Wordfence Security
Endpoint firewall, malware scanner and login security plugin for WordPress, with paid tiers for real-time threat data and hands-on incident response.
80
Defender Security
WPMU DEV's WordPress security plugin with malware scanning, AntiBot firewall, 2FA with passkeys, hardening and audit logs; Pro adds scheduled scans.
Free installs80K+WordPress.org, active
Est. Pro installs~6.8KLikely 3.4K–14K
Vendor claims1M+ usersVendor's own figure
Rating4.8/5334 reviews
Price from$60/yrFreemium
Last updated29 Sep 2026Version 6.3.0
Overview
Defender is the security plugin from WPMU DEV. It combines a malware and vulnerability scanner, a set of firewall modules, login security, one-click hardening recommendations and an audit log. The free version on WordPress.org is broad; Defender Pro is sold on its own or comes with any WPMU DEV membership and on WPMU DEV hosting.
What the free plugin does
- Scanning: compares core, plugin and theme files with WordPress.org originals, checks for known vulnerabilities and flags suspicious code such as injected eval() calls. Scans run on your server and are started manually in the free version.
- Firewall: login lockouts, 404 detection, a malicious bot detector, user-agent banning, IP allow and block lists, MaxMind-based country blocking and the AntiBot Global Firewall, which blocks IPs using data from 750,000+ sites once you connect a free WPMU DEV account.
- Login security: 2FA via authenticator app, backup codes, email fallback and WebAuthn (biometrics or hardware keys), a custom login URL, pwned-password blocking, forced password resets and session-hijacking protection.
- Hardening: around a dozen recommendations applied in one click, from disabling XML-RPC and the file editor to blocking user enumeration, preventing PHP execution in writable folders and adding security headers.
Recaptcha and Cloudflare Turnstile can be added to login, registration and password reset forms, and an audit log records logins, user changes, content edits and settings changes.
Defender Pro
Pro adds scheduled scans with automated email reports, Safe Repair and quarantine of infected files, and fuller management through The Hub, WPMU DEV’s multi-site dashboard. Membership includes 24/7 support and the rest of WPMU DEV’s Pro plugins.
Limitations
There is no signature-based web application firewall in the plugin itself; WPMU DEV’s WAF is only for sites on its hosting. There is no virtual patching, no offsite scanning and no automatic updating of vulnerable plugins. Defender is a good choice for people who want a free plugin with wide login and hardening coverage, and especially for existing WPMU DEV members.
Best for: Site owners who want a broad free security plugin with strong login protection, and WPMU DEV members who get Pro at no extra cost.
Defender's free version covers more ground than most, including country blocking, passkey-style 2FA and pwned-password checks. Its weak spots are the lack of a request-filtering WAF and that automation (scheduled scans, reports) is reserved for Pro, but for WPMU DEV members it is an easy default.
Pros
- Free malware, file-change and vulnerability scanning
- Country blocking, 404 detection and bot traps included free
- 2FA with WebAuthn hardware keys and biometrics in the free plugin
- Pwned-password blocking, forced resets and a custom login URL
- One-click hardening including security headers
- Audit log of user, content and settings events
Cons
- Scheduled scans and automated reports need Pro
- No signature-based WAF unless hosted with WPMU DEV
- No virtual patching or auto-update of vulnerable plugins
- Global Firewall and Hub features require a WPMU DEV account
- Scans run on your server and can be slow on large sites
Key features
What Defender Security highlights on its WordPress.org page and its own website, split by version.
Free version WordPress.org
- Malware and suspicious code scanning
- Core, plugin and theme file change checks
- Known vulnerability detection
- AntiBot Global Firewall IP blocking
- Login lockouts and 404 detection
- Country blocking via MaxMind
- reCAPTCHA and Cloudflare Turnstile
- 2FA with app, email and WebAuthn
- Custom login URL
- Pwned password blocking
- One-click hardening and security headers
- Audit logging
Pro / paid adds From $60/yr
- Scheduled automatic scans
- Automated security email reports
- Safe Repair and quarantine of files
- Manage IPs and settings from The Hub
- 24/7 expert support
- Included with WPMU DEV membership
- White-label reporting for agencies
- Expert malware removal help
Feature checklist
21 of 26 features we track in Security Plugins, feature score 79/100
Firewall & blocking 6/7
Web application firewall Key
Filters malicious requests (SQL injection, XSS and similar) before they reach WordPress.
Plugin offers lockouts, bot and UA blocking; the request-filtering WAF is for WPMU DEV-hosted sites only.
Partial
Cloud / DNS-level firewall
Firewall runs on the vendor's network in front of your server, not inside WordPress.
No proxy in front of the site; the hosted WAF is limited to WPMU DEV hosting.
Not included
Brute-force protection Key
Limits failed logins and locks out attackers guessing passwords.
Configurable lockouts after failed logins (default 5 in 300 seconds).
Included
Login CAPTCHA
CAPTCHA or Turnstile on login, registration and password reset forms.
reCAPTCHA or Cloudflare Turnstile for login, registration and reset forms.
Included
Rate limiting & bot blocking
Throttles or blocks aggressive crawlers and bad bots.
404 detection, malicious bot trap and user-agent banning throttle abusive crawlers.
Included
Country blocking
Block or allow traffic by country.
Location banning using the free MaxMind GeoLite2 database.
Included
Real-time IP blocklist
Blocks IPs known for attacks using shared threat intelligence.
AntiBot Global Firewall blocks IPs from data across 750K+ sites; needs a WPMU DEV connection.
Included
Scanning & cleanup 5/6
Malware scanner Key
Scans files and database for malware, backdoors and injected code.
Free scan for suspicious code, injections and backdoors.
Included
File change detection
Compares core, plugin and theme files with originals and flags changes.
Compares core, plugin and theme files with WordPress.org originals.
Included
Vulnerability alerts Key
Warns when installed plugins, themes or core have known vulnerabilities.
Checks active plugins, themes and core against known vulnerability registries.
Included
Scheduled scans
Runs scans automatically on a schedule.
Scheduled scans with reports are Pro-only; free scans are manual.
Paid version Pro
Off-site scanning
Scans run on the vendor's servers so they don't slow your site.
Scans run on the site's own server (with a 3-hour timeout).
Not included
Malware removal
One-click or expert cleanup of infected sites.
Safe Repair and quarantine of infected files are Pro; no free cleanup service.
Paid version Pro
Login security 5/5
Two-factor authentication Key
Second login factor via authenticator app, email or similar.
Authenticator app, backup codes and email fallback; can be enforced per role.
Included
Passkeys / WebAuthn
Passwordless login with passkeys or hardware security keys.
WebAuthn login with biometrics or USB hardware security keys.
Included
Password policies
Enforce strong passwords, expiry or breached-password checks.
Blocks pwned passwords and can force a site-wide password reset.
Included
Custom login URL
Move or hide the wp-login.php / wp-admin login page.
Mask Login Area replaces wp-login.php and wp-admin with a custom slug.
Included
Session management
View and end active user sessions, limit concurrent logins.
Session-hijack protection and login duration control, but no active-session list.
Partial
Hardening 2/5
One-click hardening
Disable XML-RPC, file editing, user enumeration and similar weak points.
One-click tweaks: disable XML-RPC and file editor, stop user enumeration, block PHP in uploads.
Included
SSL / HTTPS tools
Enforce HTTPS, fix mixed content and redirects.
No HTTPS enforcement or mixed-content tools in the hardening list.
Not included
Security headers
Set HSTS, CSP, X-Frame-Options and other HTTP security headers.
Hardening includes adding headers such as HSTS and XSS protection.
Included
Virtual patching
Firewall rules that block exploits for known plugin vulnerabilities before an update is available.
No virtual patching rules are offered.
Not included
Auto-update vulnerable plugins
Automatically updates plugins with known vulnerabilities.
Flags outdated or vulnerable plugins with manual update buttons only.
Not included
Monitoring & management 3/3
Activity log Key
Records logins, changes and admin actions for auditing.
Audit log of logins, users, content, plugins and settings; CSV export.
Included
Security alerts
Email or app alerts for attacks, lockouts and scan results.
Lockout and scan notifications by email; automated scheduled reports with Pro.
Included
Multi-site dashboard
Manage security for many sites from one dashboard.
The Hub manages IP lists across sites with a free account; full reports and management with Pro.
Partial
Pricing
Free
$0On WordPress.org
Pro Basic
$60per year1 site
Shown at $36/yr with a '40% off forever' offer; includes the WPMU DEV toolkit.
Pro Standard
$100per year3 sites
Shown at $60/yr with the same offer.
Pro Plus
$200per year10 sites
Shown at $120/yr with the same offer.
WPMU DEV Premium
$1,200per yearUnlimited
Full membership ($100/month); hosting discounts, white-label reselling. 30-day money-back.
Prices are list prices from the vendor's site, checked 14 Oct 2026. Many vendors discount the first year.
How many sites use Defender Security?
Free installs from WordPress.org, the vendor's own claim, and our estimate of paid installs.
Free version (WordPress.org)
80K+
Active installations reported by WordPress.org.
Vendor claim
1M+ users
Sites/users claimed on the vendor's website. source
Estimated Pro / paid installs
~6.8K
Our estimate, see method below.
How we estimated this: About 85K free installs x 8% (the usual share of free sites that also run the paid version when most features are free, and Pro is included in a wider membership) gives 6.8K. The vendor figure (1M+ users) is more than 8 times the free installs, so it probably counts more than this plugin (other products or platforms) and we leave it out. Likely range: 3.4K to 14K. This counts sites running the paid version, including sites whose licence has lapsed. Estimates are rough and based on public figures as of 14 Oct 2026.
Stats & health
Weekly downloads
4,764 downloads last week, 4.4M all time
Rating breakdown
| Version | 6.3.0 |
|---|---|
| Last updated | 29 Sep 2026 (34 days ago) |
| Tested up to | WordPress 7.1.4 |
| Requires | WordPress 6.4+, PHP 8.0.0+ |
| Support threads (2 months) | 4 of 4 resolved |
| On WordPress.org since | 7 Jun 2017 |
Company & policy
| Refund policy | 30-day money-back (source, 5 Oct 2026) |
|---|---|
| Trustpilot rating | 4.8 (3,102 reviews) (source, 5 Oct 2026) WPMU DEV company rating as displayed on the Defender page. |
Defender Security compared
Defender Security/Jetpack Protect
Defender Security/Patchstack
Defender Security/WP Cerber Security
Defender Security/Limit Login Attempts Reloaded
Defender Security/MalCare Security
Defender Security/Shield SecurityDefender Security/Wordfence Security
Defender Security/Kadence Security (formerly Solid Security)
Defender Security/Sucuri Security
All-In-One Security (AIOS)/Defender Security
Defender Security/Really Simple Security Alternatives to Defender Security
Sucuri Security
Free auditing, file integrity and remote scanning plugin from Sucuri that connects to its paid cloud firewall and malware cleanup platform.
87
Shield Security
Automated WordPress security plugin with firewall, silentCAPTCHA bot detection, 2FA and audit log; ShieldPRO adds malware and vulnerability scanning.
84
MalCare Security
Cloud-scanning WordPress security plugin with a plugin-level firewall, login protection and paid one-click malware cleanup, for site owners and agencies.
80
Kadence Security (formerly Solid Security)
Login-focused WordPress security plugin (formerly Solid Security / iThemes Security) with 2FA, brute-force protection and Patchstack virtual patching in Pro.
77
WP Cerber Security
Self-distributed WordPress security plugin with firewall, anti-spam, malware scanner, 2FA and custom login URL; PRO adds GEO rules and scheduled scans.
69
FAQ
Is Defender Security free?
Yes. Defender Security has a free version on WordPress.org. Paid plans start at $60/yr.
How many sites use Defender Security?
WordPress.org reports 80K+ active installations of the free version. The vendor claims 1M+ users sites in total. We estimate around 6.8K sites run the paid version.
Does Defender Security have web application firewall?
Yes: partial. Plugin offers lockouts, bot and UA blocking; the request-filtering WAF is for WPMU DEV-hosted sites only.
Does Defender Security have brute-force protection?
Yes: included. Configurable lockouts after failed logins (default 5 in 300 seconds).
Does Defender Security have malware scanner?
Yes: included. Free scan for suspicious code, injections and backdoors.
Does Defender Security have vulnerability alerts?
Yes: included. Checks active plugins, themes and core against known vulnerability registries.
Does Defender Security have two-factor authentication?
Yes: included. Authenticator app, backup codes and email fallback; can be enforced per role.
Does Defender Security have activity log?
Yes: included. Audit log of logins, users, content, plugins and settings; CSV export.
What does Defender Pro add over the free version?
Mainly automation and management: scheduled scans with email reports, Safe Repair/quarantine and fuller control from The Hub, plus 24/7 support.
Is Defender Pro included in a WPMU DEV membership?
Yes. Every WPMU DEV plan includes the full Pro plugin suite, and WPMU DEV hosting comes with Defender Pro preinstalled.
Does Defender have a web application firewall?
The plugin offers lockouts, bot traps, user-agent and IP blocking plus the AntiBot Global Firewall. A full WAF is provided only on WPMU DEV hosting.
Does it work on multisite?
Yes, the readme states all security features are compatible with multisite installations.
Last updated 5 Oct 2026. Spotted something wrong? Suggest an edit.