Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Atlant Security is a free WordPress plugin with a broad collection of security, monitoring, and recovery features. Its WordPress.org listing describes an early-request web application firewall (WAF), login protections, malware scanning, two-factor authentication, hardening controls, and more. Those are documented features, not independent proof that the plugin blocks attacks effectively. Its WAF also runs after WordPress core and plugin files have loaded—not before WordPress starts—so it should not be mistaken for a server-level firewall.
What Atlant Security includes
WordPress.org describes Atlant Security as 17 integrated security modules organized across five layers: early-request filtering, application-aware controls, content and configuration hardening, outbound monitoring and data scanning, and response and recovery. The listing also cites 28+ WAF attack-pattern families, 38 malware signatures, and 12 emergency recovery actions. These are publisher-provided counts; they are not measures of attacks prevented or malware detected in independent testing.
Its listed features include:
- A WAF, rate limiting, and progressive login lockouts.
- Local file and database malware scanning, plus honeypots.
- Two-factor authentication, session controls, and security headers.
- REST API policies, cron monitoring, and AI crawler management.
- Outbound request monitoring, visitor and audit logs, and notifications.
- Hardening toggles and recovery actions.
For the current feature descriptions and changelog, consult the Atlant Security listing on WordPress.org.
Where its WAF runs—and what that means
The WordPress.org changelog corrects older “Pre-WordPress WAF” wording: Atlant Security inspects requests at WordPress init priority 0. Core and plugin files have already loaded, but the page has not yet been queried or rendered. “Early-request WordPress WAF” is therefore more accurate than “pre-WordPress” or “server-level firewall.”
Recommended Free Tools
#1 Best Overall
This distinction matters when deciding what protection a site needs. A plugin operating inside WordPress is not the same as filtering at the hosting server or network edge before WordPress loads. The listing documents Atlant Security’s application-level request timing; it does not establish comparative protection against host- or network-level controls.
Requirements and site compatibility
The WordPress.org listing specifies WordPress 6.0 or higher and PHP 8.0 or higher, and says the plugin is designed for single-site installations. Multisite support is described as planned, not currently supported. These details can change, so check the live plugin listing against your site’s WordPress and PHP versions before installing.
External connections depend on configuration
The publisher says core operation has no telemetry, but that does not mean every setup makes no external connections. The listing documents optional or conditional integrations that may contact third parties, depending on the features enabled:
- Cloudflare, Google, or Microsoft IP-range lists may be fetched.
- A GeoLite2 database may be downloaded from MaxMind when configured.
- WordPress.org APIs may be contacted for core checksums or key rotation.
- Alert content may be sent to a webhook configured by the administrator.
- reCAPTCHA or Cloudflare Turnstile resources may load when CAPTCHA protection is enabled.
Review the plugin’s integration settings and data-flow descriptions if external requests or data sharing are a concern. “No telemetry” should not be read as a guarantee of zero third-party traffic in every configuration.
Scanning and email caveats
The listing says malware scans run in AJAX batches and skip files larger than 5 MB. It recommends reducing the batch size if scans run slowly on shared hosting. If the host blocks WordPress’s default mail delivery, the listing advises using an SMTP plugin for email notifications.
Updates and configuration deserve attention
The WordPress.org changelog records a release described as fixing 14 critical and 12 high-severity findings from an external audit, followed by changes addressing login behavior, SSRF handling, session controls, malware-scanner false positives, and other features. The listing does not provide enough information to assess the audit’s scope or methodology independently, so this history is not a security assurance. It does make the changelog and timely updates important parts of using the plugin.
Release notes also describe changes to defaults: AI crawler controls were changed to allow legitimate vendor bots unless an operator opts in to blocking, and IP binding was turned off by default for new installations because changing addresses, VPNs, and mobile networks could cause repeated logouts. Review the available settings and their effects rather than enabling every control automatically.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What user reviews can—and cannot—tell you
WordPress.org reviews are individual testimonials, not controlled comparisons or independent security tests. In a review dated September 19, 2026, Julian Song called Atlant Security “one of the most complete free WordPress security plugins I have tried,” while adding that “it deserves careful configuration rather than switching everything on blindly.” That is useful user opinion about perceived breadth and setup, not evidence of effectiveness. A separate reviewer’s August 31, 2026 comment about seeking an alternative to Wordfence Free that was “not so heavy on the website” describes one person’s motivation, not a measured performance comparison. See the WordPress.org reviews for the original comments.
Who should consider it?
Atlant Security is worth evaluating if you want a free, single-site plugin whose listing brings together several security controls, monitoring functions, and recovery tools. Before relying on it, confirm compatibility, understand that its WAF runs within WordPress, review optional integrations, and decide which settings fit your site. The available documentation and reviews do not establish that it is lighter, more effective, or safer than competing plugins, and no independent benchmark or security-effectiveness figure is established here.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
