Login security without a PHP firewall to babysit.
Limit login attempts with escalating lockouts, safelists and denylists, generic login errors, a login activity log, author-scan blocking and security headers. Two-factor login with authenticator apps and passkeys is built into the core.
Bundled with Presscomet · Replaces Wordfence, Solid Security, Limit Login Attempts Reloaded, Loginizer, Two Factor, WP 2FA, All In One WP Security
What it does, and what it doesn’t.
You get
- Lockouts that cover passwords, passkeys and two-factor codes
- IP safelist and denylist with wildcards and CIDR ranges, username denylist
- Login activity log and lockout email
- X-Frame-Options, nosniff, HSTS, Referrer-Policy
Not included
- No web application firewall (WAF)
- No malware scanner or file-change detection
- No country blocking or live traffic view
What a security plugin is protecting against
On WordPress, the big risks are brute-force logins, outdated plugins with known holes, and uploaded PHP that runs. Security plugins answer with login limits, firewalls that filter requests before WordPress runs, and scanners that look for changed files.
Presscomet doesn't run PHP at all. Its bundled plugins are part of the application, so they are updated together with it — there is no separate plugin to patch, and no plugin upload that can execute PHP. There is also no xmlrpc.php endpoint. What remains is the login form, which this plugin protects. For request filtering at the edge, put a CDN or WAF service in front of the site.
Presscomet Security compared
Feature by feature, including what isn’t there. Rows describe what the bundled plugin’s code does today.
| Feature | Wordfence | Limit Login Attempts Reloaded | Presscomet |
|---|---|---|---|
| Login attempt limiting & lockouts | Included: Yes | Included: Yes | Included: Yes, with long lockouts |
| IP allow / deny lists | Included: Yes | Included: Yes | Included: Yes, wildcards and CIDR |
| Two-factor login | Included: Yes | — | Included: Built into the core, plus passkeys |
| Login activity log | Included: Yes | Included: Yes | Included: Yes |
| Web application firewall | Included: Yes | Not included: No | Not included: Not included — use a CDN/WAF in front |
| Malware scanner | Included: Yes | Not included: No | Not included: Not included |
| Country blocking | Partly: Premium | — | Not included: Not included |
| Security headers | — | — | Included: X-Frame-Options, nosniff, HSTS, Referrer-Policy |
| XML-RPC attacks | Partly: Option to restrict it | — | Not needed: Not needed — there is no xmlrpc.php |
- Included
- Partly, or on a paid plan
- Not included
- Not needed, with the reason
Third-party features as publicly documented; premium tiers change.
What moves over automatically.
Lockout settings come over from Limit Login Attempts (Reloaded), Loginizer and Solid Security. Firewall rules from any plugin are not portable.
Imported
- Limit Login Attempts Reloaded: retries, lockout lengths, lockouts before a long lockout, reset time, safelist, denylist, username denylist, lockout email
limit_login_allowed_retrieslimit_login_lockout_durationlimit_login_whitelistlimit_login_blacklist_usernames - Loginizer: retries, lockout time, lockouts and extended lockout
loginizer_options - Solid Security: lockout period and safelist
itsec-storage - Two Factor plugin user settings, used as they are
_two_factor_*
Not imported
- Wordfence firewall rules, scan settings and blocklists
- WP 2FA enrolments — users set up their authenticator app again
- Old lockout and activity logs
- Security: imported login-limiting settings.
- Security: Two Factor plugin user settings (_two_factor_* usermeta) are used as-is by Presscomet's built-in two-factor login.
How switching works.
- 01
Check your site
Run the free site check to see which of your plugins Presscomet replaces and what needs attention.
- 02
Run the migration
Connect your WordPress site. Content, users, media and plugin settings are imported into a new Presscomet site; your live site is only read.
- 03
Review and switch
Open Settings → Security: Login Security, Hardening and Activity Log tabs to check the imported settings, then point your domain at the new site when you’re happy.
Where to find it: Settings → Security: Login Security, Hardening and Activity Log tabs.
Security: questions
Does Presscomet have a firewall like Wordfence?
No. There is no web application firewall or malware scanner. Presscomet doesn’t execute PHP, which removes the most common targets, and you can add request filtering with a CDN or WAF service in front of the site.
Is two-factor authentication included?
Yes. Authenticator-app codes with backup codes, and passkeys, are built into the core. Turn them on and require them per role under Settings → Passkeys & 2FA; failed codes count toward lockouts.
Can I lock myself out?
Add your IP address to the safelist. Safelisted addresses are never locked out.
Can I keep running Wordfence instead?
No. Presscomet doesn’t run PHP, so WordPress plugins can’t be installed. The bundled Security plugin does the job instead, and the migration imports the settings listed above.
Does Presscomet support WooCommerce?
Not today. Presscomet is for content sites — blogs, magazines, business and documentation sites. If your site sells through WooCommerce, it isn’t a fit yet.
Related plugins and next steps
Related
- BundledAntispamLocal comment and form spam checks — no API key, nothing sent to third parties — with statistics and scheduled clean-up.
- AlternativeWordfence alternativeNo WAF or scanner — and why that matters less without PHP. Login limits, 2FA, passkeys and headers built in.
- AlternativeLimit Login Attempts Reloaded alternativeRetries, lockouts and long lockouts, IP and username lists — Limit Login Attempts Reloaded and Loginizer settings imported.
- BundledBackupsDatabase and uploads backups on demand or on a schedule, with retention, download, upload and one-click restore.
Move your WordPress site in one go — content, users, media and plugin settings. Free and open source; your live site is only read.
Managed hosting with backupsAll 19 bundled plugins
Wordfence, Solid Security, Limit Login Attempts Reloaded, Loginizer, Two Factor, WP 2FA, All In One WP Security are trademarks of their respective owners. Presscomet is not affiliated with or endorsed by them. Names are used only to describe compatibility and migration.