Free WordPress security & SMTP plugin

Your WordPress
wingman.

Malware scanner, web application firewall, brute-force login protection, shared threat intelligence and dead-simple SMTP — one lightweight plugin that flies alongside your site and watches your six.

Download Wingman

Version 1.36.42 · released 2026-10-01 · free · installs in 30 seconds

The Wingman pilot mascot

Everything on board

Wingman replaces a malware scanner, a firewall plugin, a login-limiter and an SMTP plugin with one install. Every protection is on by default; you can switch any of them off.

WordPress malware scanner

Scheduled scans check WordPress core, plugins and every PHP file for tampering, webshells and hidden payloads, and keep suspicious files on a review list until you deal with them.

Brute-force login protection

Rate limiting, automatic lockouts that escalate to bans for repeat offenders, instant bans for bots, and datacenter and geo blocking before the login page even renders.

Web application firewall

A lightweight firewall that runs before WordPress loads and blocks common exploits, known scanning tools and banned addresses. Built to fail open so it can never take your site down.

The Wingman Network

Sites running Wingman share confirmed attacker IPs and datacenter ranges. When one site blocks an attacker, every site knows. Only IP addresses are shared.

Simple SMTP for WordPress

Host, port, username, password, done. Every WordPress email delivered through your SMTP server, with a mail log, one-click test emails and diagnostics.

One-toggle hardening

Block PHP in uploads, disable XML-RPC, stop user enumeration, disable the file editor, watch for new administrators. Each one a single switch, all on by default.

Up and running in three steps

  1. Download. Get the plugin zip with the download button. The link always points at the newest release.
  2. Upload. In your WordPress admin go to Plugins → Add New → Upload Plugin and choose the zip.
  3. Activate. The first scan starts within a minute and protection is already on. Set up SMTP under Wingman → Settings if you want reliable email.

Prefer the command line? wp plugin install https://wingman.codepilots.io/wingman.zip --activate

Get Wingman

Your site, your data

Nothing to sign up for

  • No account, no license key, no paid tier
  • Protection is on from the moment you activate
  • Every protection is a single switch you can turn off
  • Wingman keeps itself up to date

What leaves your site

  • An anonymous daily ping with the site URL, plugin version and last scan time
  • Confirmed attacker IPs, if the Wingman Network is on
  • Nothing else: no content, users, settings, findings or visitor data
  • Monitor any Wingman site with GET /pingman

Frequently asked questions

Is Wingman free?

Yes. Wingman is free and open source (GPL-2.0-or-later). There is no account, no license key and no paid tier. Download the zip, upload it to WordPress, activate.

What does Wingman do?

Wingman is a WordPress security plugin with a built-in SMTP mailer. It scans for malware, runs a web application firewall, protects the login page against brute-force attacks, shares attacker IPs between sites through the Wingman Network, applies hardening switches, watches for new administrator accounts, and delivers all WordPress email through your SMTP server with a mail log.

What are the requirements?

WordPress 6.0 or newer and PHP 7.4 or newer. Wingman works on any host; where a particular protection cannot be applied on your server, it tells you on the status page and everything else keeps working.

How do I install Wingman?

Download the zip from this page, then in wp-admin go to Plugins → Add New → Upload Plugin, choose the file and activate. With WP-CLI: wp plugin install https://wingman.codepilots.io/wingman.zip --activate. Protection is on and the first scan starts within a minute.

Does Wingman slow down my site?

No measurable impact. The firewall is designed to be extremely fast, scans run in short chunks in the background, and Wingman adds no CSS or JavaScript to your public pages.

Can Wingman lock me out of my own site?

Automatic bans are by IP address only, never by username. Logged-in users are never geo- or datacenter-blocked, the firewall fails open, and every protection can be switched off under Settings → Security. WP-CLI keeps working throughout.

What data does Wingman send to Codepilots?

An anonymous daily install ping with the site URL, plugin version and last scan time. If the Wingman Network is enabled, confirmed attacker IPs are shared too. Nothing else: no content, users, settings, findings or visitor data.

What is the Wingman Network?

Shared threat intelligence between sites running Wingman. When several independent sites confirm the same attacker, every site is protected from it. Only IP addresses are shared, and it can be switched off.

How does Wingman update?

Wingman updates itself from wingman.codepilots.io, so updates appear in wp-admin like any other plugin. Self-update is on by default so security releases arrive on their own.

How do I set up SMTP?

Go to Wingman → Settings → SMTP, enable it, enter host, port, encryption, username and password, and send a test email. The mail log shows every message sent or failed afterwards.

Can I monitor a Wingman site externally?

Yes. Every Wingman site answers GET /pingman with a small JSON status (OK, warning or critical) that works with any uptime monitor, including Pingman.

Who makes Wingman?

Codepilots, a web agency in Denmark, at codepilots.io. Wingman runs on the sites Codepilots builds and hosts, and is released for anyone to use.

What's new

Wingman 1.36.41

  • Firewall reliability improvements: scheduled scans keep running on every hosting setup.

Wingman 1.36.39

  • Scan accuracy improvements for staging setups; modified .htaccess findings now show what changed.

All release notes →