Disclosure: This content is reader-supported, which means if you click on some of our links that we may earn a commission.
If you are reading this post because your site’s been hacked, download Sucuri now and get the company’s help completely removing the problem right now. For everyone else, Wordfence is my top recommendation to protect your WordPress.
Don’t be a sitting duck. Hacks can bleed your budget dry and destroy your company’s reputation. If your visitors’ information gets compromised, they have a good reason not to come back.
Using the best WordPress security plugins, you’ll be able to prevent attacks from happening in the first place.
Bad actors will see that your site isn’t worth the trouble, given how many unprotected WordPress sites are still out there.
My WordPress sites are the lifeblood of my business. With major revenue on multiple sites, I know I’m a prime target.
I’ve got a lot of experience with WordPress security plugins. I want to share some of what I have learned so that you can make sure that your site, visitors, and reputation stay safe.
Here are the top WordPress security plugins and a short guide to help you find the right one for your site.
#1 – Sucuri Security Review — The Best for WordPress Developers
Sucuri Security helps companies protect websites of all kinds. Its WordPress security plugin is a good way to harden your site and prevent damaging attacks.
I don’t recommend the free Sucuri plugin as a standalone solution. It doesn’t come with access to a website firewall, which I consider a fundamental element of WordPress security.
If you are a web developer or an agency that sells or manages WordPress sites for their clients, the cost of paying for Sucuri is nothing compared to the benefits it delivers.
Sites experiencing crippling DDoS attacks have installed Sucuri and been fine within an hour. After getting hacked, WordPress administrators have reached out to Sucuri and had their site clean and running before the day is done.
These are just some of the common stories Sucuri users have shared.
If you are responsible for ensuring your clients’ WordPress site protection, look no further than Sucuri. You’ll be able to get an in-depth picture of exactly what’s happening on each site and automated alerts if something goes wrong.
Sucuri is constantly scanning your sites for malware. Unlike Wordfence, Sucuri scans remotely (from their servers), so you are not drawing on your own resources for scans or loading up your database.
The other benefit of remote malware scanning is that all the data is safely stored with Sucuri, so attackers can’t delete logs to cover their tracks. You will always know exactly what happened and how.
In the event that a site gets hacked, there’s no better ally to have in your corner than Sucuri. There are zero hidden costs for complete malware removal.
Unless you’re a fairly skilled software engineer, making sure a hack is 100% cleaned up is incredibly difficult. With Sucuri, it’s guaranteed.
Like I said, you have to have a paid Sucuri license to access the firewall. The reason is that it’s a best-in-breed product. Sucuri can’t just give it away.
It automatically blocks all unencrypted traffic, DDoS attacks, bots, brute force attacks, password cracking, and malicious code. You also get fine-grained control over IP whitelisting to ensure that only appropriate users have access to admin panels.
You can also block visitors from certain countries. This can be very important if you notice a high number of attacks coming from a particular location.
There are some vulnerabilities with a cloud-based firewall, which is why Wordfence’s endpoint firewall works so well. Sucuri solves this problem by including website server-side scanning.
This protects you from phishing pages, backdoors, spam and other types of attacks that won’t get picked up by Sucuri’s remote malware scanner.
The Sucuri Security plugin is free, but to take advantage of many of the features I just listed, you will need to get the full platform.
There are three tiers available:
- Basic: $199.99/year per site
- Pro: $299.99/year per site
- Business: $499.99/year per site
The difference in tiers has more to do with how your service requests are prioritized. You also get more frequent malware and hack scans with more expensive plans.
Business-tier licenses include a malware removal SLA of six hours. If your client’s site gets hacked in the dead of the night, it is guaranteed to be back up by the time everyone gets back to work.
With the other plans, you still get the complete malware removal, but it may take more time, depending on the complexity and severity of the attack.
All plans come with a secure 24/7 ticketing system for customer support and a 30-day money-back guarantee.
If you are looking for a free WordPress security plugin, I’d go with one of the other options on this list.
But if you have clients that depend on you to manage their WordPress sites, paying $20-40 for the Sucuri platform is well worth the top-notch protection and peace of mind.
#2 – Jetpack Review — The Best for Improving Your Whole Site
Jetpack is one of the easiest ways to make your WordPress site faster and more secure. It’s like a dozen plugins in one, allowing you to do more with less.
This isn’t just convenient and efficient—it’s way safer. Plugins are the #1 target of WordPress hackers. Using fewer plugins decreases your attack surface.
In terms of security-specific features, Jetpack isn’t as robust as Wordfence or Sucuri, but it may have enough to get the job done for your WordPress sites.
It covers the basics, like automated plugin updates, 2FA, brute force attack protection, spam prevention, and malware scanning.
Anyone can find their way around the intuitive interface, no engineering chops necessary. For tech novices, Jetpack can be a refreshingly easy way to manage WordPress security:
You also get automated backups of your site. That’s a feature reserved for an add-on charge with Sucuri or another plugin with Wordfence. Oh, and you get unlimited storage for backups, which is huge for people with ecommerce sites.
Plus, the single Jetpack plugin also gives you tools to design a beautiful site and grow your traffic.
I’m focusing on the security side of Jetpack in this post, but know that it comes loaded with design, growth, and performance features that you won’t get with other options on this list.
Each of those features is one less plugin you need to install, which hardens your WordPress security in a real way.
Like I said, Jetpack is designed for general users. Yes it’s powerful, but it’s stupid simple to figure out.
Even if you are not at your desk when you receive an alert, Jetpack’s mobile app will walk you through the process of setting things right:
Jetpack is actually hosted by WordPress, which means all of these great tools aren’t putting a strain on your servers. Like any plugin, it can still slow down your site, but it’s nothing compared to the 20-30 plugins you’d need to replace it.
The reason that some people complain that Jetpack is slowing their site way down is usually that it’s in conflict with another plugin, or they’ve enabled Jetpack modules they aren’t using.
This is not hard to fix. The most popular modules are enabled by default, but you can control all your Jetpack features on one page:
Simply enable the ones you want, disable the ones you don’t, and watch the website performance issues fade into the rear-view.
Jetpack Free comes with a very helpful set of security features, including brute force attack protection, two-factor authentication, daily backups, daily scans, and automatic plugin updates.
Throw in the design, growth, and performance features, and you’ve got one of the better all-around WordPress plugins on the market.
The paid plans for Jetpack provide more security features—like spam prevention—and a much more comprehensive activity log to audit your site.
Pricing breaks down into three tiers:
- Jetpack Backup: $7.95/month
- Jetpack Security Daily: $19.95/month
- Jetpack Security Real-time: $59.95/month
- Jetpack Complete: $79.95/month
As you might expect, the difference between Jetpack Security Daily and Real-time plans refers to the frequency of backups and scans. Instead of happening once a day, Jetpack Security Real-time scans and backs up your site continuously.
You also get a one-year activity log with Real-time instead of the 30-day archive that comes with Jetpack Security Daily.
For ecommerce and membership sites with a lot of active visitors, the additional protections that come with Jetpack Security Real-time are really valuable. If your site is a lot of static content, the Daily plan will probably be enough.
If you are just focused on security, don’t worry about Jetpack Complete. It doesn’t come with any relevant features that aren’t included with Jetpack Security. The difference is in the CRM software features, which are great for managing customer relationships, but I won’t get into them here.
All of the tools that come with Jetpack Free will work on all of the WordPress sites you manage. The paid features work, too, but you have to purchase licenses for each site.
When problems or confusion arise, Jetpack has what they describe as a “global team of Happiness Engineers ready to provide incredible support.” It’s tantalizing, but what does it mean?
Well, Jetpack is made by Automattic—the same folks who run WordPress—so it’s safe to say you will be getting quality support from experts who know their stuff.
If Jetpack isn’t getting it done, you can request to cancel within 14 days and receive a full refund.
I highly recommend Jetpack for people who are new to WordPress, as it makes managing a site much easier. It’s also great for people who want to increase security and decrease the number of plugins they’re relying on.
#3 – Wordfence Security Review — The Best for Multiple WordPress Sites
Wordfence is one of the top-rated WordPress security plugins with an outstanding free version that’s packed full of essential security features.
Simply install the free plugin available on WordPress.org and share an email address that Wordfence will use to send you notifications. Whenever there is an outdated plugin, malicious file, or virus detected, you’ll be notified immediately.
Wordfence is an especially good option for people with lots of WordPress sites to protect. Wordfence Central lets you manage security across all of your sites in a single interface.
There are no charges or restrictions for Wordfence Central. From the intuitive dashboard, quickly track security events and configure alerts to be sent by email, SMS, or Slack.
Looking at the security capabilities at your disposal, it’s hard to imagine a better or cheaper way to protect all of your sites.
The Wordfence security scanner checks all your WordPress core files, themes, and plugins for a wide range of potential issues, such as:
- Bad URLs
- Backdoors
- Code injection
- Malicious redirects
- SEO spam
And that’s with the free version. The only difference with the paid version is that the scanner checks to make sure your site and IP haven’t been blacklisted and it updates in real-time with the Wordfence Threat Defense Feed.
Because Wordfence protects more than 4 million WordPress sites, the company has incredible insight into the latest threats, malware signatures, and necessary firewall rules.
Premium Wordfence users get the latest security updates from the Threat Defense Feed in real-time. With the free version you have to wait 30 days for the updates to kick in.
The web application firewall (WAF) is really well-developed as well. Stop spam, bots, brute force, and DDoS attacks in their tracks.
Unlike other WordPress security plugins, Wordfence uses an endpoint firewall instead of a cloud-based one, which means that the firewall actually runs on the server it is protecting.
This picture simplifies what’s going on and how a cloud-based firewall can cause problems that won’t happen with a WordPress-specific, endpoint firewall:
The combination of a strong firewall and malware scanner is further enhanced by Wordfence login security.
You get two-factor authentication (2FA) that uses temporary one-time passwords and login page CAPTCHA forms to prevent bots from breaking into your site.
Wordfence Live Traffic, which is included with the free version, gives you a real-time picture of what’s happening on your site by producing logs at the server level. This captures a lot more information than data visualization software like Google Analytics.
The tradeoff is that enabling Live Traffic can put a serious strain on your server resources.
This is why Wordfence has a reputation as a plugin that will slow down your site. This is especially true for people on shared hosting plans.
I recommend setting Live Traffic to “Security Only,” which will only track successful logins, attempted logins, and other security-related incidents. This will decrease the load on your server.
The free version of Wordfence is going to be more than enough for most WordPress owners, even if they have a ton of different sites.
If you need the extra protection afforded by Wordfence Premium, licenses start at $99/year per site, with discounts for volume purchases and longer contracts.
Should you be unhappy with how it’s going, you can let Wordfence know within a month and they will give you a refund.
#4 – All In One WP Security & Firewall Review — The Best Free Forever WordPress Security Plugin
All In One WP Security & Firewall is a straightforward option that’s beloved by people who would never call themselves WordPress security gurus. I’m thinking of those who are great at using WordPress for their business but less confident with the technical backend.
Regardless of your level of WordPress know-how, All In One will make the process of protecting your site as simple and clear as possible.
The plugin is also free forever. There is no paid version. Every feature and function they list is yours upon installation, with no upsells coming your way.
The tradeoff is that you are going to have to do a lot more on your own than you would with a plugin like Sucuri. Like I said, though, All In One makes it as painless as possible to maintain your WordPress security.
Let’s dig in.
After you install the plugin, you’ll see a simple dashboard with a Security Strength Meter and a Security Points Breakdown:
No degree necessary to understand these. The score on the meter is based on the number of security features you’ve enabled. The breakdown explains how the points are scored.
It’s great to get a quick temperature read and easy to figure out how to increase your score if the needle moves into the danger zone.
There’s also a Critical Feature Status box which, as you might guess, shows you the whether or not the most important security features are enabled:
If you’ve had to disable these features for any reason, this way you won’t forget to turn them back on.
So far, not too complicated.
What about the other features that impact your security score and protect your site?
All In One rates features as Basic, Intermediate, and Advanced according to how likely they are to cause problems on your site.
Basic features will improve security without much impact. Intermediate and Advanced features may impact other parts of your site, depending on the other plugins you are using.
With All In One, you can enable features one by one. The feature ratings let you know how careful you have to be.
This fixes a common problem people encounter using WordPress security plugins. You mess with one firewall setting and, all of a sudden, another plugin breaks.
Some of the highlight security capabilities that you can control confidently with All In One are:
- Password strength tool
- Auto detect duplicate login names
- Brute force attack prevention
- Track and block login attempts
- Add Google reCAPTCHA
- Database and file security tools
- Blacklist unwanted IPs
- Flexible firewall
- Scan WordPress for changes
- Spam prevention
This isn’t even everything that’s included. You’ll notice there are some features that you definitely have to pay for elsewhere. This is because they aren’t as deep.
The scanner, for example, will alert you to any changes that have been made to your WordPress system, but it’s not going to detect or remove malware with the precision of Sucuri.
In other words, All In One lets you know something is wrong, but you have to figure out how to fix it.
Support is also limited to posting questions on the community forum. It’s certainly not concierge service—which is to be expected for a totally free plugin.
So your questions may get addressed in a day or two, but that’s a far cry from the on-demand customer service provided by paid plugins.
All In One is updated routinely and constantly evolving. Experts designed it for non-experts to use. It’s been a blessing to hundreds of thousands of WordPress owners who have never had to pay a cent. Maybe it’s for you, too.
#5 – Hide My WP Review — The Best Protection from Theme Detectors and Bots
WordPress security is a many-headed hydra. Beyond just stopping direct and brute force attacks, you have to worry about keeping the core updated, as well as vulnerabilities and exploits of your plugins and even your site theme.
Hide My WP helps keep your site security tight while also concealing key elements of your site from snooping parties.
This plugin is super effective at the essentials of WordPress security. Its firewall automatically blocks SQL injections, brute force attacks, and many other security intrusions. You can also use it to block IP addresses and visitors from specific locations.
There’s also its built-in trust network that adds extra protection from bots and hackers.
But what I find coolest and most interesting about Hide My WP is right in the name—its capability to hide the fact that you’re using WordPress.
Look, I love WordPress and so do millions of others. But with well-known access points and tons of third-party plugins and themes to use, you’re always fighting a battle against those who would use that information against you.
With Hide My WP, you can prevent others from theme and plugin detectors. That means not only keeping bad actors from knowing potential weak points but also concealing your website configuration and design from competitors. That’s a nice bonus value.
Hide My WP also masks the two entry points everyone knows, WP-Login and WP-Admins. With this plugin you can hide the former and either hide or rename the latter so that no one can just walk through your front door.
On top of all that, you get a robust dashboard that reports attacks, blocks, IP addresses, and more.
And, it’s just $24 for a license. If you want developer support that stretches for a whole year, you’ll pay just over $31 in total. That’s a pretty good deal for a plugin that both covers all the necessary security bases and has features for hiding your WordPress login portals, theme, and plugins.
Protect yourself from traditional and emergent attacks, including theme and plugin detectors, but going with Hide My WP.
What I Looked at to Find the Best WordPress Security Plugin
Keeping your WordPress protected from attack is important. Finding the right security plugin will make that task easier.
Finding the wrong one could break your site, leave it vulnerable, or slow it to a crawl.
You want the increased security without the headaches, so which one do you choose?
Use these criteria to evaluate your options. This will help you find a reputable WordPress security plugin that covers your bases and works well for your site.
Plugin Credibility
Experimenting with new plugins is a ton of fun, just not for security purposes.
Only use those that are popular and widely trusted. It’s not hard to do. You’ll find basically everything you need to know on the WordPress plugins page.
As you scan your options, you can quickly tell how many people have installed the plugin and how highly it’s rated by users:
This is all really good news. More than 4 million people are using Wordfence, and it has 4.5 out of 5 stars. That’s pretty much the gold standard of plugin credibility.
There’s no hard and fast rule about ratings and installations. Just don’t try something that only a few thousand people have used. Let other people work out the kinks.
Clicking on Wordfence, you’ll find a description of the plugin along with a closer look at some key information:
I’d steer clear of plugins that haven’t been updated in a year. Cybersecurity evolves way too quick for that kind of pace. There may be lots of new vulnerabilities since the last time it was patched.
You can also dive into the ratings and read reviews. This is a good idea for credibility, but also to see how the security capabilities work in the real-world:
Finding a highly-rated plugin will tell you whether or not it lives up to expectations.
At the end of the day, just with what’s working already for WordPress users, especially those in similar situations to yourself.
Security Capabilities
What do you need your WordPress security plugin to do? Many users know they want their site protected, but don’t know what that entails.
Here are some of the hallmark security capabilities and how they protect you:
- Automated backups to restore your site if something happens
- Automated updates of WordPress core and plugins
- Security alerts that notify you immediately when something goes wrong
- Malware scanning to ensure your site is clean
- Spam protection for your forms and comment section
- Uptime monitoring to alert you if the site goes down
- Brute force protection to stop bots or attackers from cracking passwords
- Blocklist/Blacklist monitoring ensures your site is not flagged by regulators
- IP monitoring to block known attackers
- Activity Log to track and audit changes on your site
- Two-Factor Authentication (2FA) to secure logins
- Web Application Firewall (WAF) to block malicious traffic before it reaches your site
- CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. It’s going to prevent bots from filling out forms or logging in to your site.
You’d be surprised how much of this is covered by the free plans on this list. The difference with the premium plans (besides the faster turnaround from customer service) is that you get a greater degree of protection and control over these capabilities.
For instance, with Wordfence free plan, the malware scanner covers core files, themes, and plugins for a range of potential cyberthreats. With premium Wordfence, your scanner is updated in real-time as new malware signatures are discovered. The free version only updates 30 days later.
Looking at your different options, there are tradeoffs. Sucuri users get blacklist monitoring for free, which only comes with premium Wordfence.
With Sucuri, however, only premium licenses get a website firewall, whereas Wordfence includes that standard.
Assess the tradeoffs. If you already have a firewall, then the free version of Sucuri is more appealing.
Resource Usage
This is something to consider with any type of plugin, which all take up processing and server power to do their jobs.
WordPress security plugins are notorious for hogging resources. There’s just no getting around it, malware scans and traffic logs of security incidents are going to put a strain on your system.
Think about this in terms of your hosting provider and situation. What kind of resources do you have, and what’s the cost of going over the limit?
You also want to be aware of the control you have over a WordPress security plugin. Configuring it properly may solve a lot of the resource-related issues.
For example, you can disable the live feed for Wordfence or ask it to only log security-related incidents instead of all traffic. Many users report that this is all you need to do, should Wordfence be slowing your site down.
Jetpack is hosted by WordPress. That means there’s no draw on your servers, though memory and CPU usage can be an issue. Fortunately, Jetpack gives you fine-grained control over which modules are enabled, which can help you manage resources efficiently.
Plugin Compatibility
If WordPress is one part of your larger online platform, be sure to do a little research on how the plugin will work across your entire ecosystem.
WordPress security plugins prevent bad things from happening to your site, but sometimes the added protections can get in the way of legitimate users or cause other plugins to break.
Jetpack will play nicely with WooCommerce, as both plugins are made by the same company. In fact, Jetpack will probably increase site speed for Woo.
On the other hand, if you are using the BuddyPress plugin, which turns your site into a social media venue, Jetpack has been known to cause issues.
I recommend going back to the reviews to establish some sense of how compatible each WordPress security plugin really is:
The one-star reviews are my favorite to read. They are where you find the situations where your plugin doesn’t work well, though I tend to skip the reviews written in all caps.
There is also some degree of responsibility on your end for making sure that plugins play well together.
I really like All In One WP Security for this because they help you understand which features of their plugin are most likely to impact other plugins you are using.
It can be hard to forecast plugin compatibility, but it’s not something you want to put off. See what you can find out ahead of time.
Responsive Support
When you select a free WordPress security plugin, you are only going to get so much in the way of support. With All In One, for example, there’s really no one to reach out to beyond the community forum on WordPress.org.
With plugins from WordFence, Sucuri, and Jetpack, you at least have someone to call, though a prompt response time is only guaranteed with their paid options. With Wordfence Premium, you get direct access to expert advice, whereas their free support may take a few days to reply.
You’re going to notice the biggest difference in customer service when something bad happens.
After a hack, Sucuri is going to clean and restore your site. No other product I’ve reviewed includes that level of support.
With Wordfence, for example, you have to pay for a site cleaning service that’ll run you $490 per WordPress site.
If you have suffered attacks before, or you have a WordPress that does a large amount of business, paying the higher price for Sucuri’s best-in-class customer service is more than just peace of mind. It may end up saving you and your clients a ton of money in the long run.
Conclusion
In terms of WordPress security, plugins are part of a larger battle. These are my top picks to get you started:
- Sucuri Security – Best for WordPress developers
- Jetpack – Best for improving your whole site
- Wordfence Security – Best for multiple WordPress sites
- All In One WP Security & Firewall – Best free forever WordPress security plugin
- Hide My WP – Best protection from theme detectors and bots
You still want to practice common sense security hygiene—strong passwords, no admin accounts named “administrator”, always updating plugins and themes, and so on.
Even if you have the best plugin, lapses in these areas can result in issues.
All In One WP Security & Firewall is going to help you stay on top of this, ensuring people are using strong passwords and alerting you when plugins need to be updated. It’s an easy way to protect your site and enforce best practices at the same time.
Using Jetpack means you can probably stop using 10-20 other plugins, which is going to make your site more manageable and secure. On top of that, you can shield your WordPress from many of the most common attacks.
Wordfence and Sucuri lead the pack in terms of security capabilities. The free version of Wordfence is definitely better than the free version of Sucuri. Between the two paid options, it’s going to come down to your specific needs.
If you own multiple sites, Wordfence is going to be very easy to use. The Wordfence central dashboard will let you track and respond to events across all of your sites in real-time.
If you are developing lots of sites for clients, Sucuri will deliver peace of mind to everyone involved. Their security auditing tools are second to none, and their reputation for post-hack response is unparalleled.
If concealing your WordPress site’s plugins and themes is top-of-mind, look no further than Hide My WP. You get all the security features you expect, plus ways to hide your login portals, theme choices, and plugins being used.
Plugins aren’t just for security. If you liked this post, check out my favorite plugins here for SEO, contact forms, increasing traffic and more.
