Robust, simple, and flexible quantum key distribution (QKD) is vital for realising practical applications of this technique. Contrary to typical phase-coded QKD schemes, the plug-and-play QKD design requires only one arm-length-insensitive interferometer without active feedback, in which the noise is automatically compensated by the two-way structure. However, there are certain possible loopholes in the typical plug-and-play designs, which require consideration and strict monitoring. This study proposes a loophole-free plug-and-play QKD scheme with two-way protocol and presents an experimental demonstration of said scheme. The security is analysed under a collective attack scenario assisted by the decoy state method. The scheme was implemented in a 50.4 km commercial fibre without active feedback. The system showed highly robust performance with an ultra-low error rate and maintained an ultra-high visibility of 0.9947+/-0.0002 through significant environmental changes over 24 hours.