No. InstallLock is designed to complement your existing WordPress security tools, not replace them.

Plugins such as Wordfence provide features like firewall protection, malware scanning, and login security. InstallLock focuses on a different security risk by restricting unauthorized software changes and requiring separate authenticator authorization.

Using InstallLock alongside other security tools adds another important layer of protection for your website.

No. When InstallLock protection is active, simply logging in with a WordPress administrator account is not enough to make the software changes InstallLock protects.

Those changes require separate authorization using a six digit code from your authenticator app. This helps protect your website even if someone obtains your administrator login credentials.

No. No WordPress security plugin can guarantee complete protection against every threat.

InstallLock adds an independent layer of security that protects your WordPress core and themes against unauthorized software changes. InstallLock Pro extends that protection to plugin installations, updates, activations, deactivations, and deletions. These protections help prevent unauthorized changes even if an attacker gains access to a WordPress administrator account or attempts changes remotely through a compromised management service.

Like all other WordPress security plugins, InstallLock cannot guarantee protection if an attacker gains full control of your hosting account or server. With that level of access, an attacker can modify website files directly, bypassing all security protections enforced within WordPress, not just InstallLock. This is a limitation shared by every WordPress security plugin.

That is why secure hosting, firewalls, malware scanning, and regular backups remain important.

Yes. InstallLock Pro is designed to block unauthorized plugin installations through WordPress, including installation attempts initiated remotely through connected management services.

Even if an attacker obtains WordPress administrator credentials or compromises a connected management service, those credentials alone do not authorize plugin installations while InstallLock Pro protection is active.

This provides an important safeguard against malicious plugin installations that might otherwise occur without your knowledge.

No. InstallLock is designed to restrict unauthorized software changes without interfering with normal website operations.

Visitors can continue browsing your website, and administrators can continue publishing posts, editing pages, and managing everyday WordPress activities.

InstallLock focuses on securing software changes, not restricting normal website use.

Yes. When you need to make software changes, simply authorize them using your six digit authenticator code. InstallLock temporarily allows those changes and automatically restores protection when the selected time expires.

InstallLock can also allow approved automatic updates while protection remains active. Free supports eligible WordPress core and theme automatic updates, while Pro extends this capability to approved plugin updates.

InstallLock provides recovery codes during authenticator setup. If you lose access to your authenticator app, you can use an unused recovery code to restore access and connect a new authenticator.

Recovery codes should be stored securely in a location separate from your authenticator device. Anyone who obtains a valid recovery code could potentially use it to recover authorization.

InstallLock Pro requires an active annual license. If your license expires, Pro protection stops. You can switch to InstallLock Free to continue protecting WordPress core and themes.