Bulletproof your WordPress.
Your customers live on your website. Booked WP Security locks that website down - logins, firewall, updates, files, backups, monitoring - with every protection on its own switch. Turn on what you want. It runs itself.
Fifteen protections. Each one yours to switch on or off.
Grouped by what they protect. Turn on the ones you want; the defaults are what we'd choose for a business that holds customer data.
Two-step sign-in
Staff confirm sign-in with their phone. Enforce it for everyone, or just for managers.
Login lockdown
Limits attempts, blocks the usernames attackers try first, and hides your login page behind a URL only you know.
Session control
See who's signed in right now, sign anyone out with one click, and set sessions to expire when a shift ends.
Firewall
Known attack patterns stopped before WordPress even loads. Bad bots and scrapers blocked.
Country blocking
Only take bookings from where your customers are. Block whole countries or specific networks. Off by default.
Security headers
The browser-level protections most sites forget - clickjacking, content sniffing, forced HTTPS - set correctly and kept that way.
Automatic updates with rollback
WordPress, themes and plugins updated overnight. A snapshot is taken first, and if an update breaks something it's rolled back before you wake up.
Vulnerability alerts
Every plugin and theme you run checked against known security holes daily. You're told the moment one appears, and what to do.
Remove the unused
Inactive plugins and themes are the easiest way in. See what's dormant and remove it in one go.
File integrity scan
Every file on your site checked daily against what it should be. Anything changed, added or hidden that shouldn't be is quarantined and you're told.
Lock file editing
Disables the theme and plugin editors in WordPress admin, locks file permissions, and stops PHP running from the uploads folder.
File manager
Browse, search and tidy your site's files from inside WordPress, with every change logged. No FTP, no guessing.
Off-site backups
Your whole site and customer list copied every day to somewhere separate, encrypted, kept for 30 days. One-click restore.
Security log
Every sign-in, blocked request, file change, update and setting change in one searchable list, with who, when and from where.
Monitoring & alerts
Uptime, certificate expiry and unusual admin activity watched around the clock. If something's wrong, you and Booked support hear about it.
The booking plugin is secure on its own. This locks the site around it.
Booked itself already protects the booking system in depth - with or without the add-on. WP Security is about the rest of your WordPress site: the logins, the files, the updates, the things a booking plugin can't reach.
- Your customers are only on your site. Not in a shared database with other businesses. A breach elsewhere has nothing to reach.
- Every staff screen is locked to staff. All 224 admin routes carry an explicit permission check. Managers and employees each get only their own capabilities.
- Passwordless customer sign-in. A single-use link that dies in 15 minutes; only a hash is stored, so there's no password to leak, reuse or phish.
- Documents encrypted at rest. ID scans and referrals encrypted with AES-256-GCM, kept outside the public web folder, served only after a permission check, every view logged.
- No card numbers, ever. Booked Payments' hosted fields take the card; your site keeps only the brand, last four digits and the consent record.
- The booking form is treated as hostile. Separate rate limits per action, every database query prepared, a blocklist by email, phone or IP, screening answers validated on the server.
- Health answers handled as sensitive. Never in a text preview or subject line, full history kept, deleted with the customer, one-button stop on all messages.
- Tamper-proof licence. Signed grants and a signed manifest - patched or hand-edited code drops the plugin to unlicensed.
- Two-step sign-in and login lockdown for every WordPress user, not just Booked staff.
- A firewall in front of the whole site, stopping attacks before WordPress loads.
- Automatic updates with rollback for WordPress core, every theme and every plugin.
- Vulnerability alerts for anything else you've installed.
- File integrity scans, locked file editing and a file manager - the part a booking plugin can't see.
- Off-site backups of the whole site, not just bookings.
- A security log, monitoring and a weekly report covering the entire site.
Add it. Leave it. Check the report on Mondays.
Add it at checkout or later
Tick it when you subscribe, or add it from Settings inside Booked whenever you like. It installs alongside Booked in one click.
Sensible defaults switch on
Two-step sign-in, firewall, updates, scans and backups come on straight away. Country blocking stays off until you want it. Flip anything from the dashboard.
You get a weekly report
One email every Monday: what was blocked, what was updated, what changed, your score. If anything needs a decision, it's at the top.
One price. Everything in it.
No tiers, no per-feature charges. If you're on the Business plan it's already included.
- All fifteen protections
- Off-site backups, 30 days kept
- Daily scans and vulnerability alerts
- Weekly report and 24/7 monitoring
- Cancel any time - your site stays as it was
Questions
Do I need this if I already have a security plugin?
Probably not both. Booked WP Security covers what Wordfence, Solid Security and a backup plugin cover, in one place, tuned around a site that holds customer bookings. If you're happy with what you have, keep it.
Will it slow my site down?
No. The firewall runs before WordPress loads, so blocked requests never cost you anything, and scans and backups run in the early hours.
What if an automatic update breaks something?
A snapshot is taken before every update. If the site errors afterwards, it's rolled back automatically and you're told which update was held back.
Where do the backups go?
Encrypted, to storage separate from your hosting, in the UK. Thirty days are kept. You can restore any of them in one click, or download one to keep yourself.
Can I turn things off?
Every protection has its own switch. Some businesses don't want country blocking or forced two-step sign-in - fine. Your score reflects what's on.
What happens if I cancel?
Protections switch off and your site carries on as it was before. Backups are kept for 30 days after cancelling so you can still download them.
Your customers are on your site. Lock the site.
£8 a month. Add it at checkout or from inside Booked any time.
Add Booked WP Security