Title: Ultimate Security – AI Security, 2FA, Login Protection & Vulnerability Scanner
Author: WP Ultimate Security
Published: 22 Tháng 3, 2025
Last modified: 26 Tháng 10, 2026
---
Tìm kiếm plugin
# Ultimate Security – AI Security, 2FA, Login Protection & Vulnerability Scanner
Bởi [WP Ultimate Security](https://profiles.wordpress.org/wpultimatesecurity/)
[Tải về](https://downloads.wordpress.org/plugin/ultimate-security.1.2.0.zip)
* [Chi tiết](https://vi.wordpress.org/plugins/ultimate-security/#description)
* [Đánh giá](https://vi.wordpress.org/plugins/ultimate-security/#reviews)
* [Cài đặt](https://vi.wordpress.org/plugins/ultimate-security/#installation)
* [Nhà phát triển](https://vi.wordpress.org/plugins/ultimate-security/#developers)
[Hỗ trợ](https://wordpress.org/support/plugin/ultimate-security/)
## Mô tả
**Stop hackers and bots from getting into your WordPress site.** Ultimate Security
adds two-factor login, blocks password-guessing attacks, stops spam bots and warns
you about plugins with known security holes. A setup wizard picks the right settings
for your kind of site, so you don’t have to understand every option. And because
a security plugin should never break your site, every change can be previewed, tried
in Test Mode and undone.
It is also built for the age of AI. Check your site for hidden prompt injection
aimed at AI agents. See which AI crawlers and AI bots, like GPTBot and ClaudeBot,
read your pages, and block AI scrapers with ready-made Cloudflare rules. Connect
ChatGPT, Claude or Cursor with read-only access, through a sign-in you approve or
the official WordPress MCP Adapter.
#### Why site owners choose it
* **Free, with no account needed.** Install it and it works. No sign-up and no
usage tracking.
* **Set up in about 3 minutes.** The wizard asks what kind of site you run, checks
it, and shows every change before applying it. You can undo it all later.
* **Try before you enforce.** Test Mode shows what would have been blocked, without
blocking anyone.
* **Undo any change.** Recent changes lists your last ten saves; undo one in a
click. Turn on “Protect my changes” and a sensitive change that breaks your login
page or site is undone for you.
* **You can’t lock yourself out for good.** The wizard gives you an emergency link
that switches the plugin off from any browser, and one click adds your own address
to the “always allow” lists.
* **Act fast after a break-in.** Emergency Lockdown stops every plugin, theme and
WordPress change for a set time while you clean up, and you get an email when
any account is given administrator powers.
* **Ready for AI.** Find text written to trick AI agents (prompt injection), see
which AI bots crawl your site, and let AI apps read your security status without
letting them change anything.
#### Protect your login
**Two-factor login.** After the password, users confirm with a code sent by email
or shown in an authenticator app (Google Authenticator, Authy, Microsoft Authenticator
and similar). Choose which user roles need it. Works on the WordPress, WooCommerce
and Ultimate Member login forms. See at a glance on the Users screen who has two-
factor on. Changing two-factor settings asks for a code first, and you are warned
by email if someone keeps failing your two-factor check, because that means they
know your password.
**Stop password-guessing bots.**
* Lock out anyone who gets the password wrong too many times. Repeat offenders
wait longer each time.
* Permanently block addresses you never want to see again.
* An administrator can send a locked-out user a 15-minute recovery link, or let
users ask for an unlock link by email.
* Works behind Cloudflare automatically. Site Health tells you if your host’s setup
needs one extra step.
**Hide your login page.** Move `wp-login.php` to a private address so bots can’t
find it.
**Stronger passwords.**
* Set rules for length, letters, numbers and symbols, or pick a ready-made preset.
* Stop people reusing old passwords, and ask for a new one on first login or after
a set time.
* Reject passwords that have appeared in known data leaks. The check never sends
the password itself anywhere.
* Works with password managers: they are told your rules, so the passwords they
create are accepted, and the “Generate password” button follows your rules too.
**Control who stays signed in.**
* Limit how many devices one account can use at once.
* Sign people out automatically after a period of inactivity.
* See who is signed in right now, and end any session with one click.
#### Control apps, API keys and AI agents
More and more tools reach WordPress without a browser: apps signed in with application
passwords, the REST API and AI agents.
* **Application passwords.** See every key on the site, when it was last used,
and revoke it. Switch keys off for the whole site or for chosen roles.
* **Confirm risky actions.** Ask for the password again before someone installs
a plugin, makes a new administrator or creates a new key, so a stolen browser
session can’t do it.
* **API & Agent Access.** One page showing what each plugin exposes: REST routes,
public AJAX actions, scheduled tasks and AI agent tools.
* **Outbound connections.** See which outside servers your plugins contact through
WordPress.
#### AI security for your site
AI agents and AI search bots now read WordPress sites every day. Ultimate Security
helps you keep them safe and in check. Every AI feature is off until you turn it
on.
* **Prompt injection scan.** Finds hidden text written to trick AI agents into
doing something: instructions hidden from visitors, invisible characters and
links built to leak data. It checks posts, custom fields and page-builder content,
comments (pending ones too), menus, author profiles, categories, widgets and
the site title. Move a matching comment to the Trash or strip the hidden part
of a post after a preview, or open the item and edit it yourself. No AI needed,
and nothing leaves your site.
* **Weekly AI safety scan.** Optionally scans every week and emails you about new
high-risk finds.
* **AI tool check.** Flags AI tools from other plugins that can change your site
and are offered to every AI agent, or that skip their permission check.
* **AI crawler visits.** See which AI bots fetch your pages (GPTBot, ChatGPT-User,
OAI-SearchBot, ClaudeBot, Claude-SearchBot, PerplexityBot, Amazonbot, CCBot,
Bytespider, DuckAssistBot and others), when they last came and what they are
for, without Cloudflare. Block them with the Cloudflare firewall rules or robots.
txt.
* **Connect ChatGPT, Claude and Cursor safely.** Let them read your security status
through a sign-in you approve once on your site. Read only, and you can disconnect
each app at any time.
* **Claude, Cursor and VS Code.** Share read-only security tools and ready-made
prompts (“Run a security review”) with AI apps through the official WordPress
MCP Adapter.
* **Explain with AI.** On WordPress 7 and newer, an “Explain” button on Security
Fixes, Security Events and sensitive settings pages asks the AI provider you
set up in WordPress for a plain-language answer. Addresses, user names and your
login address are removed before anything is sent.
* **Ask your AI.** Copy a ready-made question about any security issue into ChatGPT,
Claude or any AI chat. No AI key needed.
#### Block spam and bots on your forms
Add Google reCAPTCHA or Cloudflare Turnstile to your login, registration, password
reset and comment forms, and to WooCommerce login, registration and checkout.
* Check that your keys work before going live.
* If the CAPTCHA service is down, your forms keep working.
* Won’t clash with another CAPTCHA plugin on the same form.
#### Find security problems before hackers do
**Vulnerability scanner.** Checks WordPress, your plugins and your themes against
a database of known security holes, and emails you when it finds one. It works without
an API key; WPScan or Patchstack keys add extra coverage. Holes that attackers are
known to use are marked and listed first.
* Runs on a schedule in the background.
* Flags plugins that haven’t been updated in a long time.
* Results show in the dashboard, Site Health and your plugins list.
**Security score.** One number that tells you how well protected your site is, which
fix to do next, and how it has changed over time.
**File check.** Compares your WordPress core files with the official copies, so
changed or added files stand out.
**See what is happening.** Security Fixes lists everything that needs attention,
most serious first, with fixes you can preview before they run. Security Events
shows recent sign-ins, failed sign-ins and lockouts. Troubleshoot checks the things
your protections rely on, including whether your server’s PHP has the latest security
fixes, and Security Baseline tells you when a setting changes. You get an email
when any account gains the power to install plugins, change settings or manage users,
or is signed in without the login form. You are also told when a plugin appears
or changes unexpectedly, or hides from your Plugins list. If you think someone got
in, Emergency Lockdown stops all plugin and theme changes for a set time while you
clean up, without taking your site offline. The Application Passwords and API &
Agent Access pages show which apps and AI tools can reach your site.
**Safer updates.** Choose when WordPress, plugins and themes update automatically.
Set update days and quiet periods, delay updates by a few days, and get an email
when something changes.
#### Advanced protection
**Cloudflare firewall rules.** If your site uses Cloudflare, connect your account
and turn on ready-made rules from wp-admin: let good bots through, block bad crawlers,
AI crawlers and risky traffic, and block attacks on known WordPress flaws before
you’ve had a chance to update. You can preview every rule before it goes live. New
block rules can start as a challenge for 24 hours, so you see their effect before
anyone is blocked.
**Security keys (salts).** Change the secret keys in `wp-config.php` on demand or
on a schedule, which signs everyone out and makes stolen login cookies useless.
You get a warning before a scheduled change, and can restore a previous set.
#### Test Mode
Turn on your protections without blocking anyone, and review a log of what would
have been blocked. Choose which user roles it covers. Visitors who aren’t signed
in are still held to the login limit, and Test Mode switches itself off after seven
days, so a forgotten test never leaves your site unprotected.
#### Moving from another plugin
* Import your two-factor and login settings from Wordfence Login Security. Preview
it first and undo it if you change your mind.
* Import your login limits and blocked usernames from Wordfence, Solid Security
or All In One WP Security, plus the hidden login address from the last two. You
see every change first, nothing is weakened, and one click undoes it.
* Copy your settings to another site, or keep a backup, as a file.
* Detects WooCommerce, Ultimate Member, page builders, form, caching and SEO plugins,
and warns you if another security plugin is already doing the same job.
#### Privacy
No usage tracking. The plugin contacts an outside service only when you switch on
a feature that needs one, and each is listed under External Services below.
#### For developers
```
wp ultimate-security template list
wp ultimate-security template apply [--dry-run]
wp ultimate-security template undo
wp ultimate-security export [--file=]
wp ultimate-security import [--dry-run]
wp ultimate-security status
wp ultimate-security unlock | --ip= | --all
wp ultimate-security 2fa status [--format=json]
wp ultimate-security 2fa disable
wp ultimate-security captcha off
wp ultimate-security login-url reset
wp ultimate-security agent summary | findings | events | actions | plan
wp ultimate-security agent preview [--args=]
```
AI tools: with “Share security findings with AI agents” on, read-only abilities (
security summary, findings, events, vulnerabilities, update status, login protection
status, fix previews) and three prompts appear in the WordPress Abilities API, so
the official MCP Adapter offers them to AI apps. REST: `/wp-json/ultimate-security/
v1/agent/*` for administrators.
#### Video guides
* [Set up an authenticator app](https://www.youtube.com/watch?v=2hu-4C4RsqE)
* [Two-factor login by email](https://www.youtube.com/watch?v=oXF1IWAISTc)
* [Hide your login page](https://www.youtube.com/watch?v=O-h6rVUPSw4)
* [Set strong password rules](https://www.youtube.com/watch?v=2mTDSrdpMI0)
* [Limit login sessions](https://www.youtube.com/watch?v=qGdDc_loPyM)
* [Manage plugin and theme updates](https://www.youtube.com/watch?v=mlT0zbGP_wc)
* [Change your security keys after a breach](https://www.youtube.com/watch?v=9m85pe8JX8Q)
* [Spot changed WordPress files](https://www.youtube.com/watch?v=dOzK9pDmEZI)
* [Understand Site Health reports](https://www.youtube.com/watch?v=7h7eMOUucVA)
* [Dashboard walkthrough](https://www.youtube.com/watch?v=8UaUn7rgh6g)
* [Move your Wordfence two-factor settings](https://www.youtube.com/watch?v=6sw8FNnbTPU)
#### Learn more
* [Website](https://www.wpultimatesecurity.com) — features and articles.
* [Documentation](https://docs.wpultimatesecurity.com/) — setup guides, troubleshooting
and how-tos.
* [YouTube](https://www.youtube.com/@wpultimatesecurity) — all video guides.
### External Services
This plugin connects to the following third-party services, and only when you use
the related feature:
#### Google reCAPTCHA
* When: reCAPTCHA protection is enabled. The reCAPTCHA script is then loaded in
your visitors’ browsers on the protected forms.
* Data sent: the visitor’s reCAPTCHA response token, your site secret key, and
the visitor’s IP address for verification.
* Endpoints: https://www.google.com/recaptcha/api.js (browser script, with a preconnect
to https://www.gstatic.com) and https://www.google.com/recaptcha/api/siteverify(
server-side verification).
* Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/
privacy
#### Cloudflare Turnstile
* When: Cloudflare Turnstile protection is enabled. The Turnstile script is then
loaded in your visitors’ browsers on the protected forms.
* Data sent: the visitor’s Turnstile response token, your site secret key, and
the visitor’s IP address for verification.
* Endpoints: https://challenges.cloudflare.com/turnstile/v0/api.js (browser script)
and https://challenges.cloudflare.com/turnstile/v0/siteverify (server-side verification).
* Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.
com/privacypolicy/
#### WPVulnerability
* When: the Vulnerability Scanner runs. This is the default vulnerability database
and requires no API key.
* Data sent: your WordPress version and the slugs of your installed plugins and
themes.
* Endpoint: https://www.wpvulnerability.net/
* Privacy: https://www.wpvulnerability.net/
#### WPScan
* When: the Vulnerability Scanner runs and you have configured a WPScan API key.
* Data sent: your WPScan API key, your WordPress version, and the slugs of your
installed plugins and themes.
* Endpoint: https://wpscan.com/api/v3/
* Terms: https://wpscan.com/terms-of-service/ — Privacy: https://wpscan.com/privacy-
policy/
#### Patchstack
* When: the Vulnerability Scanner runs and you have configured a Patchstack API
key.
* Data sent: your Patchstack API key, your WordPress version, and the slugs of
your installed plugins and themes.
* Endpoint: https://patchstack.com/database/api/v2/
* Terms: https://patchstack.com/terms-of-service/ — Privacy: https://patchstack.
com/privacy-policy/
#### CISA Known Exploited Vulnerabilities
* When: only when a vulnerability scan starts (scheduled or “Scan now”), at most
once a week. Your site downloads CISA’s public list of vulnerabilities that attackers
are known to use, so those can be marked and listed first.
* Data sent: nothing beyond a normal web request (GET) for that public file from
your site’s server. No site data is sent. Only the vulnerability IDs (CVE numbers)
are kept.
* Endpoint: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.
json
* Terms: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Privacy:
https://www.cisa.gov/privacy-policy
#### WordPress.org Plugin and Theme Information API
* When: the Vulnerability Scanner checks whether an extension has been abandoned,
and when the Update Manager gathers update information.
* Data sent: the slugs of your installed plugins and themes (no user data).
* Endpoints: https://api.wordpress.org/plugins/info/1.2/ and https://api.wordpress.
org/themes/info/1.2/
* Privacy: https://wordpress.org/about/privacy/
#### WordPress.org Core Version Check
* When: the Update Manager checks for available WordPress core updates.
* Data sent: a standard WordPress core version-check request (no user data).
* Endpoint: https://api.wordpress.org/core/version-check/1.7/
* Privacy: https://wordpress.org/about/privacy/
#### WordPress.org Core Checksums
* When: you run the WordPress core file-integrity check.
* Data sent: your WordPress version and locale, in order to retrieve the official
file checksums for comparison.
* Endpoint: https://api.wordpress.org/core/checksums/1.0/
* Privacy: https://wordpress.org/about/privacy/
#### WordPress.org Secret-Key (Salt) API
* When: you rotate WordPress security keys and salts, on demand or on a schedule.
* Data sent: a request for …
## Ảnh màn hình
[⌊The dashboard tells you in plain words how safe your site is and what to fix next.⌉⌊
The dashboard tells you in plain words how safe your site is and what to fix next
.⌉[
The dashboard tells you in plain words how safe your site is and what to fix next.
[⌊Answer a few questions and the setup wizard secures your site. You see every change
first and can undo it later.⌉⌊Answer a few questions and the setup wizard secures
your site. You see every change first and can undo it later.⌉[
Answer a few questions and the setup wizard secures your site. You see every change
first and can undo it later.
[⌊Stop bots that guess passwords. Repeat offenders are locked out for longer.⌉⌊Stop
bots that guess passwords. Repeat offenders are locked out for longer.⌉[
Stop bots that guess passwords. Repeat offenders are locked out for longer.
[⌊Test Mode shows what would have been blocked, without blocking anyone.⌉⌊Test Mode
shows what would have been blocked, without blocking anyone.⌉[
Test Mode shows what would have been blocked, without blocking anyone.
[⌊Add a second step to login with an email code or an authenticator app.⌉⌊Add a
second step to login with an email code or an authenticator app.⌉[
Add a second step to login with an email code or an authenticator app.
[⌊Hide your login page and require strong passwords.⌉⌊Hide your login page and require
strong passwords.⌉[
Hide your login page and require strong passwords.
[⌊Stop spam bots on your login, comment and WooCommerce forms with reCAPTCHA or
Cloudflare Turnstile.⌉⌊Stop spam bots on your login, comment and WooCommerce forms
with reCAPTCHA or Cloudflare Turnstile.⌉[
Stop spam bots on your login, comment and WooCommerce forms with reCAPTCHA or Cloudflare
Turnstile.
[⌊Find plugins, themes and WordPress versions with known security holes, automatically.⌉⌊
Find plugins, themes and WordPress versions with known security holes, automatically
.⌉[
Find plugins, themes and WordPress versions with known security holes, automatically.
[⌊Turn on ready-made Cloudflare firewall rules without writing any code.⌉⌊Turn on
ready-made Cloudflare firewall rules without writing any code.⌉[
Turn on ready-made Cloudflare firewall rules without writing any code.
[⌊See who is signed in right now and sign anyone out with one click.⌉⌊See who is
signed in right now and sign anyone out with one click.⌉[
See who is signed in right now and sign anyone out with one click.
[⌊Switch each feature on or off. Your site stays fast.⌉⌊Switch each feature on or
off. Your site stays fast.⌉[
Switch each feature on or off. Your site stays fast.
[⌊Bring your settings over from Wordfence Login Security, or copy them to another
site.⌉⌊Bring your settings over from Wordfence Login Security, or copy them to another
site.⌉[
Bring your settings over from Wordfence Login Security, or copy them to another
site.
## Cài đặt
**Requirements:** WordPress 5.6+ and PHP 7.1+. HTTPS is strongly recommended for
2FA and secure sessions.
#### Install from your dashboard
1. In WordPress, go to **Plugins Add New** and search for “wpultimatesecurity”.
2. Click **Install Now**, then **Activate**.
3. Follow the **Security Wizard** that appears — it scans your site, recommends settings,
and shows you every change before applying it.
#### Install manually
1. Download the plugin ZIP.
2. Go to **Plugins Add New Upload Plugin**, choose the ZIP, and click **Install
Now**.
3. Click **Activate**, then follow the Security Wizard.
Or with WP-CLI: `wp plugin install ultimate-security --activate`
#### Your first 3 minutes
1. Run the **Security Wizard** and apply the template that matches your site.
2. Save the **emergency link** the wizard shows you somewhere safe. It gets you back
in if you ever lock yourself out.
3. Turn on **two-factor login** for every administrator.
Then, when you have a minute: open **API & Agent Access AI agents** and run the**
AI safety** scan to check your content for text written to trick AI agents.
## Hỏi đáp
### I locked myself out. How do I get back in?
Open the **emergency link** the setup wizard gave you. It switches the plugin off
so you can log in and fix the setting. If you didn’t save it, ask your host to rename
the folder `/wp-content/plugins/ultimate-security`, or run `wp plugin deactivate
ultimate-security` over SSH.
### Will this slow down my site?
No. Checks run only when someone logs in or submits a form, not on every page view.
Scans run in the background on a schedule, in small batches. If you turn on AI crawler
visits, each page view adds one quick name check; storage is touched only when an
AI bot visits, at most once an hour per bot.
### Do I need any technical knowledge?
No. The setup wizard picks settings for your kind of site and shows every change
before applying it. You can undo all of it later.
### What is Test Mode?
A safe way to try your settings. Your protections run, but nobody is blocked; instead
you get a log of what would have been blocked. Once you are happy, switch it off
to enforce the rules. It turns itself off after seven days, so a forgotten test
never leaves your site unprotected.
### Can I undo what the wizard changed?
Yes. The wizard shows every change before applying it, and you can undo them all
later. Changes you made yourself afterwards are kept.
### Is it really free?
Yes. Everything described on this page is included, with no account, trial or time
limit.
### Do I need an API key for vulnerability scanning?
No. The scanner works straight away with the free WPVulnerability database. WPScan
and Patchstack keys are optional and only add extra coverage.
### Does it work with WooCommerce?
Yes. CAPTCHA can protect the WooCommerce login, registration, password reset and
checkout forms, two-factor login works on the WooCommerce login form, and the wizard
has a WooCommerce template.
### Do I need a Cloudflare account?
Only for the Cloudflare firewall rules. Every other feature works without one.
### I use Cloudflare or another CDN or proxy. Do I need to do anything?
For Cloudflare, no: it is recognised automatically. For any other proxy or load
balancer, add its address under Brute-force protection Trusted proxies. Until you
do, the plugin avoids locking out everyone at once, and Site Health tells you what
to add.
### CAPTCHA is blocking every login. How do I recover?
Add `define( 'ULTIMATE_SECURITY_DISABLE_CAPTCHA', true );` to `wp-config.php` to
switch CAPTCHA off, log in, re-enter your Site Key and Secret Key, then remove the
line. To turn off just one provider, use `ULTIMATE_SECURITY_DISABLE_TURNSTILE` or`
ULTIMATE_SECURITY_DISABLE_RECAPTCHA`. Over SSH, `wp ultimate-security captcha off`
does the same. Site Health warns you when a key stops working.
### Will it conflict with other security or CAPTCHA plugins?
It can if two plugins do the same job. Use one plugin per job (one for two-factor,
one for CAPTCHA, one for login limits) and switch the overlapping feature off in
the other. Ultimate Security warns you when it spots an overlap.
### I already use another security plugin. Can I bring my settings across?
You can import two-factor and login settings from Wordfence Login Security. You
see exactly what will come across first, and can undo the import afterwards.
### Does the custom login URL work with caching and CDNs?
Yes. Make sure your caching plugin doesn’t cache the login page; most skip login
and admin pages automatically.
### Does it work with Redis or Memcached?
Yes. Give the cache enough memory so it doesn’t drop entries early, or a lockout
can end sooner than you set.
### Does it work on WordPress Multisite?
It runs on Multisite, with settings per site. It has been tested less there than
on single sites, so try it on a staging network first.
### Can I check many sites at once?
Yes. On each site, create an application password for an administrator account you
use for monitoring. Then read `https://example.com/wp-json/ultimate-security/v1/
agent/summary` with it, or run `wp ultimate-security agent summary`. You get the
security score, open issues, versions and recent sign-in problems in one reply.
It is read-only, and the plugin sends nothing anywhere: your tool asks, the site
answers.
### Does the plugin track me or phone home?
No. There is no usage tracking. It contacts an outside service only when you use
a feature that needs one, and each is listed under External Services below.
### What does the plugin store about my visitors?
IP addresses and browser details are kept in the session log so you can review sign-
ins. Test Mode keeps its own log of what it would have blocked. If you turn on AI
crawler visits, only the bot’s name and the days it visited are kept, never an IP
address. Everything stays in your own database.
### Is it GDPR-friendly?
Your data stays on your own server. Outside calls are limited to the services listed
under External Services, and only for features you turn on. “Explain with AI” removes
addresses, user names and your login address before it sends anything to the AI
provider you chose.
### What happens to my data when I uninstall?
By default your settings are kept, in case you reinstall. To remove everything,
turn on “delete plugin data” in the plugin’s advanced settings before uninstalling.
### Can I connect ChatGPT or Claude?
Yes, if your site uses HTTPS and pretty permalinks and has the official WordPress
MCP Adapter plugin. Go to API & Agent Access, open “Connect AI apps”, turn on “Share
security findings with AI agents” and “Let AI apps sign in”, then follow the steps
shown there for ChatGPT or Claude. An administrator approves each app once on your
site. The app can only read security information; it cannot change anything. You
can revoke it on the same screen at any time. In ChatGPT, your plan must allow custom
apps (developer mode). Cursor can connect too after you choose “Allow Cursor” on
the same screen.
### How do I check my WordPress site for prompt injection?
Go to API & Agent Access, open the AI agents tab, turn on AI safety checks and click“
Scan content now”. Ultimate Security looks for hidden instructions, invisible characters
and data-leaking links in your content and comments, and shows each place it finds.
No AI service is used for the scan.
### How do I see which AI bots visit my site?
Turn on “Watch AI crawler visits” on the same AI agents tab. It lists the AI bots
that fetch your pages by the name they give, with the last visit and what each bot
is for. Pages served from a page cache or CDN do not reach WordPress, so those visits
are not counted.
### How do I block AI crawlers like GPTBot?
First, turn on “Watch AI crawler visits” to see which AI bots actually come. If
your site uses Cloudflare, turn on the ready-made AI crawler rule under Cloudflare
firewall rules and preview it before it goes live. Without Cloudflare, list the
bots you want to stop in your robots.txt file; well-behaved AI crawlers follow it.
### Can an AI agent change my site?
Not through Ultimate Security. AI apps you connect can only read your security information,
and fixes run only when a signed-in person clicks them. AI tools added by other
plugins are separate: the AI tool check warns you about any that can change your
site or skip their permission check.
### What is the WordPress MCP Adapter, and is it safe?
The MCP Adapter is the official WordPress plugin that lets AI apps such as Claude,
Cursor and VS Code use tools a site offers. Ultimate Security’s tools are read only
and stay off until you turn them on under API & Agent Access. You can see every
AI tool on your site, from any plugin, on the same page.
### Does the plugin send my site data to AI services?
Not unless you ask it to. The prompt injection scan and AI crawler visits work entirely
on your site. Only “Explain with AI” sends text to an AI provider, and only the
one you set up in WordPress, after you turn it on and click Explain. See External
Services below for exactly what is sent.
### How do I get support?
Ask in the plugin’s support forum on WordPress.org, or visit https://www.wpultimatesecurity.
com.
## Đánh giá
Không có đánh giá nào cho plugin này.
## Người đóng góp & Lập trình viên
“Ultimate Security – AI Security, 2FA, Login Protection & Vulnerability Scanner”
là mã nguồn mở. Những người sau đã đóng góp vào plugin này.
Những người đóng góp
* [ WP Ultimate Security ](https://profiles.wordpress.org/wpultimatesecurity/)
“Ultimate Security – AI Security, 2FA, Login Protection & Vulnerability Scanner”
đã được dịch qua 1 ngôn ngữ. Cảm ơn [những người tham gia dịch](https://translate.wordpress.org/projects/wp-plugins/ultimate-security/contributors)
vì đóng góp của họ.
[Dịch “Ultimate Security – AI Security, 2FA, Login Protection & Vulnerability Scanner” sang ngôn ngữ của bạn.](https://translate.wordpress.org/projects/wp-plugins/ultimate-security)
### Muốn tham gia phát triển?
[Duyệt code](https://plugins.trac.wordpress.org/browser/ultimate-security/), check
out [SVN repository](https://plugins.svn.wordpress.org/ultimate-security/), hoặc
theo dõi [nhật ký phát triển](https://plugins.trac.wordpress.org/log/ultimate-security/)
qua [RSS](https://plugins.trac.wordpress.org/log/ultimate-security/?limit=100&mode=stop_on_copy&format=rss).
## Nhật ký thay đổi
#### 1.2.0
* New: Emergency Lockdown. If you think someone has broken in, one switch stops
anyone from adding, updating or changing plugins, themes or WordPress itself,
for up to 7 days, while you clean up. Your site stays online. You need your password
to turn it off early.
* New: Privileged Account Watch. You get an email when any account is given administrator-
level powers, such as installing plugins or managing users. One page shows who
has these powers.
* New: you get an alert when someone is signed in as an administrator without using
the login page.
* New: Site Code Watch. You are told when a plugin is added in an unusual way,
changes without an update, or hides itself from your Plugins list. One page shows
everything installed on your site.
* New: the Troubleshoot page tells you if your server is missing an important security
update for PHP, the software your site runs on, and what to ask your web host.
* New: if you use Cloudflare, an optional rule blocks one known attack on that
PHP flaw before it reaches your site. Off until you turn it on.
* Improvement: if you use a Patchstack key, plugins that hackers are already attacking
are flagged and shown first.
* Improvement: the leaked-password check on the login page now safely handles extremely
long entries.
* Fix: the first vulnerability scan no longer gets stuck on “Finalizing”, and you
can retry a scan that stopped.
* Fix: vulnerability scans finish faster when WordPress.org is slow or cannot be
reached.
* Fix: on-screen notices are easier to read.
#### 1.1.0
* New: see how your security score changes over time.
* New: security holes that hackers are actively using are now flagged and shown
first, so you know what to fix today.
* New: undo button. Your last 10 settings changes are saved, and you can undo any
of them with one click.
* New: optional safety net. If a settings change breaks your site, the plugin can
put it back for you.
* New: switching from Wordfence, Solid Security or All In One WP Security? Bring
your login settings with you.
* New: a page that shows which other security plugins you have and where they do
the same job.
* New: locked out? Users can ask for an unlock email. And an “Add my IP” button
helps you never block yourself.
* New: try risky settings safely first with Test Mode, and try new firewall rules
for a day before they block anyone.
* New: connect ChatGPT, Claude or Cursor so they can answer questions about your
site’s security. Read only, off until you turn it on, and you can disconnect
any time.
* New: find hidden text on your site that tries to trick AI tools, and remove it
safely. Off until you turn it on.
* New: see which AI bots visit your site. Off until you turn it on.
* New: “Explain” and “Ask your AI” buttons turn security messages into plain language.
Private details are removed first.
* New: agencies using MainWP see more about each site, like the score trend and
serious security holes.
* Improvement: fewer false alarms on the Troubleshoot page.
* Improvement: admin pages load faster.
* Fix: a vulnerability scan no longer gets stuck.
* Fix: password confirmation works smoothly when you install or delete plugins
and themes, or create app passwords.
* Fix: lockouts are counted correctly in reports.
* Fix: turning off AI app sign-in always disconnects every app.
* Fix: AI tools get less private information, such as full IP addresses.
* Fix: a technical notice that some sites saw on WordPress 6.7 and later is gone.
#### Earlier versions
See the full history at https://wpultimatesecurity.com/changelog/
## Meta
* Phiên bản **1.2.0**
* Cập nhật lần cuối **2 ngày trước**
* Số lượt cài đặt **10+**
* Phiên bản WordPress ** 5.6 hoặc cao hơn **
* Đã kiểm tra lên đến **7.1.3**
* Phiên bản PHP ** 7.1 hoặc cao hơn **
* Ngôn ngữ
* [English (US)](https://wordpress.org/plugins/ultimate-security/) và [Lao](https://lo.wordpress.org/plugins/ultimate-security/).
* [Dịch sang ngôn ngữ của bạn](https://translate.wordpress.org/projects/wp-plugins/ultimate-security)
* Thẻ
* [AI Crawlers](https://vi.wordpress.org/plugins/tags/ai-crawlers/)[AI-Security](https://vi.wordpress.org/plugins/tags/ai-security/)
[login security](https://vi.wordpress.org/plugins/tags/login-security/)[security](https://vi.wordpress.org/plugins/tags/security/)
[two factor authentication](https://vi.wordpress.org/plugins/tags/two-factor-authentication/)
* [Nâng cao](https://vi.wordpress.org/plugins/ultimate-security/advanced/)
## Đánh giá
Chưa có đánh giá nào được gửi.
[Your review](https://wordpress.org/support/plugin/ultimate-security/reviews/#new-post)
[Xem tất cả đánh giá](https://wordpress.org/support/plugin/ultimate-security/reviews/)
## Những người đóng góp
* [ WP Ultimate Security ](https://profiles.wordpress.org/wpultimatesecurity/)
## Hỗ trợ
Có điều gì muốn nói? cần giúp đỡ?
[Xem diễn đàn hỗ trợ](https://wordpress.org/support/plugin/ultimate-security/)