-level security is thin, and who want a self-contained malware scanner without paying for a third-party SaaS subscription. It suits small business sites, blogs, and membership sites that need a baseline scanner plus login protection without configuring a heavier security suite. Non-technical administrators will appreciate the patch-and-replace workflow for infected core files.

Who Should Skip It

If you already run Wordfence, Sucuri, or a host-provided malware scanner, adding this plugin is redundant and can cause overlapping scans or false-positive conflicts. Sites on managed WordPress hosts (Kinsta, WP Engine, Pressable) already have brute-force and malware protection at the infrastructure layer and do not need this plugin.

The Bottom Line

With an 84.59/100 quality score, 100,000 installs, and a 98/100 user rating, Anti-Malware Security and Brute-Force Firewall is a credible budget-friendly scanner that punches above its weight on compatibility and maintenance. It is not as feature-rich or as actively threat-fed as Wordfence, and the low support volume makes it harder to gauge responsiveness under pressure. For older PHP stacks or users who specifically want the patch-and-replace recovery workflow, it is a sensible pick; for most mainstream installs, Wordfence or a host-level scanner remains the safer default.

Pick this when your main concern is HTTPS migration, mixed-content fixes, and lightweight firewall headers rather than active malware scanning.

Wordfence Security – Firewall, Malware Scan, and Login Security 97/100

Pick Wordfence when you want real-time traffic monitoring, a more frequently updated threat feed, and 2FA bundled into the same plugin.

Jetpack – WP Security, Backup, Speed, & Growth 94/100

Pick Jetpack when you want security, backups, downtime monitoring, and performance tweaks from one Automattic-maintained plugin and do not mind the account connection.

All-In-One Security (AIOS) – Security and Firewall 91/100

Pick AIOS when you want a free plugin with a strong firewall rules engine and login lockdown but do not need signature-based malware scanning.

Safe SVG 89/100

Pick Safe SVG as a complement, not a replacement, since it solves a narrow upload-validation gap rather than full site malware scanning.