Skip to content
PluginCanary

Kadence Security - Password, Two Factor Authentication, and Brute Force Protection

by Nexcess · 700,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: Kadence Security - Password, Two Factor Authentication, and Brute Force Protection is maintained, has no open risk signals and no unpatched vulnerabilities.

82/ 100 Canary Score
Sub-scores for Kadence Security - Password, Two Factor Authentication, and Brute Force Protection
Ownership100
Maintenance100
Security90
Support25
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
chrisjean27 Jan 2015 to 15 Aug 2019, 72 commits
TimothyBlynJacobs6 Sep 2017 to 16 Jul 2025, 52 commits
jason_the_adams31 Oct 2023 to 2 Nov 2023, 8 commits
themerex15 Nov 2023 to 15 Nov 2023, 1 commits
shvv16 Sep 2025 to 12 May 2026, 11 commits
defunctlife28 May 2026 to 28 May 2026, 1 commits
stellarwp27 Jul 2026 to 14 Oct 2026, 4 commits

New committer stellarwp made a first commit on 27 Jul 2026. New committer defunctlife made a first commit on 28 May 2026.

Maintenance

Last release
20 days ago
Releases, 24 months
22
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for Kadence Security - Password, Two Factor Authentication, and Brute Force Protection
Q1 20243
Q2 20241
Q3 20240
Q4 20243
Q1 20251
Q2 20251
Q3 20254
Q4 20252
Q1 20264
Q2 20263
Q3 20263
Q4 20261

Last release 14 Oct 2026. Tested with WordPress 7.1 (current).

Support

25% of 12 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
20 Jun 2024Solid Security <= 9.3.1 - IP Address Spoofing to Denial of Service5.3<= 9.3.19.3.20
31 Oct 2023Solid Security Basic <= 9.0.0 - Unauthenticated Login Page Disclosure5.3<= 9.0.09.0.11
27 Mar 2023iThemes Security <= 8.1.4 - Open Redirection via redirect_to_https4.7<= 8.1.48.1.50
22 Apr 2021iThemes Security < 7.9.1 and iThemes Security Pro < 6.8.4 - Hidden Login Bypass5.3< 7.9.17.9.10
6 Jan 2021iThemes Security <= 7.6.1 - Broken Password Mechanism7.5<= 7.6.17.7.00
25 Jun 2018iThemes Security <= 7.0.2 - Authenticated SQL Injection7.2< 7.0.37.0.30
5 Mar 2018iThemes Security <= 6.9.0 - Cross-Site Scripting7.5<= 6.9.06.9.10
6 Oct 2016iThemes Security <= 5.6.1 - Stored Cross-Site Scripting6.4< 5.6.25.6.20
27 Sep 2016iThemes Security <= 5.6.1 - Sensitive Information Exposure via Diff Response5.3<= 5.6.15.6.21
25 Apr 2016iThemes Security <= 5.3.5 - Missing Capabilities Check7.4< 5.3.65.3.653
21 Apr 2016iThemes Security < 5.3.1 - Insecure Backup/Logfile Generation5.3< 5.3.15.3.157
5 Apr 2016iThemes Security < 5.3.5 - Authenticated Cross-Site Scripting3.3< 5.3.55.3.573
14 Apr 2015iThemes Security <= 4.6.12 - Stored Cross-Site Scripting6.5< 4.6.134.6.13430
1 Aug 2014Better WP Security <= 3.6.3 - Stored Cross-Site Scripting6.4<= 3.6.33.6.4411
1 Aug 2014Better WP Security <= 3.5.3 - Stored Cross-Site Scripting7.2<= 3.5.33.5.4411
1 Aug 2014iThemes Security < 3.6.4 - Stored Cross-Site Scripting8.3< 3.6.43.6.4411
20 Aug 2012iThemes Security < 3.4.4 - Cross-Site Scripting6.5< 3.4.43.4.41122
11 May 2012Better WP Security <= 3.2.4 - Multiple Cross-Site Scripting6.1<= 3.2.43.2.51223
11 May 2012iThemes Security < 3.2.5 - Cross-Site Scripting7.2< 3.2.53.2.51223

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for Kadence Security - Password, Two Factor Authentication, and Brute Force Protection
Q4 20245.0
Q1 20255.0
Q2 20255.0
Q3 20254.6
Q4 20253.7
Q1 20262.0
Q2 20261.0
Q3 20262.6

Average rating fell from 5.0 to 2.6 between Q4 2024 and Q3 2026.

Rating distribution
5 star3419
4 star177
3 star46
2 star61
1 star289
Latest low reviews

Momentum

700,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Kadence Security - Password, Two Factor Authentication, and Brute Force Protection
4 May 202610,549
11 May 2026360,542
18 May 202666,833
25 May 2026254,325
1 Jun 202664,823
8 Jun 202637,312
15 Jun 202628,490
22 Jun 202624,476
29 Jun 202622,938
6 Jul 202633,391
13 Jul 202618,760
20 Jul 202621,725
27 Jul 2026267,886
3 Aug 202665,880
10 Aug 202632,936
17 Aug 202627,743
24 Aug 202626,307
31 Aug 202622,559
7 Sep 202618,112
14 Sep 2026260,727
21 Sep 202666,054
28 Sep 2026256,463
5 Oct 202673,675
12 Oct 2026249,755
19 Oct 202675,188
26 Oct 202656,258
2 Nov 20266,879

Weekly downloads over the last 4 weeks are 7% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

IP Location BlockScore 96 · 10,000+Wordfence Security - Firewall, Malware Scan, and Login SecurityScore 94 · 5,000,000+Sucuri Security - Auditing, Malware Scanner and Security HardeningScore 93 · 600,000+WP Content Copy Protection & No Right ClickScore 93 · 100,000+NinjaFirewall (WP Edition) - Advanced Security Plugin and FirewallScore 93 · 100,000+

Facts

Version10.0.6
AuthorNexcess
Added23 Oct 2010
Last updated14 Oct 2026
Active installs700,000+
Requires WordPress6.5
Tested up to7.1.4
Requires PHP7.4
CategorySecurity & Privacy > Security Scanning & Malware Protection
Tagsmalware, security, password protection, brute force protection, two factor authentication

Other plugins by this author: Kadence Blocks - Page Builder Toolkit for Gutenberg Editor, The Events Calendar, Kadence Starter Templates - Predesigned Website Templates, GiveWP - Donation Plugin and Fundraising Platform, Image Widget, Event Tickets and Registration, Kadence WooCommerce Email Designer, Virtue/Ascend/Pinnacle Toolkit, Kadence Central - Site Management, Backups, Security, and Reporting, Membership Plugin - Kadence Memberships, GiveWP Donation Widgets for Elementor, Advanced Post Manager

Questions

Is Kadence Security - Password, Two Factor Authentication, and Brute Force Protection still maintained?

Kadence Security - Password, Two Factor Authentication, and Brute Force Protection was last updated on 14 Oct 2026. Its Canary status is Healthy.

Is Kadence Security - Password, Two Factor Authentication, and Brute Force Protection safe?

Kadence Security - Password, Two Factor Authentication, and Brute Force Protection has no open unpatched vulnerabilities on record. 0 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns Kadence Security - Password, Two Factor Authentication, and Brute Force Protection?

The wordpress.org author is Nexcess. Recent committers: stellarwp, defunctlife, shvv, TimothyBlynJacobs, themerex. New committer stellarwp made a first commit on 27 Jul 2026.

What can I use instead of Kadence Security - Password, Two Factor Authentication, and Brute Force Protection?

Plugins in the same category with a higher Canary Score: IP Location Block, Wordfence Security - Firewall, Malware Scan, and Login Security, Sucuri Security - Auditing, Malware Scanner and Security Hardening, WP Content Copy Protection & No Right Click, NinjaFirewall (WP Edition) - Advanced Security Plugin and Firewall.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue