1
Wordfence Security Included
Endpoint WAF in free version; free rules arrive 30 days after Premium.
80feature score
WordPress Security Plugins with Web application firewall
Filters malicious requests (SQL injection, XSS and similar) before they reach WordPress. 11 of the 12 plugins we track include it.
2
Sucuri Security Paid version Basic Firewall
Paid Sucuri firewall filters malicious requests; the plugin only connects to it.
87feature score
3
Defender Security Partial
Plugin offers lockouts, bot and UA blocking; the request-filtering WAF is for WPMU DEV-hosted sites only.
79feature score
4
Shield Security Included
Firewall rules block malicious requests in the free plugin.
84feature score
5
MalCare Security Included
Plugin-level firewall blocks SQLi, XSS and other OWASP classes; advanced rule set on Protect and up.
80feature score
6
Kadence Security (formerly Solid Security) Paid version Kadence Pro
Firewall with Patchstack rules and custom request rules is part of Pro.
77feature score
7
WP Cerber Security Included
Traffic Inspector screens suspicious requests and code injection attempts.
69feature score
8
All-In-One Security (AIOS) Included
PHP and .htaccess firewall with 6G/8G rules, XSS and XML-RPC protection.
61feature score
9
Really Simple Security Partial Pro
Pro firewall uses automated access rules (404s, regions, IPs) rather than payload inspection.
54feature score
10
Patchstack Paid version Personal protection
Paid plans filter requests with vPatch rules and unlimited custom firewall rules; free has no firewall.
60feature score
11
Jetpack Protect Paid version Jetpack Scan
Free allows manual IP rules only; automatic WAF rules need Jetpack Scan.
51feature score