Lock it down
Firewalls, malware scanning, two-factor and backup routines for a safer site.
3 listings in this collection
Wordfence Security
Wordfence combines a web application firewall with malware scanning and login hardening in one plugin. The free tier includes the firewall ruleset, a scanner that compares core, theme and plugin files against known signatures, brute-force protection with configurable lockouts, and live traffic logging that shows requests hitting your site. Its threat intelligence feed is shared across millions of installs, which is why new plugin vulnerabilities tend to appear as firewall rules quickly. Premium adds real-time rules, country blocking, two-factor authentication and support. The scanning is thorough to the point of being slow on large sites, and the live traffic view can grow unwieldy without tuning. For a small business site that needs one security plugin and no server access, it remains the most complete free option.
Patchstack
Patchstack approaches WordPress security from the vulnerability side. It maintains a database of plugin and theme issues, watches the ones installed on your site, and can apply virtual patches at the firewall layer before an official update exists. That matters because plugin vulnerabilities are often disclosed before a fix ships, and small sites rarely update within hours. The free plan covers monitoring and alerts; paid plans add virtual patching, a firewall, and a dashboard across multiple sites. It is less of an all-in-one scanner than Wordfence and more of an early-warning and mitigation layer, which makes it a reasonable companion rather than a replacement. Agencies that maintain client sites tend to value the per-site overview and the disclosure timeline most.
Solid Security
Solid Security, formerly iThemes Security, focuses on hardening the parts of WordPress that attackers probe first. It can enforce strong passwords, add two-factor authentication, limit login attempts, rename the login URL, change database prefixes on new installs, and schedule file-change detection that compares your installation against a known-good hash. The free version covers most of that; the pro tier adds an uptime monitor, passwordless login, and priority support. Its settings screen is organised by concern rather than by feature, which makes it easier to reason about than a long checkbox list. The plugin is less interested in live traffic inspection than Wordfence, so the two are sometimes run together. It suits administrators who want a checklist of hardening measures applied consistently.