Secupress Pro v2.7.2 - WordPress Security Plugin
Developer: Julio PotierCategory: WordPress PluginsTrusted with 162 downloadsGeek5 favoritesLatest v2.7.2Updated today
Like many Security Plugins, SecuPress has a bunch of awesome features.
Related items
Related Security Plugins
Complianz Premium - GDPR/CCPA Cookie Consent
by Real Big Plugins
Complianz is a GDPR/CCPA Cookie Consent plugin that supports GDPR, DSGVO, LGPD, POPIA, APA, RGPD, CCPA and PIPEDA with a conditional Cookie Notice and customized Cookie Policy based on the results...
ReCaptcha For WooCommerce - WordPress Plugin
by Woo
Security is the most important concern nowadays for any website or an eCommerce store.
Wordfence Premium - WordPress Security Plugin
by Defiant Inc
Wordfence Premium is for self-administered websites that are looking for the ultimate protection against the latest exploits including real-time firewall rules and malware signature, a continuously...
Like many Security Plugins, SecuPress has a bunch of awesome features. But it’s not only about features, it’s also about performance, loading speed, memory usage. And less technically the confort of using a well done plugin with a beautiful user interface and an great user experience counts. Then, we have in mind to secure a large number of websites, you can be part of this. The most important for us is that you have a secured website, using SecuPress or not.
Recent releases
Release history
Oct 21, 20267.1 MB
Other
- 19 Oct 2026
- Critical: Warn admins so they can check the backdoor and patch it.
- Removal: Ban Non-Existent Users Feature. Unknown identifiers are no longer blocked on the first try. Use Limit Login Attempts now.
Added
- Passwordless login now uses a 6-digit code instead of a magic link.
- Disable Application Passwords: refuse and log any Application Password authentication attempt.
- Move Login scanner checks whether the default login page is still reachable.
- Dashboard attacks widget lists attack types, trends and blocked IPs.
- Reading a WordPress option known as malware is logged as an "option" attack.
- Disallowed usernames are also refused as display names.
Improved
- A magic-code request for an unknown identifier shows the same form as a real account.
- Bad login attempts now count unknown identifiers the same way as real accounts.
- Enhance login error handling and disclosures in Login Errors Disclose feature.
- Learning Mode can review common page slugs (demo, beta, etc.) instead of treating them as critical.
- Backup folder can be set with the SECUPRESS_BACKUPS_PATH constant or the secupress.backups.path filter.
- Activating Bad URL Access now also enables Bad File Extensions (and the reverse on deactivation).
- Pro update checks also run outside wp-admin, so new versions are visible everywhere.
- Security Status shows the firewall state, blocked attacks and daily trends.
- Application Password usage can trigger a critical alert.
- Anti-spam obfuscates email addresses in front-end content.
- Remove the ssl_verify false from EDD class.
- Better detection of fake WP filename and fake WP option name.
- Allowed IPs from different providers (meta, google, rocket)
Fixed
- Escape sessions values late in Sessions Control feature, even if sanitized by WP first
- A double notice when you have 3 (??) security plugins active was visible
- Invisible login form when redirected from a Move Login page
- Better feedback message to differenciate whenever out server it out or your licence key is incorrect
- PHP Fatal error from JetFpack setting set_current_screen() during a REST Call
- Better JS selector for "Show all plugins" feature to prevent some other plugins popups to show too early.
- Security rules are no longer written when a previous SecuPress marker block has no closing marker, which could leave .htaccess or wp-config incomplete.
- Async scans are not queued twice, and their delay is applied correctly.
- Stop User Enumeration feature was blocking Editors to create or edit posts and pages.
- Fatal error in the dashboard attacks widget (wrong count passed to _nx, seen with Divi).
- File monitoring no longer reports the whole WordPress core as missing when the filetree is incomplete.
v2.7.1Verified Safe
Sep 25, 20267.1 MB
View changelog
Other
- 25 Sep 2026
- Security Fix: Directory traversal in the class file loader (administrators).
Added
- Firewall Learning Mode for 8G (observe signatures, review hits, allow globally or per URL prefix, auto-calibrate).
Improved
- WAF revamp: 8G signatures are now optional per filter, with local exceptions.
- Block Bad Referers is now available in Free.
- Hide WP, WooCommerce and PHP session cookies from the Support ID.
- Malware scanner still lists malware files when WP core checksums are missing, and matches "file" signatures on the filename.
- Deactivating a wp-config module no longer leaves the file or the setting in a bad state.
- Anti-spam comment delay now finds the comment form via the WordPress core field, so custom theme form IDs no longer break the timer.
Fixed
- Mixed content replacement now handles namespaced XML/SVG.
- Authors and other lower roles could not edit or create content with Stop User Enumeration.
- Apache bad URL access rules were missing the "-" substitution, so flags were ignored.
- "Expired license" displayed incorrectly on the dashboard widget.
- PHP warning when headers are already sent.
- Undefined variable notice in the System Status widget.
- reset() call on the pointers tour steps.
v2.7Verified Safe
Sep 15, 20263.4 MB
View changelog
Other
- 12 Sep 2026
- Security Fix: Unauthenticated Authentication Bypass via 'secupress_auto_login_token' Parameter.
- Security Fix: Possible RCE when writing constants into wp-config.php.
- Security Fix: SQL Injection by administrators when deleting logs.
Added
- Pause the security for 30 minutes (settings kept, auto-resume, email warning).
- Dashboard widget "System Status".
- Alerts when an application password is added to an account.
- Expert settings for Anti Hotlink (allowed referers, redirection type, webp/avif/svg).
- Password protection for backup ZIP files.
Improved
- Application Passwords alerts are no longer enabled by default.
- Firewall updated to 8G (query, URI, host, cookie, user-agent, referer).
- Store backups outside the web root when possible.
- Strong passwords are now enforced on the password reset form. PasswordLess users cannot reset.
- Export/import restricted to configuration keys only (no logs, transients, scans, or banned IPs).
- HTTPS redirection now generates IIS rules.
- Compatibility fallbacks when the mbstring PHP extension is missing.
- Hide sensitive COOKIE values in block reports.
- Self-unban emails no longer leak whether an address exists.
- Updated forbidden file extensions list.
Fixed
- Rewrite rules and current URL for subdirectory, subdomain, siteurl and own-directory installs (readme.html, changelogs, bad URL/file access, Move Login).
- User enumeration via REST routes, language URL prefixes like /fr/, and ?_embed=.
- Possible PasswordLess bypass after last fix from Protect User Creation.
- (again) Possible fatal error "Call to undefined method ::is_processing()" if WooCommerce loads an older async lib (file monitoring, bad plugins, bad themes).
- Bad themes deactivation hooks.
- Unlock admin callback used a wrong message.
- A plugin returning to the repository was still listed as closed/old.
- Fake Google Bots filter.
- Wrong return type in rewrite bases helper.
- String/array issue in the database malware scan.
- Safely remove the PasswordLess option and fix the affected role check.
Frequently asked questions
Is Secupress Pro GPL licensed?
Yes, Secupress Pro is distributed under the GNU General Public License (GPL). You can legally use, modify, and redistribute it on unlimited websites.
What is the latest version of Secupress Pro?
The latest version of Secupress Pro on GPLCoffee is v2.7.2 (released Oct 21, 2026, 7.1 MB download size). Every new release is synced automatically, and subscribers can update directly from their WordPress dashboard with the one-click connector plugin.
How much does Secupress Pro cost on GPLCoffee?
Secupress Pro is available for $8.99 for a 1-year license or $22.99 for a lifetime license. Membership plans also include credit-based access so you can download Secupress Pro along with thousands of other plugins, themes, and PHP scripts for a single subscription.
Which WordPress and PHP versions does Secupress Pro support?
The current release of Secupress Pro requires WordPress 5.5 or higher, tested up to WordPress 7.1.3, PHP 7.3 or higher. Per-release compatibility details are listed in the version history.
Is Secupress Pro safe to download?
Yes. The latest release of Secupress Pro (v2.7.2) was scanned with VirusTotal and came back clean. Scan results are visible on each version page, and releases flagged as malicious are blocked from the catalog.
Auto-updates included
Install it once, update automatically.
The GPLC Connector installs this plugin from your wp-admin and rolls out new versions to your connected sites. Included with every membership plan: 10 to 40 connected sites depending on the plan (Lite 10, Pro 20, Geek and Lifetime 40).