If you want the short answer, start with Wordfence for firewall and malware scanning, add Patchstack so you hear about vulnerable plugins before attackers do, and turn on two-factor authentication with Sigil for every account with admin access.
That combination deals with the most common ways WordPress sites get compromised, and you can set all three up without paying a cent.
The rest of this list is about filling the gaps that combination leaves, whether that’s malware cleanup, an audit trail of who changed what, or showing customers that your store is safe to buy from.
Security stopped being theoretical for us when wpmayor.com was hit by a carding attack, with bots hammering our WooCommerce checkout to test stolen card numbers. We fixed it at the checkout layer, and it was a useful reminder that the attack you plan for isn’t always the one that turns up.
Every plugin recommended below is actively maintained, and I’ve organised them by the job they do, because no single security plugin covers everything.
The Best WordPress Security Plugins at a Glance
| Plugin | Best for | Free version | Paid from |
|---|---|---|---|
| Wordfence Security | Firewall and malware scanning | Yes, with rules and signatures delayed 30 days | About $149/year per site |
| Patchstack | Vulnerability alerts and virtual patching | Yes, up to 3 sites | $5/site per month for virtual patching |
| MalCare | Off-site scanning and malware cleanup | Yes, weekly scans, no cleanup | $99/year (cleanup from $299/year) |
| Kadence Security | Hardening and login security | Yes | Bundled with Kadence Pro |
| All-In-One Security | A free all-rounder | Yes | $44.50 first year for 2 sites |
| Sucuri | Cloud firewall plus a cleanup service | Monitoring plugin only | $229/year per site |
| Sigil | Passkeys and two-factor authentication | Yes | Optional Pro add-on |
| WP Activity Log | An audit trail of every change | Yes | $139/year |
| Security Ninja | Security audits for smaller sites | Yes | $119/year |
| PCrisk Trust Badge | Showing visitors your site is clean | Monthly scan, no badge | $16.95/month |
How We Chose These Plugins
Every plugin on this list had to clear four bars.
- It has to be actively maintained, with recent releases and testing against current WordPress versions, because an abandoned security plugin is a vulnerability in its own right.
- It has to do a distinct job well rather than duplicate another pick.
- Its free version has to be genuinely useful rather than a demo, and where a feature is paid, we say so.
- Finally, the developer needs a track record in WordPress and of fixing security issues in its own code quickly, which matters more in this category than any other.
1. Wordfence Security
Wordfence is still the default security plugin for most WordPress sites, and for good reason. It combines an endpoint firewall, a malware scanner and login security in one plugin, and it’s estimated to have between 5 and 6 million active installs with a 4.7 rating across more than 5,000 reviews.
The catch with the free version is timing. Free users get the same firewall rules and malware signatures as Premium users, but 30 days later, which is a long window when a vulnerability is being actively exploited. Scans also run on your own server, so they’ll use more resources than an off-site scanner.
Key Features
- A web application firewall that runs before WordPress loads, blocking known attack patterns and brute-force attempts.
- A malware scanner that compares your core, theme and plugin files against the official repository versions and flags anything that’s changed.
- Login security with two-factor authentication, CAPTCHA and limits on failed attempts, built into the free version.
- Real-time IP blocklisting and country blocking with Premium.
Pricing
The core plugin is free. Premium costs about $149 per year for one site and removes the 30-day delay, while the Care and Response plans add hands-on configuration and incident response from the Wordfence team.
2. Patchstack
Most of the WordPress security incidents I’ve seen over the years started with an outdated plugin rather than anything in core, which is exactly the problem Patchstack tackles. It watches the plugins, themes and core version on your site, warns you as soon as one of them has a known vulnerability, and on paid plans blocks the exploit with a virtual patch until you can update.
Patchstack doesn’t scan for malware or clean up infections, so it complements a scanner like Wordfence or MalCare rather than replacing one. It has 100,000+ active installs and a 4.9 rating on WordPress.org.
Key Features
- Early warnings about new vulnerabilities in your plugins, themes and core, with the listing citing up to 48 hours ahead of public disclosure.
- Automatic updates for vulnerable software, managed from one central dashboard.
- Virtual patching (12,000+ rules on paid plans) that blocks a specific exploit without touching the plugin’s code.
- Hardening, login protection and a community IP blocklist on the Developer and Enterprise plans.
Pricing
The free plan covers up to three sites with alerts and reports. You can add virtual patching to an individual site for $5 per month, and the Developer and Enterprise plans are priced on Patchstack’s own site.
3. MalCare
MalCare comes from the team behind BlogVault, and its big advantage is that scanning happens on MalCare’s servers rather than yours. That keeps the load off your hosting, and it means the scanner still works if the site itself has been compromised.
Where MalCare really earns its place is cleanup. On the Repair plan and above, removing malware is automated, which is a very different experience from following a forum thread at 2am while your host threatens to suspend the account.
Key Features
- Off-site malware scanning, weekly on the free plan and up to hourly on the top tier.
- Automated malware removal with a post-cleanup report on the Repair and Fortify plans.
- A firewall with bot protection, geo-blocking and virtual patching on paid plans.
- Login protection and two-factor authentication, for two admin users on the free plan.
Pricing
The free plan detects malware but doesn’t remove it. Protect costs $99 per year for one site, Repair adds cleanup at $299 per year, and Fortify adds hourly scans and an annual audit at $499 per year.
4. Kadence Security Basic
If you’ve been around WordPress for a while, you’ll know this plugin as Better WP Security, then iThemes Security, then Solid Security. With version 10, it became Kadence Security, and it still has 700,000+ active installs.
The name has changed three times, but the focus hasn’t. This is a hardening and login security plugin first, and it’s one of the most thorough free options for locking down how people sign in and what your site exposes.
Key Features
- Two-factor authentication through authenticator apps, email or backup codes, plus password policy enforcement.
- Local and network brute-force protection, with the option to hide the login URL.
- Vulnerability scanning of core, plugins and themes four times a day, plus file change detection.
- Passkeys, magic links and Patchstack-powered virtual patching in the Pro version.
Pricing
The free plugin covers the hardening and login features above. The Pro features are now sold as part of the Kadence bundles, which start at $350 per year, so you can’t purchase it alone.
5. All-In-One Security (AIOS)
All-In-One Security is now developed by Team Updraft, the people behind UpdraftPlus, and it’s one of the most generous free security plugins available. It has more than a million active installs and is still updated regularly.
Its strength is breadth. You get a firewall, login protection, file change detection and spam protection in the free version, with each feature clearly explained, which makes it a good choice if you want one free plugin to handle most of the basics.
Key Features
- A PHP and .htaccess firewall that blocks common attack patterns before they reach WordPress.
- Login lockdown, renaming the login page and two-factor authentication.
- File change detection and comment spam protection.
- Malware scanning, country blocking and blocking of visitors who trigger lots of 404 errors in Premium.
Pricing
The core plugin is free. AIOS Premium starts at $44.50 for the first year for up to two sites, renewing at $89 per year.
6. Sucuri
Sucuri is a little different from the rest of this list, because the plugin is only part of the product. The free Sucuri Security plugin handles monitoring, while the real protection comes from Sucuri’s paid platform, which puts a cloud firewall and CDN in front of your site so attacks are filtered before they reach your server.
That makes it a strong choice for sites that face a lot of hostile traffic or that can’t afford to stay infected for long, since every platform plan includes unlimited malware and hack removal by Sucuri’s team.
Key Features
- Security activity auditing, file integrity monitoring and remote malware scanning in the free plugin.
- Blocklist monitoring, so you’ll know if Google or another service flags your site.
- A cloud-based firewall and DDoS protection on the paid platform (the plugin’s firewall isn’t free).
- Unlimited malware cleanup, with faster response times on higher plans.
Pricing
The plugin is free. Platform plans start at about $229 per site per year, with the Pro and Business tiers adding faster cleanup times and more frequent scans.
7. Sigil 2FA
Stolen and guessed passwords are still one of the easiest ways into a WordPress site, which is why two-factor authentication belongs on any security shortlist. Sigil is a free 2FA plugin that also lets people sign in with a passkey, using Face ID, Touch ID, Windows Hello or a hardware security key instead of a password.
Its standout feature is how carefully it handles rollout. A setup wizard gets the first administrator enrolled before anything is enforced, it won’t let you require 2FA for your own role until you’ve set up a method yourself, and a grace period gives existing users time to enrol before the requirement starts.
In the interest of transparency, Sigil is developed by WP Mayor’s founders at RebelCode. We also have a list of the best 2FA plugins if you want to consider the alternatives in detail.
Key Features
- Passkeys, authenticator apps, email codes and backup codes, with passkeys usable as a full passwordless sign-in.
- Per-role enforcement, a 2FA column on the Users screen, and email notifications when someone’s second factor changes.
- Limits on repeated wrong passwords across the login form, XML-RPC and the REST API, and no password-only access over XML-RPC or REST for anyone with a second factor.
- A WooCommerce My Account tab, a shortcode for front-end enrolment, multisite support, and imports from Two Factor, Wordfence and WP 2FA.
Pricing
Sigil is free, and everything runs on your own site with no external service or account. A separate Sigil Pro add-on is available for extra features.
8. WP Activity Log
When something goes wrong on a site, the first question is usually who changed what, and when. WP Activity Log by Melapress answers that by keeping a detailed record of user and system activity, from logins and failed login attempts to content edits, plugin installs and settings changes.
It’s the plugin I’d install first on any site with more than a couple of users, and it’s especially valuable for agencies that need to show clients exactly what happened on their site.
Key Features
- A log of user activity, content changes, plugin and theme changes, and WordPress settings changes.
- Coverage for popular third-party plugins, including WooCommerce, Yoast SEO, Gravity Forms, WPForms and MemberPress.
- Real-time alerts, reports and user session management in Premium.
- Mirroring logs to external services such as a syslog server or AWS CloudWatch.
Pricing
The core plugin is free. Premium starts at $139 per year for one site, with Enterprise plans for compliance-heavy setups.
9. Security Ninja
Security Ninja has been around since 2011 and has been reviewed here on WP Mayor. It’s a good fit for site owners who want to understand their security setup rather than hand it over to a black box. Its core is a set of 50+ security tests that check your site for common misconfigurations and explain how to fix them.
It’s lighter than the bigger suites, and it now includes a firewall and malware scanner, which makes it a sensible single plugin for smaller sites.
Key Features
- 50+ security tests covering configuration, file permissions and common weaknesses.
- A malware scanner for WordPress core, plugins and themes.
- A firewall, login protection and scheduled scans with email reports.
- One-click hardening fixes and MainWP integration for managing multiple sites.
Pricing
The core plugin is free. Security Ninja Pro costs $119 per year for one site, dropping to $259 per year for five sites.
10. PCrisk Trust Badge
PCrisk Trust Badge takes a different angle to the rest of this list. Rather than hardening your site or blocking attacks, it scans your site from PCrisk’s own servers against more than 90 security sources, including Google Safe Browsing, Spamhaus, PhishTank and URLhaus, then shows visitors a badge backed by the result.
What sets it apart from the static “secured by” seals you’ve probably seen is that the badge is dynamic. It only displays while your latest scan is clean, and it links to a public report showing the scan date, a trust score and the engines used. If a scan flags a problem, the badge hides itself and you get an email with the details, so your site never carries an outdated safety claim.
It detects and reports rather than fixing anything, so you’ll want to pair it with one of the plugins above. You can find the full breakdown in our PCrisk Trust Badge review.
Key Features
- Off-site scanning for malware, phishing, obfuscated scripts and SSL problems, with no extra load on your server.
- A dynamic badge that hides when a scan fails and links to a public trust report.
- Dedicated badge placements on WooCommerce shop, product, cart and checkout pages.
- Email alerts on all paid plans, plus Slack, webhooks and an API from the Pro plan up.
Pricing
The free plan gives you a monthly scan with a trust score and summary, but no badge. Solo costs $16.95 per month for one domain with daily scans and the badge, and every plan includes a 14-day free trial.
Worth a Mention: Jetpack Protect
If your site already runs Jetpack, Jetpack Protect is worth a look. The free plugin checks your plugins and themes for known vulnerabilities every day and adds a basic firewall, while real-time malware scanning and automatic fixes require a paid Jetpack Security or Scan plan.
How to Build Your WordPress Security Stack
The mistake I see most often is treating security as a single plugin you install and forget. A better approach is to cover four jobs: blocking attacks, catching vulnerable software, controlling who can log in, and knowing what changed. Here’s how I’d put that together for the three types of site we hear about most.
| Site type | Firewall and scanning | Vulnerabilities | Logins | Extras |
|---|---|---|---|---|
| Blog or brochure site | Wordfence (free) or AIOS | Patchstack (free) | 2FA for admins with Sigil or Kadence Security | Your host’s backups |
| WooCommerce store | Wordfence Premium or MalCare | Patchstack with virtual patching | 2FA for admins and shop managers | WP Activity Log and PCrisk Trust Badge on checkout |
| Agency portfolio | MalCare or Sucuri for cleanup cover | Patchstack across every client site | Enforced 2FA by role | WP Activity Log for client accountability |
A few rules apply whichever stack you choose:
- Don’t run two firewall or malware scanning plugins on the same site, because they’ll conflict, duplicate work and slow things down.
- Keep off-site backups that you’ve actually tested restoring.
- Pick a host that handles security at the server level too, since a plugin can only do so much once a request has reached WordPress.
Frequently Asked Questions
Do I Need a Security Plugin if My Host Already Provides Security?
Usually, yes. Host-level protection such as a server firewall and malware scanning is valuable, but it can’t see inside WordPress the way a plugin can. A plugin is what enforces two-factor authentication, logs user activity and warns you about a vulnerable plugin on your specific site.
Can I Run More Than One Security Plugin?
Yes, as long as they do different jobs. Patchstack, Sigil, WP Activity Log, and PCrisk Trust Badge all sit happily alongside a firewall plugin. Running two firewalls or two malware scanners, such as Wordfence and AIOS together, is where conflicts and slowdowns start.
Is the Free Version of Wordfence Enough?
For a low-traffic blog, it’s a solid baseline. For a store or a client site, the 30-day delay on firewall rules and malware signatures is a real gap, so either upgrade to Premium or pair the free version with Patchstack’s virtual patching.
What Should I Do if My Site Has Already Been Hacked?
Take a full backup of the infected site first, so you have a record of what happened, then change every admin password and hosting credential. From there, a cleanup service such as MalCare’s Repair plan or Sucuri’s platform is usually faster and more thorough than trying to remove malware by hand.
Do Security Plugins Slow Down WordPress?
Some do, especially plugins that run large malware scans on your own server. Off-site scanners like MalCare and PCrisk Trust Badge, and cloud firewalls like Sucuri’s, keep most of that work away from your hosting.
Is Two-Factor Authentication Really Necessary?
For anyone who can install plugins or edit content, yes. A stolen password alone shouldn’t be enough to take over a site, and passkeys now make the extra step close to effortless. Our best 2FA plugins guide goes into much more detail.
Final Thoughts
The WordPress security market looks very different from a few years ago. Firewalls have moved to the cloud, vulnerability services can now warn you before many exploits reach your site, and passkeys are finally making strong logins easy enough that people actually use them.
What hasn’t changed is that the sites that get hurt are usually the ones running outdated plugins with a single password standing between an attacker and the admin dashboard.
If you only do three things after reading this, install a firewall and scanner, add vulnerability monitoring, and turn on two-factor authentication. Everything else on this list makes those three stronger.
What does your own security stack look like right now, and is there a plugin you’d argue deserves a place on this list? Let me know in the comments.
94 Responses
Great list of wordpress plugins! Thanks.
This is a detailed analysis, good work. I can never go that in-depth
I will bookmark this excellent post which I will follow for my actual and next projects with WordPress. Thank you.
Hey there .. thanks for posting this .. it has clear my judgement about Jetpack I was considering it as a safety plugin but now i have come to know it is not.
Great Such a nice collection of security plugins.really nice keep it up with good sharing.
Wonderful post. A cyber attack can happen with any CMS. If you look around where banks and multinational companies are attached, most of them do not use WordPress and they still have a huge damage to their system. I will bookmark this excellent post which I will follow for my actual and next projects with WordPress. Thank you.
I use AIT SECURITY WORDPRESS PLUGIN – aitsecurity.net should be on your list!
Great article. Even though plugins like WordFence and Sucuri are pretty enough to secure your WordPress website from hackers but as an additional security experts recommend to install two step authentication and audit log to make it impossible to break it. Thanks for sharing.
I’ve personally tried using Site Guarding (www.siteguarding.com) as a preventative measure against website malware, etc. and had a terrible experience with them.
After subscribing to their service the very next day my Joomla website was down. I had received an email from them explaining that the site was down due to the changes they made and were working on fixing the issue. After several days of downtime and ridiculous excuses as to why the site was down (that included blaming my very popular hosting provider) I finally removed their access to the site. At this point I requested a refund on their services as they obviously didn’t do a thing for me other than destroy my site. To my surprise, they said that they completed their work and that I owed them the money. Mind you, it took my hosting company and I over TWO WEEKS to fix the site and get it back to working condition.
Obviously this is a very shady company and I would strongly advise anyone that’s considering using their services to move on and find a different security company.
Hey There,
Great list, you might want to check out our new plugin BruteGuard which is a 100% free cloud powered brute force protection plugin. Each site using it joins a network of sites that help each other to protect you against botnet attacks in the smartest way possible.
WordPress is a great platform to do SEO on it because you have many plugins! Security plugins plays an important role when attacking hacker’s Thanks for sharing this great article with us. This article was very helpful for beginners keep sharing
You covered almost all security based plugins with full of description. From this list i used All in One WP Security & Firewall Plugin for my Website.
Thank you
This is quite a nice list . Would be great if you add some more and update it. I am using Anti-Malware from GOTMLS.NET and its good.Is there any other service that provide scan and fix for free ??
Thanks
Awesome collection. I am using All in WP and security that offers lots of options to secure WordPress. Other mentioned plugins too are valuable and I am experienced with some of them.
Thanks for such a nice article!!
It helps me.
i Would like to suggest User Blocker Plugin.
it provide the ability to block or unblock user account Quickly and effortlessly.
Great list of wordpress plugins. It helps with the WP Smush is a great plugin that speeds up my website.
I tried almost all of the plugins you listed here and found no one is fully perfect for me. But the problems I faced with them were not big. A plugin made me confused about the settings, another one started to send me scary notifications regarding hacking attempts, one has locked me out from my site….ha ha ha!
Finally, I left all except one. This is iThemes Security, the great plugins for me to be from all tension of my security. Thanks for keeping this plugin with the list.
blablabla … sorry for that. I had almost try all above plugins, some worked some not, some functions are blocking things that I wanted to block and some plugins closed the door for any visitor.
I search an evening long to the right plugin for security and guess which plugin I installed .. Well None ! It seems to be that as soon as you install a securty plugin on a website that it attracks idiots who try to login with their admin nonsense. So no for now no plugin security for me.
Hi Jean!
Feeling great by using iThemes security plug-ins.Its provide lots of way to secure site.All the way its just pleased me by its work.Loved it.
I am using iThemes security on my blog and i am satisfied with it. It is quite good security plugin.
I am using All In One WP Security. Its really All in one. Also others plugins are good. Thanks for sharing a article on wp security issue. Any of above plugin will make our wordpress secure.
In my opinion, Ninja Firewall is the best.
Thanks for the useful list of security pllugins. Useful blog…
You should try LCS Security – works really well. My site was under a barrage of failed login attempts and some adware content got injected somehow. This plugin looks like a newcomer, but it really got rid of most hacking attempts and content injection within just a few days after installation.
This is the best list about WordPress security plugin. We have to make sure WordPress security system and WP Security Audit Log would be best one. Thanks a lot for your great contribution.
Is this the same plugin as that available on CodeCanyon?
Thanks for sharing this. All the plugins that you listed here are very good. But my favorite is Sucuri Security.
This was a refreshing post that highlighted some areas I had not thought about.
Great collection. Security is one of the big concern in recent times and one should use any of these plugins to keep the website safe from attacks.
Great article.
I have seen people who install a security plugin once their website has been compromised. Don’t wait for something to happen, rather be proactive.
There is no doubt that These are the must have WordPress plugins for every blogger.
Currently I am using few of them like Yoast SEO, Jetpack, W3 Total Cache, Redirection, Wp Smush.it.
For WordPress security, I am using ” iThemes security ” also known as ” Better WP Security “.
Thanks for sharing this list with us.
Hello, friend my question is that, please tell how to secure wordpress blog /site from hackers? Is this responsibility of hosting providers or my-self. Kindly tell some plugins for wordpress.
Hi Bilqees, you can use any of the plugins mentioned above to improve your site’s security.
What about permissions to the user database?, I always put all privilegies but I think all is not ok, can you share about this?.
Hey Jean!
Would really love for you to include our WP Simple Firewall plugin in the round-up. We have stacks of awesome features.
Happy to answer any questions if you need about it!
Thanks,
Paul.
hey Jean,
one should use all plugins for security or some of them.
Which will be good for all your protection need.
great one and awesome plugins thanks for sharing 🙂
Nice article friend,
I these plugin which plugin help me to clock bots to register in my buddypress site. also allow facebook registration.
Please advise.
Great Such a nice collection of security plugins.really nice keep it up with good sharing.To know more 50+ best wordpress Plugins, go to google & search for “blog.templatetoaster” there you will be finding some best wordpress plugins.
Very Good Article
Great information, Jean!
From the ones you mentioned, “Wordfence Security” plugin, I found it a free and great solution to secure blogs and make them faster.
Tested and happy with it!
Thanks for the share.
Hi Jean,
You have missed a great free security plugin called Simple Security Firewall. It is an all in one plugin with any premium feature restriction.
Excellent post i found here which i am looking for best security plugin
I have now using Woodfence security plugin for my blog it’s Damm Good and better
Some of them seem to do the same thing… so if i had to choose. One of each kind of protection… which ones would you recommend?… (They need to be easy to set up… i am a wp rookie)
I have askimet and stop spammers in my wp site.
Thanks
Jean, we’re avid users of WordFence Free Version, but am going to be investing in the paid version for 1 of our company sites, while the other company site will have BulletProof from AITpro so we can see the difference in the level and depth these 2 big plugins go to protect the WP site.
Thanks for the write up on more plugins I never heard of. Do any seem clunky to you or do you prefer one over another?
What security measures do you take and use on this website/blog?
– Patrick
where is wordfence?
Hi, the post has now been updated again, and it now includes Wordfence also 🙂
Looks promising, i like this ”hide wordpress” thing. For me most important is to change login url, bruteforce, and hide wp.
what about pruteprotect is antivirus or not??
i need anivirus pluggin and firewall please i had just prute protect thank you!!
what about pruteprotect is antivirus or not??
Thanks a lot for these article to make WP safe!
Brian Lacouvee I advise you the plugin WP Security All In One one of Almighty which ravage right now, it’s simple easy to use rich food security, even copying text is protected.
Came across your article looking for an alternative to Best WP Security (iThemes Security). Do you have an update to your opinion now that all this mess has happened to them. I am still using their version 3.6.6. I am concerned they have removed some important features in order to offer them with the pro version. I may be completely wrong, but with what has transpired I have to wonder? Do you have a good WP Security plugin alternative to replace iThemes Security at this time?
I prefer “Security Ninja”.It’s one of the most secure wordpress plug-in I have used till now.
With the number of threats online, having a security help for our blog is very essential Good thing you posted this very informative article. Now, we are aware of how to secure our blog’s essential data. Thanks a lot for this post and please continue posting more informative articles.
Thanks for the info! I’ve been having a lot of trouble with “WordPress https” with one of my client’s sites it was making it way slow. I’m hoping “Better WordPress Security” will be better. I’ll give it a try now thanks again 🙂
thank you so much. I was facing security problems with my blog
Great thanks for this wonderful post about WordPress Security Plugins but I install some Plugins in my WordPress blog & due to lot of Plugins my website wasn’t running. It was showing me Server error. so I don’t use very many plugins.
I came here from another post on the blog: https://wpmayor.com/best-plugins-to-hide-wordpress/ at Jean’s recommendation.
Excellent tool-set collection, Jean!
And among them there is one I haven’t heard of yet (the AskApache one…) – this is so cool, I have new toys to play with, tonight…
Thanks again, Jean!
Cheers!
~Steve
That’s a great list. As well as BPS I also use Better WP Security and Secure WordPress. Of course one of the most important things is if you have a user name of “admin” change it NOW!
These are another 2 great plugins, gonna add them to the list in fact.
This is the link. It may be called GOTMLS. I really am new.
Has anyone used “Anti Malware”
thanks for the info. Greatly appreciated.
In one of the websites I manage I see lot of attempts to login to the website automatically. Those are from a particular countries and I can also trace out individual IPs from which I was attacked. I banned few countries and few countries from visiting my website. However I don’t think it’s a good method. I see lots of security plugins mentioned in this article. Is there any particular plugin that could be useful in dealing with my situation?
Thank you
Hi Jean, nice blog. Thank you. I am currently working through the maze of WP security options trying to work out what to do and use etc. This certainly helps. Bulletproof security was recommended as well as WP Defender. I assume that either will do?
BulletProof security has been established for a longer period and is very popular, while WebsiteDefender still seems to be a bit hit and miss when it comes to customer satisfaction. Personally I would go for BulletProof Security as its a one time purchase, WebsiteDefender has some way to go yet, and they don’t even show their pricing until you go to sign up, not a nice practice in my opinion.
What do you think of combining BulletProof with Antivirus for WordPress?
hi all i’ve code a new antivirus perl based.
Functions:
1) found and remove malicious file and if you want make a backup.
2) found exploitables file and suggest update
video demonstration
if someone is interesting to test please contact me
last few testing and program will be public
regards
david
Great list of plugins exactly what i needed as i have created a new wordpress site. i would have been Great if you could advice the pros and cons some plugins. But anyway it is still good source.
Agreed, that plugin really seems to be gathering a lot of traction lately.
Thank u for your list. It’s good..
thx 😉 good job
I like to know if these plugin conflict eachother.
Or which plugins work together… Anyone?
They should work together, best to try them out, its faster that way.
Thank you. Very useful plugin for wordpress security.
By the way, WordPress Firewall 2 contains 2 huge security issues (XSRF and XSS), so, it will be deactivated soon.
Keep in touch, i’ll do a “3” 😉
Thank you! i’ve been hacked some weeks ago but still lookin’ for any good protection from malware.
Perfect Article, thank you for the list, I used some them as like WP Security Scan, WP-DBManager, WordPress File Monitor Plus and AskApache Password Protect
they are good for me
best regards
Hi,
I wonder if you can offer some advice on this. I have a blog that for the last 8 weeks has been receiving unwanted subscriptions. The trouble is I don’t know how they are coming through.
I use feedburner for both my RSS and email sign up. I have removed the contact us form and replaced with email address written out (the @ replaced with at).
I have updated all of the relevant plugins and version of WP but I am still getting fake signups that go into the membership section as a subscriber (which isn’t where the email subscriptions are recorded).
I am not a dev person so am struggling. Any thoughts people?
One can also use services like Website Defender and Sucuri Site scan to check for vulnerabilities on your site. Check them out.
Preventing the WordPress blog from unsavory characters is not a problem now. These WordPress security plugins help in minimizing attacks from hackers. These snippets of information helped me with respect to the security and so I thought of sharing them with you all.
Same as @ChefGaby for this article to be(come) informative it needs links to the plugins mentioned. I tried searching for the first (Blackhole) but couldn’t find anything, so I won’t even bother with the rest!
Arghhh & Oops
Had this window already open since this am and only now had the time to read it and of course I did not refresh the page.
Seeing the links now, cheers!
OMG! I just activated and set up Bulletproof. Looks amazing! I am stoked. The real test will be watching what my monitoring service does when it scans my site tomorrow. 😉
i would also add “Better WP Security”.
Thanks for the list. Unfortunatly some of them are not very updated 🙁 but thanks anyway!
If you know of any of these have given you any problems let me know.
Hello
What about a login plugin protection like “BAW More Secure Login” (WordPress official repo) ?
What so you think about this strong authentication free plugin ?
See you !
Looks interesting Julio, nice work, always good to have more than one level of protection.
Some links to the WordPress plugins section would be nice.
I also don’t see the point in linking the images to the image itself.
I searched for the plugins myself, but linking directly to the plugin would be helpful.
Thanks for pointing that out, links added!
Great article, ,thanks for the info and shared.
Welcome Frank.