All-In-One Security vs. Kakapo Security: Points or Proof?

All-In-One Security is a popular free security plugin with a points system: every measure you switch on raises the security score. That's motivating — and it tempts you to flip toggles whose effect you don't know.

The short answer

AIOS covers login protection, hardening, a simple firewall, and file changes, and it's free and easy to get into. The score makes progress visible but says nothing about how much each measure actually achieves.

Kakapo Security does without a score and relies on transparency: 40 firewall patterns and 22 scan patterns are in the shipped source code, along with a list of approaches that, when measured, produced too many false positives. The activity log is chained and computed against a value from wp-config.php.

Where the two differ

Why no score

A score assumes that measures can be added up. They can't: timely updates and a second factor together achieve more than a dozen small hardening toggles — but in a points system, they count the same.

The second effect is worse: if you optimize for 100 points, you'll also switch on things that have side effects on your site. A toggle that earns one point and breaks the page builder is a bad deal.

If you use a tool with a score: don't switch on anything whose effect you can't explain in one sentence. The score isn't the goal.

When All-In-One Security is the better choice

• You want to start for free
• You like a guided setup with visible progress
• You only need login protection and basic hardening

When Kakapo Security is the better choice

• You want to be able to read what it scans for
• You need a log that shows whether it was changed after the fact
• Nothing should go to a security service
• You look after multiple sites under one license

Switching: what to do

1. Write down the custom login URL, if one is set — otherwise you'll lock yourself out.
2. Check which rules were written to .htaccess; security plugins like to leave blocks behind there.
3. Install Kakapo Security and enter your license key.
4. Set the firewall to “Monitor” first and let it run alongside for a week.
5. Take a baseline of the files while the site is verifiably clean.
6. Switch off the old plugin, then switch to “Block”.

What neither of them replaces

A security plugin is one layer, not the roof. Three things remain your job, and in practice they prevent more incidents than any firewall setting.

• Updates. The vast majority of successful break-ins exploit vulnerabilities for which an update had long been available.
• Backups. They're the only thing that counts after an incident — and the only thing that also helps when you weren't attacked at all but simply broke something yourself.
• Cleaned-up accounts. Every account nobody needs anymore is a door nobody is watching anymore.

These three cost no money and require no special knowledge. If you have them in place, a security plugin adds a lot. If you don't, what a plugin mostly buys you is a better feeling.

Where Kakapo Security deliberately does nothing

So that your expectations are right, here are the limits in plain terms: two-factor login sends its codes by email; authenticator apps aren't supported. There's no maintained signature database for malicious code — the scan looks for patterns, not for known malware by name. And while the vulnerability check accepts the URL of a source, it doesn't ship with one. On top of that, the firewall works inside WordPress, not in front of it — an attack that overloads the server won't be stopped by a PHP plugin, no matter which one.

What it does instead is narrowly defined and verifiable: detect and reject patterns, check core files against the checksums from api.wordpress.org, notice changes to files, and log every decision in a chain that can't be quietly altered after the fact. If you need those four things, it's the right fit. If you're looking for a signature database, it isn't.

With any security plugin, check where the firewall sits. In front of the server is stronger against overload; inside WordPress is more precise for requests to WordPress itself. You only get both at once if your hosting provider plays along.

Frequently asked questions