Who's behind this
About Loyal Security
Loyal Security – Firewall & Malware Scanner asks for more trust than most software — it reads every request, touches every file, and holds your two-factor secrets. That trust should be checkable, not just claimed. This page is where everything needed to check it is collected in one place.
Who builds this
Loyal Security is built and maintained by Ioannis Afaloniatis, an individual developer based in Greece, trading as “Loyal Security.” There is not yet a separate registered company behind the product — if that changes, this page and the terms of use will say so, and the change will be noted in the plugin's changelog.
That's stated plainly here, rather than only in the legal text, because an anonymous brand behind a plugin that runs with administrator-level access on your site is a reasonable thing to be wary of. This one isn't anonymous.
Why the name changed
The product was originally named “Total Security WP.” It was renamed to
Loyal Security in September 2026 to comply with WordPress.org's naming
policy, which restricts using “WordPress” or “WP” in a plugin's
name or slug. Every public address moved from totalsecuritywp.com to
loyalsecuritywp.com at the same time; the old domain still redirects here.
The plugin itself uses the new name throughout: the loyal-security folder, the
wp loyal-security WP-CLI commands and the loyal-security/v1 REST
API namespace.
Read the source
The free plugin's complete source is published at github.com/loyal-security/loyal-security, under the same GPL-2.0-or-later license it ships under. It is not a mirror or a marketing snapshot — it ships unobfuscated, with no compiled blobs, so what you read there is what runs on your site.
Compare your installed copy's files against the repository (or against the WordPress.org checksums once listed, below) before trusting it with administrator access. The licensing page explains what the GPL does and doesn't require for the free plugin, and the separate commercial terms Pro ships under.
WordPress.org listing
The free plugin is submitted to WordPress.org and going through its review process, which includes an automated and human code review before a plugin is allowed to list. Once it's live there, installs and updates will also be verifiable through WordPress.org's own checksums and your site's native plugin updater, independent of this website entirely.
What leaves your server
The full, itemized list of every external service the plugin can contact, what it sends, and how to turn each one off is on the privacy & data page. Nothing in the free tier contacts anything beyond the same public WordPress.org APIs core already uses for update checks, unless you've explicitly opted into something that says otherwise.
Reporting a vulnerability
Found a flaw in the plugin itself? There's a coordinated disclosure policy, a defined
scope, and a stated response timeline on the
security page (also published at
/.well-known/security.txt). Please report privately rather than filing a
public issue.