A security plugin can only do so much if the server under your site is weak. So start with the hosting. Pick a WordPress host that already builds protection into its setup. A lot of that protection runs at the server level, where it tends to work better, without harming performance on your site. It also spares you hours spent poking at a pile of plugin security settings when you may not even be sure what each one does or why it is there.
With that covered, here are the WordPress security plugins worth a look:
| Product | Best for | Price | Rating | Active installs |
|---|---|---|---|---|
| Sucuri Security | Free malware and blacklist monitoring | Free + paid | 4.2/5 | 600,000+ |
| iThemes Security | Login and password hardening | Free + paid | 4.6/5 | 700,000+ |
| Wordfence Security | A strong free firewall and scanner | Free + paid | 4.7/5 | 5M+ |
| WP fail2ban | Brute force protection at server level | Free | 4.2/5 | 60,000+ |
| All In One WP Security & Firewall | Beginners who want a security score | Free + paid | 4.7/5 | 1M+ |
| Jetpack | Sites already using Jetpack | Free | 3.7/5 | 3M+ |
| SecuPress | Beginners who want a clear interface | Free + paid | 4.1/5 | 40,000+ |
| BulletProof Security | Advanced users | Free + paid | 4.8/5 | 20,000+ |
| VaultPress | Real-time backups with security scans | Paid | 3.8/5 | 10,000+ |
| Google Authenticator (miniOrange) | Adding two-factor login | Free + paid | 4.5/5 | 10,000+ |
| Security Ninja | Learning what to fix and why | Free + paid | 4.7/5 | 7,000+ |
| Defender | Simple layered hardening | Free + paid | 4.8/5 | 80,000+ |
| Astra Web Security | Businesses that want malware cleanup included | Paid | ||
| Shield Security | Security that runs quietly | Free + paid | 4.8/5 | 30,000+ |
| Hide My WP | Hiding that a site runs WordPress | Paid | ||
| WebARX | Agencies managing many sites | Paid |
Sucuri Security – Auditing, Malware Scanner and Security Hardening
The Sucuri Security plugin offers both free and paid versions, and the free one covers what most sites need. The website firewall is the main thing behind a paywall, since it needs a Sucuri plan, and plenty of site owners can live without it.
Sucuri Security WordPress plugin
The free plugin gives you an audit log of security activity, so you can see what it is doing for your site. On top of that you get file integrity checks, blacklist monitoring, security alerts and hardening options. Paying adds support channels and scans that run more often. A scan every 12 hours, for example, costs roughly $17 a month.
Features That Make Sucuri Security a Great Choice:
- SSL certificates come in several types. They cost extra, but you can get them as part of the packages.
- Need help? Support is on hand through live chat and email.
- If something goes wrong on your site, an alert reaches you right away.
- Advanced DDoS protection is available through some plans.
- Even on the free plugin you keep useful tools: malware scans, blacklist checks, file integrity monitoring and hardening, all at no cost.
Pros
- File integrity and blacklist monitoring
- Security activity audit log
- Security hardening
Cons
- The website firewall needs a paid Sucuri plan
iThemes Security
The iThemes Security plugin used to be called Better WP Security. It packs more than 30 ways to keep hackers and other intruders out of your site. Its main job is spotting weak points such as vulnerable plugins, outdated software and poor passwords.
iThemes Security WordPress plugin
The free version covers a few basics, but the paid upgrade is the one to get: iThemes Security Pro at a modest $80 a year. That price buys ticket-based support, a full year of plugin updates and a license for two websites. If you have more sites to cover, a higher-priced plan takes care of that.
The Pro version adds the heavy hitters: enforced strong passwords, lockouts for bad users, database backups and two-factor login. That is only part of the list. In total there are 30 security measures you can switch on, which makes the Pro price feel fair.
Features That Make iThemes Security a Great Choice:
- It watches for changed files. That matters, because most site owners never notice when someone tampers with one.
- Google reCAPTCHA support puts one more barrier on your login form.
- It checks your core WordPress files against the current release, so you can tell if something harmful has been slipped into them.
- You can refresh your WordPress salts and keys, which makes your authentication keys harder to crack.
- “Away Mode” shuts the WordPress dashboard to every user during periods when you are not working on the site.
- The usual must-haves are here too: strong password rules, brute force protection and 404 detection.
Pros
- File change detection
- Brute force protection and strong password rules
- Away mode locks the dashboard
Cons
- Two-factor authentication and backups are in Pro
- Now called Kadence Security on wordpress.org
Wordfence Security
Wordfence Security ranks among the best-known WordPress security plugins, and it earns that spot. It keeps things simple while giving you strong tools, like solid login protection and help recovering from a security incident. A big plus is the view it gives you of your traffic patterns and of attempted hacks.
Wordfence Security WordPress plugin
The free version is one of the strongest around. It covers firewall blocking and brute force protection, among much else. Premium starts at about $99 a year for a single site. Buying keys for many sites gets much cheaper: at 15 or more licenses the discount is 25%, which works out to $74.25 each. If you build and look after lots of sites, Wordfence is well worth a look.
Features That Make WordFence Security a Great Choice:
- Small sites can get by fine on the free version alone.
- Buying keys for many sites at once saves developers a lot.
- The firewall side is complete: a web application firewall, real-time threat defense, brute force protection, plus blocking by country or by hand.
- Its scanner goes after malware, spam and live threats. It checks every file on your server for malware, not only the WordPress ones.
- Live traffic monitoring shows you who is on the site: people, bots, Google’s crawler, and every login and logout.
- There are some less common extras, such as password audits and signing in with your mobile phone.
- A comment spam filter is built in, so you can skip a separate anti-spam plugin.
- It warns you when one of your plugins has been pulled from the WordPress plugin directory (often because it was unsafe or hacked) or has stopped getting updates and been abandoned.
Pros
- Web application firewall and brute force protection
- Malware scan of all files
- Live traffic view
Cons
- Real-time firewall rules need Premium
WP fail2ban
WP fail2ban does a single job, and it is an important one: stopping brute force attacks. Its method differs from the security suites above, and many people think it works better. Every login attempt, whatever it is and whether it succeeds or not, gets written to the syslog with LOG_AUTH. You can then apply a soft ban or a hard ban, rather than being stuck with just one kind as with the usual approach.
WP fail2ban security plugin
Setup is barely a thing with WP fail2ban. You install it and it gets to work on its own. It also costs nothing, so there is no budget to think about. Users keep saying it runs without problems, which is why it stands out among brute force plugins.
Features That Make WP fail2ban a Great Choice:
- Choose between hard or soft blocks.
- Integrate with CloudFlare and proxy servers.
- Log comments to prevent spam or malicious comments.
- Spam, pingbacks and user enumeration attempts get logged as well.
- A shortcode option lets you block users on the spot, before they ever get to the login step.
Pros
- Logs logins to syslog for fail2ban
- Soft or hard bans
- Works with Cloudflare and proxies
Cons
- Needs fail2ban on the server
- One job only
All In One WP Security & Firewall
Few free security plugins pack in as many features as All In One WP Security & Firewall does. It is simple to use, the support is reasonable, and there are no paid tiers at all. It is very visual, too. Graphs and meters show beginners how strong their security is and what to fix to improve it.
All In One WP Security & Firewall plugin
Features are sorted into three levels: Basic, Intermediate and Advanced, so experienced developers get plenty out of it as well. Its main jobs are guarding user accounts, stopping brute force login attempts and tightening up user registration. Protection for your database and files is part of the package too.
Features That Make All In One WP Security & Firewall a Great Choice:
- A blacklist tool lets you set the rules that get a user blocked.
- It can back up your .htaccess and wp-config files, and restore them if something breaks.
- One graph shows your overall security strength, and another scores specific parts of your site. For most users, this is the clearest way to see where the site’s security stands.
- The plugin is free without any upsells along the way.
Pros
- Security strength graph and meter
- Basic, intermediate and advanced settings
- Backup of .htaccess and wp-config.php
Cons
- Many settings to go through
Jetpack
Most people who use WordPress are familiar with Jetpack. The huge feature list explains part of that, and so does the fact that the people behind WordPress.com make it. Its modules cover social media, site speed and spam protection, and there is a lot more to explore beyond those.
Jetpack WordPress security plugin
Jetpack also has security tools, which makes it attractive if you want to spend less and stick with a trusted name. The free Protect module, for example, stops suspicious activity. Its basic security features also handle brute force protection and whitelisting.
For real security muscle, though, the paid plans are where Jetpack shines. At $99 a year you get malware scans, scheduled backups and restores when things go wrong. The $299 a year plan steps up to malware scans on demand and real-time backups.
Features That Make Jetpack a Great Choice:
- A small site gets reasonable protection on the free plan. When you need more, the premium plans are fairly priced and add full support, turning it into one of the strongest options out there.
- Paying turns Jetpack into a fuller suite, adding backups, spam protection and security scans.
- Plugin updates are managed entirely through Jetpack.
- You also get downtime monitoring.
- Thanks to built-in optimization, customization, social sharing and email marketing tools, Jetpack can replace a handful of separate plugins.
Pros
- Free brute force protection
- Downtime monitoring
- Backups and malware scans in paid plans
Cons
- Malware scanning and backups need a paid plan
- Large plugin with many unrelated modules
SecuPress
SecuPress is a fairly new name among security plugins (it first came out as a freemium plugin), and it is gaining users quickly. Its developer is Julio Potier, a co-founder of WP Media, the company behind WP Rocket and Imagify. You can pick a free version or a premium one with many more features.
SecuPress WordPress security plugin
For a security plugin with a clean, easy interface, SecuPress is a strong choice. On the free plan you get brute force login protection, IP blocking and a firewall. It protects your security keys too, and it turns away bad bots, something other security plugins often charge for.
Paying from $59 a year for one site unlocks PDF reports, PHP malware scans, GeoIP blocking, two-factor login, plus alerts and notifications.
Features That Make SecuPress a Great Choice:
- SecuPress has one of the nicest interfaces around, so even beginners find it simple to use.
- Paying is well worth it here. In just 5 minutes it works through 35 checks, gives you a tidy report, then guides you through hardening.
- You can move your WordPress login page to a new URL, so bots cannot locate it.
- It spots themes and plugins that have known holes or that someone has altered to hide malicious code.
Pros
- Firewall, anti-brute-force and bad bot blocking in the free version
- Change the login URL
- Detects vulnerable plugins and themes
Cons
- Two-factor authentication and malware scans are in Pro
BulletProof Security
The BulletProof Security plugin has both free and premium versions. The paid version is a one-time $69.95 purchase. It is under active development, gets regular updates and likely has more features than most rival security plugins. A 30-day refund guarantee comes with it, along with quarantine, email alerts, anti-spam, auto-restore and other tools.
BulletProof Security WordPress plugin
Start with the free plugin, though, since it already gives you these tools:
- Login security and monitoring.
- Database backups and restoring.
- MScan Malware Scanner.
- Anti-spam and anti-hacking tools.
- A security log.
- Hidden plugin folders.
- Maintenance mode.
- A full setup wizard.
Beginners may find it hard going. Advanced developers, on the other hand, get special settings and tools such as the anti-exploit guard and an online Base64 decoder. A setup wizard with an auto-fix option smooths out some of the rough edges.
Features That Make BulletProof Security a Great Choice:
- Few rivals match its advanced kit: folder locking, cURL scans, scheduled crons and the BPS Pro ARQ Intrusion Detection and Prevention System (ARQ IDPS) encrypting solutions, among other things.
- For a typical site, the free version has more than enough.
- The database backups are provided in the free version.
- You can hide individual plugin folders.
- Built-in maintenance mode is a rare extra, since few rival plugins ship one.
Pros
- Database backups in the free version
- Malware scanner and security log
- Setup wizard
Cons
- Not the most user-friendly
VaultPress
Also worth a mention is VaultPress, which works much like iThemes Security Pro and Sucuri Scanner. There is no free protection here, but plans begin at just $39 a year, so it is one of the cheaper paid security plugins. That entry plan is pitched at bloggers and small businesses. Bigger plans cost $99 or $299 a year if you need more power.
VaultPress WordPress security plugin
Backups are its core strength, both daily and real-time, and a neat calendar view lets you pick when they run. Restoring a site takes one click. Each restore file shows up in the dashboard, and several are kept so you can pick the one you want. Best of all, the backups are incremental, which is good news for site speed.
Its security tools keep an eye out for suspicious activity. Tabs show your history and which threats were handled or ignored. Stats and all your security settings live in one tidy dashboard.
Features That Make VaultPress a Great Choice:
- It costs less than most paid WordPress security plugins.
- The dashboard is clean and simple for any user to follow.
- Backups can run in real time or by hand, set from a calendar.
- A stats tab shows when your site gets the most visitors, and which threats hit during those hours.
- VaultPress experts can step in and help with jobs like backups and site restores.
Pros
- Daily or real-time incremental backups
- One-click restores
- Security activity history
Cons
- No free plan
- Now part of Jetpack
Google Authenticator – Two Factor Authentication
Plugins that do only one security job are usually not worth it. A suite like iThemes Security Pro already gives you that job plus dozens more. Two-factor login is the exception, because many security suites seem to leave it out. For that one feature, a dedicated plugin like this can be a smart way to lock down your login.
Google Authenticator WordPress plugin
The Google Authenticator plugin puts a second check on your login screen. That matters, since most hacking attempts go after the login. Beyond your normal password, it asks for a second proof: a push notification on your phone, a QR code, a security question or a similar method.
The result is a login that is far harder to break into, because the second step is something only you know or carry, like your phone.
It is free, and the settings are easy to follow. Apart from picking the authentication method, you can decide which user roles must use it. So admins could log in with less friction, while authors and other users have to pass the two-factor step.
One downside: the extra step makes logging in to your dashboard from a phone quite awkward.
Features That Make Google Authenticator a Great Choice:
- It nearly eliminates the vulnerability that is your login area.
- Pick whichever two-factor method suits you best.
- Decide which kinds of users have to pass the extra check.
- The plugin has a shortcode for using with custom login pages.
Pros
- Push, QR code or security question as second factor
- Choose which user roles must use it
- Shortcode for custom login pages
Cons
- Two-factor login only
- Logging in from a phone gets harder
Security Ninja
Security Ninja is no newcomer. Its life began on CodeCanyon, where it was among the earliest security plugins sold and came with four add-ons. Later it went freemium, scrapped the add-ons and settled on two editions, free and premium. Only the main module is free, and it carries out over 50 checks, covering things like PHP settings and the permissions on files and MySQL.
Security Ninja WordPress plugin
It also tries brute force guesses against every user password to catch weak ones like “12345” or “password”, which teaches users a thing or two about security. An auto fixer module is included. If you would rather know what is happening, each test comes with a full explanation and the code to fix the problem yourself. That makes it a good fit if you dislike plugins changing your site with one click. The other modules come with the paid version, from $29 per site per year.
Features That Make Security Ninja a Great Choice:
- Over 50 checks run across your site through the security tester, which you get free.
- Not a technical person? The auto fixer module can sort out any problem it finds.
- It checks your WordPress core files against a clean, current copy from wordpress.org to make sure nothing was changed.
- Plugins and themes get scanned for malware and suspicious code.
- A large list of known bad IP addresses is blocked for you automatically.
- Every event on your site is logged, from user logins to changed settings.
- You can schedule regular scans.
Pros
- 50+ security tests in the free version
- Explains each test and how to fix it
- Finds weak user passwords
Cons
- Auto fixer, scans and event log are paid
Defender
Defender makes layered WordPress security dead simple. Both the free and pro versions open with a list of the hardening steps that work best, so you can improve security right away.
Defender WordPress security plugin
The free scanner hunts for suspicious code by checking your install against the official directory. Anything that changed gets reported, and one click puts the original file back. Pro brings blacklist monitoring, scheduled scans, change-tracking audit logs and cloud backups with 10 GB of off-site storage. Hacked already? Their experts will help with the cleanup.
Features That Make Defender a Great Choice:
- Google 2-Step Verification.
- WordPress core file scanning and repair.
- Login Screen Masking.
- IP Blacklist manager and logging.
- Unlimited file scans.
- Timed Lockout brute force attack shield for login protection.
- 404 limiter for blocking vulnerability scans.
- IP lockout notifications and reports.
Pros
- Core file scan and one-click repair
- Two-step login and login masking
- 404 limiter and IP lockouts
Cons
- Cloud backups and audit logs are in Pro
Astra Web Security
Astra Web Security pitches itself as a complete ‘security suite’ for WordPress. It handles malware, SQLi, XSS, comment spam, brute force and more than 100 other threats, so you can drop your other security plugins & let Astra cover everything. The dashboard is very easy to read and avoids a wall of buttons that would make you feel like you are flying a plane!
Astra Web Security for WordPress
Astra says big names such as Gillette, the African Union, Ford and Oman Airways use its security service. Pricing begins at $9 a month, with a flat 20% discount for yearly billing. If you are ready to pay for your site’s security, Astra can be money well spent.
Features That Make Astra Web Security a Great Choice:
- Setup is just a normal plugin install & your DNS stays as it is.
- Infected sites get cleaned straight away, and a tough firewall blocks over 100 attack types, from SEO spam, bad bots and brute force to code injection, XSS and SQLi.
- A full security audit of your WordPress site, business logic errors included.
- The dashboard records every attack and lets you block or whitelist a country, IP range or URL. It also keeps watch on blacklists and reputation and sends hourly admin login alerts, among other things.
- Through a free bug bounty program, outside researchers can safely tell you about any weakness on your site. Every report is verified by Astra’s engineers first.
Pros
- Firewall against SQLi, XSS and bad bots
- Malware cleanup included
- No DNS changes needed
Cons
- Monthly subscription only
Shield Security
The main job of Shield Security is to take the growing load of site security off your hands. Time is tight for everyone, so you want smart defenses and a plugin that deals with threats without flooding your inbox. It works for beginners and experts alike, and it starts scanning and protecting the moment you switch it on. Every option has documentation, so you can learn more about your site’s security whenever you like.
Shield Security WordPress plugin
You never pay for Shield’s core. Businesses, or anyone wanting stronger protection with round-the-clock 24-hour support, can step up to Pro at only $12 per site. The idea behind it, ‘no website left behind’, is that serious security should not be only for those with deep pockets. Pro brings WooCommerce support, traffic monitoring, password policies, longer audit trails, more frequent and more numerous scans, and tools that make managing security rules easier.
Features That Make Shield Security a Great Choice:
- It is one of very few security plugins that lets you limit who can open its own settings.
- Its protection works quietly in the background and does not pester you with alerts.
- No other security plugin gives you three free two-factor methods, and you decide who gets to use them.
- Pro is $12 per site for everyone, so you get bulk pricing without buying in bulk.
- With Pro you get 6x powerful scans that hunt down issues anywhere on your sites.
Pros
- Three kinds of two-factor login for free
- Limits who can change its settings
- Fully documented options
Cons
- More scans and audit trails need Pro
Hide My WP
Hide My WP masks your WordPress install, so nobody can easily tell which CMS powers the site. That includes attackers and spammers, plus detection tools such as Wappalyzer or BuiltWith. It is a popular pick.
Hide My WP plugin
It includes a solid intrusion detection system (IDS) that blocks attacks such as SQL injection and XSS in real time. Hide My WP is a paid plugin and costs $24.
Features That Make Hide My WP a Great Choice:
- Theme and plugin names vanish, permalinks change, and wp-admin plus the login URL go out of sight, along with more.
- PHP files cannot be reached directly, WP class names get tidied, and directory listing is switched off.
- Alerts you to suspicious behavior with full attacker details such as username, IP address and date.
- A “trust network” cuts off visits from known bad IP addresses for you.
- Simple to set up: pick a ready-made preset and deploy it in one click.
- Plays well with premium themes, other security plugins, multisite and servers running IIS, Nginx or Apache.
Pros
- Hides theme, plugins, wp-admin and login URL
- Intrusion detection against SQL injection and XSS
- One-click preset settings
Cons
- Paid only, sold on CodeCanyon
- Hiding WordPress is no substitute for updates
WebARX
WebARX is a paid security service for any PHP-based site, not only WordPress. Its claim to fame is an advanced endpoint firewall, managed from a cloud dashboard where you steer traffic for every site you run. The managed web application firewall shields you from bot attacks, fake traffic and holes in plugins.
WebARX WordPress plugin
You can write your own firewall rules, harden WordPress, make backups, track uptime and security problems, get alerts, export reports and a lot more. Setup is fairly simple too.
Features That Make WebARX a Great Choice:
- Advanced Website Firewall (Completely customizable from WebARX portal).
- Virtual patching pulls in rules on its own to fix plugin and theme vulnerabilities.
- Hardening for WordPress: 2FA, reCAPTCHA, automatic security headers, brute force blocking, a new wp-admin path, cookies and more.
- If a site goes offline, uptime checks ping you by email and in Slack.
- Branded PDF security reports, with your logo on them, ready to hand to clients.
- Centralized security for unlimited websites.
Pros
- Virtual patching of plugin and theme vulnerabilities
- Cloud firewall for unlimited sites
- Custom PDF security reports
Cons
- Paid only
- Now called Patchstack
Wordfence, Sucuri Security, All In One WP Security & Firewall, Shield Security and Defender all have strong free versions on wordpress.org. WP fail2ban is completely free.
Google Authenticator (miniOrange) and Shield Security do it for free, and Defender has Google two-step verification. In iThemes Security and SecuPress it is a Pro feature.
Server-level protection from your host is often faster and more effective. A plugin like Wordfence or Sucuri adds scanning, monitoring and login protection on top.
VaultPress and the paid Jetpack plans include backups and restores. BulletProof Security backs up the database in its free version.
