WordPress security plugins: firewalls, scanners and hardening explained

WordPress security plugins do four different jobs: blocking malicious requests (a firewall), finding malware or changed files (scanning), locking down logins and settings (hardening), and warning you when something you run has a known vulnerability (alerts or virtual patching). Most plugins combine two or three of these, and none of them replaces keeping WordPress, themes and plugins updated.

The risk is concentrated in add-ons. Patchstack's State of WordPress Security in 2026 report found 11,334 new vulnerabilities in the WordPress ecosystem in 2025: 91% in plugins, 9% in themes and just 6 in WordPress core. It also reported that 46% of vulnerabilities were not fixed in time for public disclosure, which is the gap a firewall or virtual patch is meant to cover.

This guide explains each layer, what core and your host already provide, how to evaluate a security plugin, and how well-known options such as Wordfence, Sucuri, Kadence Security (formerly Solid Security) and Patchstack differ. It is a guide, not a ranking.

What WordPress core and your host already do

Core security is solid and actively maintained:

• Automatic security updates. Minor and security releases install automatically by default. For the July 2026 critical release (7.0.2), WordPress.org enabled forced updates for affected sites.
• Plugin and theme auto-updates. Since 5.5 you can opt in per plugin and per theme; they run twice a day.
• Password hashing. WordPress 6.8 moved to bcrypt.
• Application Passwords (since 5.6) for API access without sharing the main password.
• Hardening constants. The official hardening guide explains that DISALLOW_FILE_EDIT in wp-config.php removes the built-in theme and plugin file editors.

What core does not include: a web application firewall, malware scanning, login attempt limits, or two-factor authentication. The official hardening guide recommends two-step authentication, which you add with a plugin such as the WordPress.org-maintained Two Factor plugin or a security suite.

Many managed hosts add a server or network firewall, malware scanning and cleanup. Ask your host what they cover so you do not pay twice or stack conflicting firewalls.

The four layers of WordPress security

1. Firewall (WAF)

A web application firewall inspects requests and blocks known attack patterns. There are two kinds:

• Endpoint firewalls run inside WordPress on your server. Wordfence describes its firewall as protecting "at the endpoint, enabling deep integration with WordPress". They see WordPress context (users, roles) but still consume your server's resources.
• Cloud or DNS-level firewalls sit in front of your server, so bad traffic is filtered before it arrives. Sucuri's firewall (a paid service) and Cloudflare work this way. They also absorb some traffic spikes, but setup involves DNS changes.

2. Scanning

Scanners compare core files against official versions, look for known malware signatures, and flag changed files. Server-side scanners see files directly; remote scanners, like the free scanner in the Sucuri plugin, check what the public site serves.

3. Hardening and login protection

This covers two-factor authentication, passkeys, login attempt limits, CAPTCHA on login, blocking compromised passwords and disabling features you do not use. Brute-force protection matters because login pages are attacked constantly.

4. Vulnerability alerts and virtual patching

Vulnerability tools match your installed plugins and themes against a database of known issues and alert you. Virtual patching goes a step further, deploying a targeted rule that blocks exploitation of a specific vulnerability until you can update. Patchstack's free plugin alerts you; its paid plans add virtual patching.

How to evaluate a security plugin

1. Which layers you need. If your host already runs a firewall and malware scanning, you may only need login hardening and vulnerability alerts.
2. Rule and signature freshness. Check whether the free tier gets new firewall rules and signatures immediately or on a delay.
3. Maintenance. Check "last updated" and "tested up to". A security plugin that falls behind is a liability.
4. Performance impact. Endpoint firewalls and server-side scans use CPU and memory. Test on staging and schedule scans for quiet hours.
5. Its own security history. Security plugins are code too; check how quickly past issues were fixed.
6. Support and cleanup. Check whether malware removal is included or extra, and how fast the vendor commits to respond.
7. Lock-in and uninstall. Some firewalls add an auto_prepend_file setting or .htaccess rules. Make sure uninstalling removes them cleanly, or you can lock yourself out.

Our plugin security article covers how to vet any plugin's code and vendor.

Well-known security plugins

Listed in no particular order. Install bands are from WordPress.org and pricing from each vendor's site, as of October 2026.

Notes: Wordfence's 30-day delay for free users is stated on its WordPress.org listing; we could not load its pricing page to confirm current paid prices, so check wordfence.com directly. Sucuri's plan tiers (Basic $229, Pro $339, Business $549 per year) differ by scan frequency and malware-removal response time, per its signup page. Sucuri says its firewall is not included free in the plugin. Kadence Security's WordPress.org listing still uses the better-wp-security slug, so existing installs update in place. Patchstack's pricing page says personal plans are available through partners and resellers.

Common mistakes

• Stacking suites. Two firewalls or two scanners can block each other, double server load and produce confusing alerts.
• Relying on a plugin instead of updating. A firewall reduces risk during the window before a patch; it does not make outdated plugins safe.
• Ignoring alerts. Vulnerability notices only help if someone acts on them. Patchstack reported a weighted median time to first exploit of 5 hours for heavily targeted vulnerabilities.
• Leaving inactive plugins installed. Their files can still be reached and exploited. Delete what you do not use.
• No backups. If a site is compromised, a clean, recent, off-site backup is the fastest way back. See the backup plugins guide.

A practical security baseline

1. Enable automatic minor core updates (default) and turn on auto-updates for low-risk plugins; review the rest weekly. See WordPress updates and auto-updates.
2. Require two-factor authentication for every administrator and editor.
3. Add brute-force protection and a firewall: from your host, a cloud service or one security plugin.
4. Subscribe to vulnerability alerts for the plugins and themes you run.
5. Set DISALLOW_FILE_EDIT and remove unused plugins, themes and admin accounts.
6. Keep off-site backups and test a restore.

The full checklist is in our WordPress security guide, and if you are dealing with an active infection, start with what to do when WordPress is hacked.

What to do when a vulnerability alert arrives

1. Check the details. Note the affected versions, whether the flaw needs a logged-in user, and whether it is reported as exploited.
2. Update if a fix exists. Take a backup, update, and check the affected feature. For critical issues, update the live site first and test right after.
3. If no fix exists, deactivate the plugin if you can live without it, or rely on a firewall or virtual patching rule while you wait.
4. Look for signs of compromise if the flaw was exploitable before you patched: new admin users, changed files, unknown scheduled tasks or redirects.
5. Record what you did, so the next person knows the history of the site.

Our guide to security patching and plugin updates goes deeper on update workflows.

Conclusion

Choose security tools by layer, not by brand. Decide what your host already covers, then fill the gaps with one main plugin or service: a firewall, scanning, login hardening and vulnerability alerts. Keep everything updated, act on alerts quickly and keep tested backups. If you would rather have someone else watch this, eSEOspace includes updates, monitoring and backups in its website maintenance services. More guides are in our WordPress hub.

Frequently asked questions