Question 1

What exactly does WP 1 Click LockDown do?

Accepted Answer

WP 1 Click LockDown hardens your WordPress site against the most common attack vectors in one click. It masks your login URL so bots cannot find it, blocks comment spam with an AI-powered engine, disables dangerous XML-RPC and pingback protocols, sets security HTTP headers, throttles brute-force login attempts, and locks down 20+ additional vulnerabilities—all without touching a line of code. Once activated it works silently in the background, 24/7.

Question 2

Will WP 1 Click LockDown protect me from every hack?

Accepted Answer

No plugin can guarantee 100% protection—and we will never claim otherwise. WP 1 Click LockDown closes the most exploited attack surfaces on WordPress: default login exposure, XML-RPC abuse, comment spam, and brute force. It is an outstanding first layer of defence, but it does not replace a Web Application Firewall (WAF), a malware scanner, or responsible hosting practices. Think of WP 1 Click LockDown as locking your doors and windows—it stops opportunistic intruders, not a determined specialist.

Question 3

Does WP 1 Click LockDown slow down my WordPress site?

Accepted Answer

No. WP 1 Click LockDown is built around performance-first principles. It adds zero database queries on front-end page loads, uses WordPress's native hook system (no rewrites of core files), and has a sub-1ms processing overhead. Independent speed tests show no measurable difference in Time to First Byte (TTFB) or Core Web Vitals scores after activation.

Question 4

Is WP 1 Click LockDown a beginner-friendly plugin?

Accepted Answer

Absolutely. WP 1 Click LockDown was designed from the ground up for non-technical WordPress users. Activate it and sensible defaults protect your site immediately—no config screens, no confusing terminology, no "feature flags" to hunt through. Advanced users can customise every setting, but most people just click Activate and never look at the settings page again.

Question 5

What WordPress version does WP 1 Click LockDown support?

Accepted Answer

WP 1 Click LockDown requires WordPress 4.6 or later and PHP 7.2+. It is tested up to the latest stable WordPress release and updated within 72 hours of any major WordPress version bump to confirm compatibility.

Question 6

Is there a free version?

Accepted Answer

Not currently. WP 1 Click LockDown is a fully featured premium plugin only. We decided against a feature-limited free tier because we want every user to have complete protection from day one—not a stripped-down version that only covers two or three attack vectors. Every plan includes a 30-day money-back guarantee so you can try it entirely risk-free.

Question 7

Can I get a full refund if WP 1 Click LockDown is not right for me?

Accepted Answer

Yes. We offer a no-questions-asked 30-day money-back guarantee on all plans. Email support@wp1clicklockdown.com within 30 days of purchase and we will process your refund within one business day. There are no hoops to jump through.

Question 8

How does login URL masking work?

Accepted Answer

WP 1 Click LockDown replaces the default /wp-login.php URL with a custom path you choose—for example /my-secure-login. WordPress rewrites requests silently so your admin users log in normally at the new address. Anyone (or any bot) hitting /wp-login.php receives a 404 Not Found response, making your site invisible to automated scanners. There is nothing stored client-side, no cookie tricks, and no compatibility issues—it works through native WordPress rewrites.

Question 9

What does the anti-spam engine actually filter?

Accepted Answer

Our anti-spam engine runs every comment through seven detection layers before it reaches WordPress: keyword analysis against an updated blocklist, URL pattern matching, IP reputation check, honeypot field validation, comment velocity (too many in a short time), user-agent fingerprinting, and behavioural signals (time-to-submit, scroll patterns). Comments that fail multiple checks are blocked silently. Comments that fail just one check are held for manual review. The result is a 98.7% spam-free comment section with a false-positive rate under 0.3%.

Question 10

What is XML-RPC and why should I block it?

Accepted Answer

XML-RPC is an older WordPress API originally designed for remote publishing tools like Windows Live Writer. Almost no modern site needs it. Unfortunately, attackers exploit XML-RPC to run credential-stuffing attacks (it allows thousands of password guesses in a single HTTP request, bypassing standard lockout mechanisms) and to use your server as an amplification relay for DDoS attacks. WP 1 Click LockDown disables it entirely with one toggle while preserving any legitimate uses you have whitelisted.

Question 11

Which security headers does WP 1 Click LockDown add?

Accepted Answer

WP 1 Click LockDown adds: Content-Security-Policy (CSP), X-Frame-Options (clickjacking protection), X-Content-Type-Options (MIME-sniffing block), Referrer-Policy, Permissions-Policy, Strict-Transport-Security (HSTS), and X-XSS-Protection. Each header can be toggled individually, and advanced users can customise the CSP directive string. After activation, your site will score A or A+ on securityheaders.com.

Question 12

How does brute force protection work?

Accepted Answer

WP 1 Click LockDown throttles repeated failed login attempts by IP address and username. After a configurable number of failures (default: 5 attempts), the offending IP is locked out for a configurable duration (default: 30 minutes). Persistent offenders can be permanently banned. Lockout events are logged and visible in the WP 1 Click LockDown dashboard. You receive an email notification on first lockout per IP. Trusted IPs you specify are always whitelisted.

Question 13

Can I generate white-label security reports for clients?

Accepted Answer

Yes, on Agency and Lifetime plans. Reports are generated as professionally designed PDFs covering: security hardening score, blocked login attempts, spam stopped, security headers status, and recommended next actions. You can add your agency logo, brand colours, and contact details. Reports can be auto-scheduled (weekly/monthly) and emailed directly to clients, or exported on-demand.

Question 14

Does WP 1 Click LockDown provide an activity log?

Accepted Answer

Yes. WP 1 Click LockDown logs every security event: login attempts (successful and failed), lockout events, spam blocks, and plugin setting changes. Logs are stored for 90 days by default and can be exported as CSV. The log view in the dashboard is searchable and filterable by event type, date, and IP address.

Question 15

Is WP 1 Click LockDown compatible with Elementor, Divi, Beaver Builder, and other page builders?

Accepted Answer

Yes. WP 1 Click LockDown operates entirely at the WordPress core/hook level and has no interaction with the front-end editor layer of any page builder. Elementor, Divi, Beaver Builder, Gutenberg, Brizy, Oxygen, Bricks, and WPBakery are all tested and confirmed compatible. If you encounter any issue with a page builder, our support team will prioritise a fix.

Question 16

Will it conflict with Wordfence, iThemes Security, or Sucuri?

Accepted Answer

Running two security plugins that both try to manage login protection or brute-force lockouts can cause conflicts. If you are currently using Wordfence or iThemes Security, we recommend disabling their login protection and XML-RPC blocking modules before activating WP 1 Click LockDown, or simply switching entirely to WP 1 Click LockDown. The anti-spam and security headers modules are generally compatible with other security plugins. If you are using Sucuri or Cloudflare as a WAF, WP 1 Click LockDown works alongside them—they address different threat layers.

Question 17

Does WP 1 Click LockDown work with WooCommerce?

Accepted Answer

Yes. WP 1 Click LockDown is fully compatible with WooCommerce. Login masking is smart enough to allow WooCommerce's own checkout and account login flows, and the anti-spam engine does not interfere with order or product review submissions unless you explicitly enable WooCommerce review filtering (which is an optional toggle).

Question 18

Does it work with membership plugins like MemberPress or LearnDash?

Accepted Answer

Yes. WP 1 Click LockDown's login masking preserves all redirects and authentication flows used by MemberPress, LearnDash, Restrict Content Pro, and similar membership plugins. We specifically test against these popular plugins before each major release.

Question 19

What happens with WPML or multilingual sites?

Accepted Answer

WP 1 Click LockDown is compatible with WPML, Polylang, TranslatePress, and MultilingualPress. Login masking applies to all language variations of the login URL. The anti-spam engine's keyword blocklist can be expanded with language-specific terms through the custom rules interface.

Question 20

Does it work on managed WordPress hosts like WP Engine or Kinsta?

Accepted Answer

Yes, with one caveat. Some managed hosts (WP Engine, Flywheel, Pressable) block XML-RPC at the server/firewall level already—WP 1 Click LockDown's XML-RPC toggle will still activate successfully, but will essentially be redundant. All other WP 1 Click LockDown features (login masking, anti-spam, brute-force, headers) work normally on any managed host.

Question 21

What is included in each pricing plan?

Accepted Answer

All plans include the complete WP 1 Click LockDown feature set: login masking, anti-spam, XML-RPC blocker, brute force protection, security headers, activity log, and email alerts. The plans differ only in the number of sites covered: Single Site (1 site, $49/yr), Starter (5 sites, $99/yr), Agency (25 sites + white-label reports + priority support, $199/yr), Lifetime (unlimited sites, one-time payment, $399). Every plan includes automatic updates for the licence period.

Question 22

Does the Lifetime plan include future updates?

Accepted Answer

Yes. The Lifetime plan covers unlimited sites forever and includes all future updates, new features, and security patches with no additional fees. Ever. This is a genuine lifetime licence, not a "lifetime of this version" trick that some plugin vendors use.

Question 23

Can I upgrade or downgrade my plan?

Accepted Answer

Yes. You can upgrade at any time and pay only the pro-rated difference for your current billing period. Downgrades take effect at the next renewal. To change your plan, log in to your customer account and select "Change Plan", or email billing@wp1clicklockdown.com.

Question 24

What happens when my annual licence expires?

Accepted Answer

If you do not renew, WP 1 Click LockDown continues to work—your site stays protected by the last installed version. You will not receive plugin updates or new features, and support access ends. We recommend renewing to ensure compatibility with future WordPress releases and to receive ongoing security definition updates.

Question 25

Can I use WP 1 Click LockDown on a local development site?

Accepted Answer

Yes. Localhost/development installations do not count toward your site limit. We only count live, publicly accessible domains.

Question 26

Do you offer a discount for non-profits or educational institutions?

Accepted Answer

Yes. We offer a 40% discount for registered non-profits and educational institutions. Contact us at billing@wp1clicklockdown.com with proof of status and we will issue a discount code.

Question 27

How does multisite support work?

Accepted Answer

Network-activate WP 1 Click LockDown from the WordPress Network Admin plugins screen. From the Network Settings menu you can set global policies that apply to every subsite in your network. Individual network admins can also allow subsite admins to customise specific settings within bounds you define. This is perfect for managed networks where you want consistent baseline security with site-level flexibility.

Question 28

Does the Agency plan cover subdomain and subdirectory multisites?

Accepted Answer

Yes. Both subdomain (site1.yourdomain.com) and subdirectory (yourdomain.com/site1) multisite configurations are fully supported. The 25-site Agency limit counts individual subsites within a network.

Question 29

Can my team members access the WP 1 Click LockDown dashboard?

Accepted Answer

On Agency and Lifetime plans you can invite additional team members to your WP 1 Click LockDown account. You assign roles: Admin (full access), Manager (can view reports and configure settings but not change the licence), or Viewer (read-only dashboard access). Each team member logs in with their own email and password.

Question 30

How do I add a new client site to my Agency plan?

Accepted Answer

Install WP 1 Click LockDown on the client's WordPress site, then enter your agency licence key in the plugin settings. The site will automatically appear in your central WP 1 Click LockDown dashboard. You can label sites with client names and notes for easy management.

Question 31

Does WP 1 Click LockDown collect or store any data from my site or visitors?

Accepted Answer

WP 1 Click LockDown does not collect any personally identifiable information from your site visitors. The only data transmitted to our servers is your licence key during activation validation and anonymised event counts for usage analytics (e.g. "X logins blocked this week"—not which usernames or IPs). All visitor data and security logs stay entirely on your server. See our Privacy Policy for the complete breakdown.

Question 32

Is WP 1 Click LockDown GDPR compliant?

Accepted Answer

Yes. WP 1 Click LockDown processes no personal data from your site's visitors. The security log (which records IP addresses of blocked attackers) is stored locally on your server—you control it, not us. We provide a log-retention setting (default 90 days) to help you comply with data minimisation principles. Our own data processing (your customer account) complies fully with GDPR.

Question 33

Does WP 1 Click LockDown phone home or send my data anywhere?

Accepted Answer

The only outbound connection WP 1 Click LockDown makes is a daily call to api.wp1clicklockdown.com to validate your licence key and download updated spam/IP blocklist definitions. This request includes your licence key and site URL. It does not include visitor data, post content, usernames, passwords, or analytics. You can review all network requests in the WP 1 Click LockDown settings under Privacy.

Question 34

Will WP 1 Click LockDown conflict with cookie consent plugins?

Accepted Answer

No. WP 1 Click LockDown sets no tracking or analytics cookies. It sets a single server-side session variable for the login masking flow. No cookie consent dialogue is required for WP 1 Click LockDown itself. It is compatible with Complianz, CookieYes, GDPR Cookie Consent, and all other popular consent management plugins.

Question 35

What support channels are available?

Accepted Answer

Single Site and Starter plans receive email support with a response time of 1–2 business days. Agency and Lifetime customers receive priority email support (same business day) plus access to live chat during UK business hours (9am–5pm Monday–Friday). All plans have access to the documentation portal at docs.wp1clicklockdown.com.

Question 36

How often is WP 1 Click LockDown updated?

Accepted Answer

WP 1 Click LockDown receives security definition updates (spam blocklist, IP reputation list) automatically in the background every 24 hours. Plugin feature/compatibility updates are released approximately once a month, with emergency patches pushed within hours of any critical WordPress vulnerability disclosure.

Question 37

What happens if WP 1 Click LockDown breaks my site?

Accepted Answer

This is extremely rare, but if it happens: deactivate WP 1 Click LockDown via FTP by renaming the plugin folder from /wp-content/plugins/wp1clicklockdown to /wp-content/plugins/wp1clicklockdown-disabled. Your site will return to normal immediately. Then contact our support team with your WordPress and server details and we will identify the conflict and provide a fix—usually within 24 hours.

Question 38

Do you have documentation and setup guides?

Accepted Answer

Yes. Full documentation is available at docs.wp1clicklockdown.com, including: quick-start guide, feature configuration reference, multisite setup walkthrough, agency dashboard guide, and troubleshooting articles. We also publish video tutorials for the most common setup scenarios.

Frequently Asked Questions

Frequently Asked Questions

Still have a question?

Email Support

Documentation

Risk-Free Trial

Ready to Harden Your WordPress Site?