What is Blink Twice Security WP?

It is a WordPress security plugin that combines malware scanning, firewall protection, hardening, cleanup, quarantine, backups, safe migration, anti-spam, 2FA and monitoring in one dashboard.

Is the free plan real?

Yes. Free includes malware scanning, Hard Shield audit, basic WAF, honeypot anti-spam, SSL watcher, vulnerability checks, file change monitoring, threat feed and one lifetime cleanup.

Does it replace other security plugins?

It can be your main WordPress security plugin when the feature set matches your needs. We recommend avoiding several heavy security plugins that scan and block the same requests at the same time.

Freelancers, agencies, WooCommerce stores and serious site owners who need a clear security workflow, not just alerts.

Can I edit the website content?

Yes. Use Appearance, then Blink Twice Settings to edit the hero copy, CTA links, contact emails, default mode and waitlist. Use Customize, then Site Identity to change the logo.

Documentation, Blink Twice Security WP

Installation

Install Blink Twice Security WP from your WordPress dashboard or upload the ZIP manually.

In wp-admin, go to Plugins, then Add New, then Upload Plugin.
Select the ZIP file from your purchase or download page.
Click Install Now, then Activate.
Open Blink Twice in the sidebar and run your first scan.

Requires WordPress 5.9+ and PHP 7.4+.

Plans and licenses

Every license is annual. Solo covers one site, Pro covers five sites, Agency covers 25 sites and Agency Scale covers 100 sites.

Free: scanner, Hard Shield audit, basic WAF, anti-spam, SSL watcher and one lifetime cleanup.
Solo: full paid toolkit for one serious WordPress site.
Pro: the same paid toolkit for five client or agency-managed sites.
Agency: adds white-label, branded reports, API, fleet view and WooGuard when the agency tier launches.

Malware scanner

The scanner checks database content, uploads, plugin files, theme files and admin users against known signatures and suspicious patterns.

Findings are grouped with severity, confidence and evidence so an agency can triage before touching production files.

Web Application Firewall

The WAF inspects requests for common SQL injection, XSS, file inclusion, traversal and noisy automated attacks. It is designed as practical protection for WordPress sites without turning the admin into a maze.

Hard Shield hardening

Hard Shield audits more than 60 posture checks and turns them into a clear A to F grade.

Directory listing and sensitive file exposure
REST API and XML-RPC controls
Security headers and login limits
Readme, wp-config and plugin guard checks

Cleanup workflow

Cleanup is built around safety. Removed files go to quarantine and database or admin-user actions are presented as clear recovery steps.

Free includes one lifetime cleanup. Paid plans unlock unlimited cleanups and bulk actions.

Backups and remote storage

Schedule database and uploads backups, configure retention and push backups to S3 compatible storage such as AWS S3, Backblaze B2, Cloudflare R2, Wasabi or DigitalOcean Spaces.

Safe migration

Clean migration exports a full site into a verified .btswp archive and scans the archive before restore. That means a hacked site can be moved with a security check in the migration flow.

Monitoring and AI analysis

Daily vulnerability checks, SSL expiry alerts, file change monitoring, uptime self-pings and optional AI code analysis help you catch issues before a client forwards a scary email.

AI analysis is bring-your-own-key with OpenAI, Anthropic or Google Gemini.

Troubleshooting

License will not activate

Check that your server can reach Freemius and that the license still has an available activation.

Scans feel slow

The first scan builds a baseline. Later scans should be faster because unchanged files can be skipped.

Emails do not send

Configure SMTP for WordPress. Security alerts depend on the same mail system as the rest of the site.

Everything you need to secure your WordPress site.