Login protection and account controls
AIOS provides controls for common account risks, from brute-force attempts to unattended sessions.
- Two-factor authentication: Require an additional authentication step for selected user roles.
- Login attempts and lockouts: Set the number of failed attempts allowed and how long users are locked out; this helps limit repeated guessing.
- Username checks: Identify default “admin” usernames and matching login and display names, then follow the plugin’s guidance to address them.
- Enumeration protection: Block unauthorised requests to URLs that could reveal usernames or other details.
- Sessions and registrations: Automatically log users out after a set period, manage active sessions, and manually approve new registrations.
- Salt rotation: Add characters to WordPress salts and rotate them weekly, an extra measure for sites seeking stronger password protection.
Firewall rules for common attack paths
AIOS uses both .htaccess and PHP firewall rules to restrict access and block common attack paths.
The .htaccess rules can protect wp-config.php, .htaccess and debug.log, limit upload sizes, disable server signatures, and prevent directory listings. These controls suit administrators who want to reduce exposure of sensitive files and server details.
PHP rules address risks involving XML-RPC, RSS and Atom feeds, and cross-site scripting. AIOS also includes 6G firewall rules, blocks fake Google bots, and can reject bot POST requests when user-agent and referrer fields are blank.
File, database, spam and activity monitoring
Beyond login and firewall controls, AIOS includes tools to review site changes and reduce unwanted access or traffic.
- File security: Scan and fix insecure permissions, disable dashboard-based PHP file editing, restrict access to sensitive files, and receive file-change alerts with exclusions for normal changes.
- Image and database controls: Prevent image hotlinking, change the database prefix, and run database backups through UpdraftPlus.
- Spam blocking: Block bot comments and monitor spam IP addresses, with configurable thresholds for blocking.
- Audit log: Track plugin and theme additions, removals, and updates, helping administrators review site changes.
What AIOS Premium adds to the free security tools
The free version includes firewall and login protections, while Premium adds scanning, monitoring, and further blocking options.
Premium includes malware scanning, response-time and uptime monitoring with notifications of issues within 24 hours, country blocking, Smart 404 Error Blocking, Advanced Two Factor Authentication, and email ticket support. The stated starting price is $70 per year, so sites needing these additional safeguards or ticketed help should weigh that cost against their needs.
Broad security coverage with support-resolution limits to weigh
AIOS combines a wide range of documented protections with recent maintenance, though its support figures are worth considering.
It is among the most widely installed plugins in the directory and has an excellent user rating. It was updated within the last week, an encouraging sign for a security tool that benefits from regular maintenance. The breadth of controls may suit site owners who want several protections managed in one plugin.
The support record shows 20 threads, with 45% resolved. Free support is provided through the WordPress.org forum, while Premium customers can submit email tickets. If your site depends on prompt help, consider whether forum support and this resolution record meet your needs before choosing the free version.
