Skip to content
PluginCanary

All-In-One Security (AIOS)

All-In-One Security (AIOS) - Security and Firewall
by David Anderson / Team Updraft · 1,000,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 30 Oct 2026, 19 releases in 24 months, no unpatched vulnerabilities.

88/ 100 Canary Score
Sub-scores for All-In-One Security (AIOS)
Ownership100
Maintenance100
Security85
Support63
Reputation85

How the score works

Quick answers

Is All-In-One Security (AIOS) still maintained?
Yes. Last release 30 Oct 2026, 19 releases in the last 24 months. 30 Oct 2026 · wordpress.org
Who owns All-In-One Security (AIOS), and has it changed hands?
No change recorded. Main committer DavidAnderson since Jan 2022. 4 Nov 2026 · SVN log
Was All-In-One Security (AIOS) removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is All-In-One Security (AIOS) safe?
28 known vulnerabilities, all fixed (latest in 5.4.9). Not on the exploited list. 24 Sep 2026 · Wordfence Intelligence
Is the latest All-In-One Security (AIOS) update safe to install?
No ownership change before 5.5.1. No one-star spike after it. 30 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
mra133 Jun 2013 to 20 Jul 2021, 202 commits
wpsolutions19 Oct 2018 to 23 May 2019, 19 commits
DavidAnderson22 Jan 2022 to 30 Oct 2026, 81 commits

3 committers recorded. No ownership change since 2013.

Maintenance

Last release
5 days ago
Releases, 24 months
19
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for All-In-One Security (AIOS)
Q1 20244
Q2 20242
Q3 20242
Q4 20245
Q1 20253
Q2 20251
Q3 20252
Q4 20251
Q1 20262
Q2 20263
Q3 20261
Q4 20262

Last release 30 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 5.0 (9 reviews). Lifetime: 4.7.

Average rating per quarter for All-In-One Security (AIOS)
Q1 20265.0
Q2 20264.4
Q3 20264.8
Q4 20265.0

Average rating stayed at 5.0 between Q1 2026 and Q4 2026.

Rating distribution
5 star1557
4 star53
3 star22
2 star15
1 star73
Latest low reviews

Security record

2 vulnerabilities in 24 months (28 on record), all patched (latest fixed in 5.4.9).

Show 28 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
24 Sep 2026All-In-One Security (AIOS) - Security and Firewall <= 5.4.8 - Authenticated (Subscriber+) Security Control Bypass6.3<= 5.4.85.4.9Patched before disclosure
5 Jun 2026All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path7.2<= 5.4.75.4.8Patched before disclosure
8 Feb 2024All In One WP Security <= 5.2.6 - Cross-Site Request Forgery to IP Blocking4.3<= 5.2.65.2.7Patched before disclosure
6 Feb 2024All-In-One Security (AIOS) - Security and Firewall <= 5.2.5 - Reflected Cross-Site Scripting6.1<= 5.2.55.2.6Patched before disclosure
25 Oct 2023All In One WP Security <= 5.2.4 - Protection Bypass of Renamed Login Page via URL Encoding5.3< 5.2.55.2.5Patched before disclosure
11 Jul 2023All In One WP Security 5.1.9 - Plaintext Storage of Credentials5.95.1.95.2.0Patched before disclosure
20 Mar 2023All-In-One Security (AIOS) <= 5.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 5.1.45.1.5Patched before disclosure
14 Feb 2023All-In-One Security (AIOS) <= 5.1.4 - Authenticated(Admin+) Directory Traversal4.9<= 5.1.45.1.51
9 Dec 2022All-In-One Security <= 5.1.2 - Information Disclosure5.3<= 5.1.25.1.31
22 Nov 2022All In One WP Security & Firewall <= 5.1.0 - Cross-Site Request Forgery8.8<= 5.1.05.1.1Patched before disclosure
21 Nov 2022All-In-One Security (AIOS) - Security and Firewall <= 5.0.8 - IP Spoofing to Protection Mechanism Bypass6.5<= 5.0.75.0.8Patched before disclosure
17 Nov 2022All In One WP Security & Firewall <= 5.1.0 - Cross-Site Request Forgery8.8<= 5.1.05.1.11
30 Sep 2022All In One WP Security & Firewall 5.0.0 - 5.0.7 - Protection Bypass via IP Spoofing6.55.0.0 to 5.0.75.0.8Patched before disclosure
11 Apr 2022All In One WP Security & Firewall <= 4.4.10 - Open Redirect and Reflected Cross-Site Scripting6.1< 4.4.114.4.11Patched before disclosure
24 Dec 2020All In One WP Security & Firewall <= 4.4.5 - Cross-Site Scripting6.1< 4.4.64.4.6n/a
8 Sep 2020All In One WP Security & Firewall <= 4.4.3 - Reflected Cross-Site Scripting4.7<= 4.4.34.4.492
14 Aug 2019All In One WP Security & Firewall <= 4.0.8 - SQL Injection9.8< 4.0.94.0.9Patched before disclosure
11 Nov 2016All In One WP Security & Firewall <= 4.1.9 - Reflected Cross-Site Scripting6.1< 4.2.04.2.0n/a
31 Jul 2016All In One WP Security & Firewall <= 4.1.2 - Captcha Bypass5.3<= 4.1.24.1.3n/a
6 Apr 2016All In One WP Security & Firewall <= 4.0.6 - SQL Injection9.8< 4.0.74.0.722
23 Feb 2016All In One WP Security & Firewall <= 4.0.5 - Cross-Site Scripting6.1< 4.0.64.0.6n/a
22 Feb 2016All In One WP Security & Firewall <= 4.0.4 - Cross-Site Scripting6.1< 4.0.54.0.5n/a
15 Aug 2015All In One WP Security & Firewall <= 3.9.7 - Cross-Site Scripting6.1< 3.9.83.9.8n/a
20 Apr 2015All In One WP Security & Firewall <= 3.9.4 - Reflected Cross-Site Scripting6.1< 3.9.53.9.530
6 Apr 2015All In One WP Security & Firewall <= 3.9.0 - SQL Injection9.8< 3.9.13.9.1n/a

Changelog mentions of security fixes: 5.4.8 (security, vulnerability, XSS, escaping); 5.4.10 (security); 5.5.0 (security, nonce, escaping).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

63% of 24 support threads resolved in the last 2 months.

Momentum

1,000,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for All-In-One Security (AIOS)
4 May 202619,437
11 May 202652,394
18 May 202660,238
25 May 202642,146
1 Jun 2026646,202
8 Jun 202696,310
15 Jun 202660,086
22 Jun 202645,865
29 Jun 202644,552
6 Jul 202647,750
13 Jul 202634,591
20 Jul 202638,278
27 Jul 202633,444
3 Aug 202630,954
10 Aug 202626,460
17 Aug 202625,779
24 Aug 202625,758
31 Aug 202624,076
7 Sep 202622,593
14 Sep 2026362,961
21 Sep 202697,084
28 Sep 202664,244
5 Oct 202651,295
12 Oct 202642,246
19 Oct 202669,649
26 Oct 2026719,414
2 Nov 202632,994

Weekly downloads over the last 4 weeks are 107% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Disable WP REST APIScore 100 · 30,000+AntiVirusScore 100 · 30,000+Protect UploadsScore 100 · 30,000+CloudSecure WP SecurityScore 98 · 100,000+WP fail2banScore 98 · 60,000+

Facts

Version5.5.1
AuthorDavid Anderson / Team Updraft
Added3 Jun 2013
Last updated30 Oct 2026
Active installs1,000,000+
Requires WordPress5.3
Tested up to7.1.4
Requires PHP7.4
CategorySecurity & Privacy > Security Scanning & Malware Protection
Tagsfirewall, security, login security, Malware Scanning, two factor authentication

Other plugins by this author: UpdraftPlus: WP Backup & Migration Plugin, WP-Optimize - Cache, Compress images, Minify & Clean database to boost page speed & performance, Redux Framework, Easy Updates Manager, Internal Link Juicer: SEO Auto Linker for WordPress, Two Factor Authentication, WPGet API - Connect to any external REST API, Upload Larger Plugins, UpdraftCentral Dashboard, Testimonial Slider, European VAT Compliance Assistant for WooCommerce, Use Administrator Password

Questions

Is All-In-One Security (AIOS) still maintained?

Yes. Last release 30 Oct 2026, 19 releases in the last 24 months.

Who owns All-In-One Security (AIOS), and has it changed hands?

No change recorded. Main committer DavidAnderson since Jan 2022.

Was All-In-One Security (AIOS) removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is All-In-One Security (AIOS) safe?

28 known vulnerabilities, all fixed (latest in 5.4.9). Not on the exploited list.

Is the latest All-In-One Security (AIOS) update safe to install?

No ownership change before 5.5.1. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue