Wordfence Security
Endpoint firewall, malware scanner and login security plugin for WordPress, with paid tiers for real-time threat data and hands-on incident response.
80
Jetpack Protect
Automattic's lightweight security plugin with free daily vulnerability scans and brute-force protection, upgradable to Jetpack Scan malware scanning and WAF.
Free installs100K+WordPress.org, active
Est. Pro installs~18KLikely 9K–36K
Rating4.6/5123 reviews
Price from$119.40/yrFreemium
Last updated12 Aug 2026Version 6.1.0
Overview
Jetpack Protect is a standalone security plugin from Automattic. It does not need the main Jetpack plugin, but it does connect your site to WordPress.com, because scanning and threat data are handled on Jetpack’s cloud infrastructure rather than on your server.
What the free version covers
Free sites get a daily automated scan of WordPress core, plugins and themes against the WPScan vulnerability database, with results and recommended actions shown in a Protect dashboard. Brute-force protection blocks login attempts from botnets and IPs that have attacked other sites in the Jetpack network, with a math CAPTCHA as a fallback for legitimate users who are blocked. The firewall screen lets you add manual rules to block or allow specific IP addresses and ranges, and an Activity Log page was added to wp-admin in 2026.
What the upgrade adds
- Daily malware scanning with one-click fixes for most threats.
- Automatic web application firewall rules maintained by Jetpack that block harmful requests and known exploits.
- Instant email alerts when threats are found, and priority support.
These come with Jetpack Scan, which renews at $9.95 a month billed yearly, or the Jetpack Security bundle at $19.95 a month billed yearly, which adds real-time VaultPress backups, Akismet and a 30-day activity log. First-year prices are discounted.
Limitations
Protect has almost no login-hardening controls: no two-factor authentication, passkeys, password rules, login URL change or session tools, and no HTTP security headers or SSL features. There is no country blocking or rate limiting, and scanning does not work for local or non-public sites. Jetpack Scan is also not available for multisite networks.
Who should pick it
It is a good low-maintenance choice for site owners already in the Jetpack ecosystem, or anyone who wants off-server vulnerability and malware scanning without tuning settings. Sites that need detailed login security or hardening should add another plugin or choose a fuller suite.
Best for: Site owners in the Jetpack ecosystem who want hands-off cloud vulnerability and malware scanning rather than detailed security settings.
Jetpack Protect does a few things well with almost no setup: daily vulnerability checks, brute-force blocking and, with Jetpack Scan, cloud malware scanning and auto-updating firewall rules. It lacks the login and hardening controls of fuller suites, so treat it as a scanning layer rather than a complete solution.
Pros
- Free daily vulnerability scans using WPScan data
- Scanning runs on Jetpack's cloud, not your server
- Brute-force protection on by default
- Works without the main Jetpack plugin
- Paid upgrade adds one-click malware fixes and automatic WAF rules
Cons
- No 2FA, passkeys or password policy
- No login URL change, hardening toggles or security headers
- No country blocking or rate limiting
- Requires a WordPress.com connection; no scanning for local sites
- Jetpack Scan does not support multisite
Key features
What Jetpack Protect highlights on its WordPress.org page and its own website, split by version.
Free version WordPress.org
- Daily automated vulnerability scans
- WPScan vulnerability database
- Recommended fixes in the Protect dashboard
- Brute-force login protection
- Manual IP block and allow rules
- Activity Log page in wp-admin
- Cloud-based scanning, no server load
- Works without the Jetpack plugin
Pro / paid adds From $119.40/yr
- Daily malware scanning
- One-click fixes for most threats
- Automatic firewall rules
- Instant email threat alerts
- Priority support
- Real-time backups (Security bundle)
- 30-day activity log (Security bundle)
- Akismet spam protection (Security bundle)
Feature checklist
13 of 26 features we track in Security Plugins, feature score 51/100
Firewall & blocking 4/7
Web application firewall Key
Filters malicious requests (SQL injection, XSS and similar) before they reach WordPress.
Free allows manual IP rules only; automatic WAF rules need Jetpack Scan.
Paid version Jetpack Scan
Cloud / DNS-level firewall
Firewall runs on the vendor's network in front of your server, not inside WordPress.
WAF runs on your server (optionally before WordPress loads).
Not included
Brute-force protection Key
Limits failed logins and locks out attackers guessing passwords.
Blocks botnet and repeated login attempts by default.
Included
Login CAPTCHA
CAPTCHA or Turnstile on login, registration and password reset forms.
Math CAPTCHA appears only as a fallback when an IP is blocked.
Partial
Rate limiting & bot blocking
Throttles or blocks aggressive crawlers and bad bots.
No crawler or bot throttling controls.
Not included
Country blocking
Block or allow traffic by country.
No country or geo blocking.
Not included
Real-time IP blocklist
Blocks IPs known for attacks using shared threat intelligence.
Brute-force protection uses Jetpack network data at login; site-wide lists are manual.
Partial
Scanning & cleanup 5/6
Malware scanner Key
Scans files and database for malware, backdoors and injected code.
Daily malware scanning with Jetpack Scan.
Paid version Jetpack Scan
File change detection
Compares core, plugin and theme files with originals and flags changes.
Core file comparison not documented on pages checked.
Not verified
Vulnerability alerts Key
Warns when installed plugins, themes or core have known vulnerabilities.
Daily scans of core, plugins and themes against WPScan data.
Included
Scheduled scans
Runs scans automatically on a schedule.
Automatic daily scans; manual scans can also be triggered.
Included
Off-site scanning
Scans run on the vendor's servers so they don't slow your site.
Scans run on Jetpack's cloud infrastructure.
Included
Malware removal
One-click or expert cleanup of infected sites.
Automated one-click fixes for most detected threats; no human cleanup.
Paid version Jetpack Scan
Login security 0/5
Two-factor authentication Key
Second login factor via authenticator app, email or similar.
No 2FA in the plugin.
Not included
Passkeys / WebAuthn
Passwordless login with passkeys or hardware security keys.
No passkey support.
Not included
Password policies
Enforce strong passwords, expiry or breached-password checks.
No password rules.
Not included
Custom login URL
Move or hide the wp-login.php / wp-admin login page.
Cannot change the login URL.
Not included
Session management
View and end active user sessions, limit concurrent logins.
No session tools.
Not included
Hardening 1/5
One-click hardening
Disable XML-RPC, file editing, user enumeration and similar weak points.
No hardening toggles such as disabling XML-RPC or file editing.
Not included
SSL / HTTPS tools
Enforce HTTPS, fix mixed content and redirects.
No HTTPS tools.
Not included
Security headers
Set HSTS, CSP, X-Frame-Options and other HTTP security headers.
No security header settings.
Not included
Virtual patching
Firewall rules that block exploits for known plugin vulnerabilities before an update is available.
Automatic firewall rules block known threats as they are found.
Paid version Jetpack Scan
Auto-update vulnerable plugins
Automatically updates plugins with known vulnerabilities.
Recommends updates but does not auto-update vulnerable plugins.
Not included
Monitoring & management 3/3
Activity log Key
Records logins, changes and admin actions for auditing.
Activity Log page added in v6.1; full 30-day history is in Jetpack Security.
Partial
Security alerts
Email or app alerts for attacks, lockouts and scan results.
Instant email notifications when threats are found.
Paid version Jetpack Scan
Multi-site dashboard
Manage security for many sites from one dashboard.
Agencies can track sites and security alerts in the Automattic for Agencies dashboard.
Partial
Pricing
Free
$0On WordPress.org
Jetpack Scan
$119.40per year1 site
Listed as $9.95/month billed yearly; first year 50% off ($4.95/month). Malware scans, one-click fixes, automatic WAF rules.
Jetpack Security
$239.40per year1 site
Listed as $19.95/month billed yearly; first year $9.95/month. Adds VaultPress Backup, Akismet and 30-day activity log.
Prices are list prices from the vendor's site, checked 14 Oct 2026. Many vendors discount the first year.
How many sites use Jetpack Protect?
Free installs from WordPress.org, the vendor's own claim, and our estimate of paid installs.
Free version (WordPress.org)
100K+
Active installations reported by WordPress.org.
Vendor claim
—
The vendor does not publish a total.
Estimated Pro / paid installs
~18K
Our estimate, see method below.
How we estimated this: About 150K free installs x 12% (the usual share of free sites that also run the paid version when a hosted service whose free tier is limited) gives 18K. Likely range: 9K to 36K. This counts sites running the paid version, including sites whose licence has lapsed. Estimates are rough and based on public figures as of 14 Oct 2026.
Stats & health
Weekly downloads
4,188 downloads last week, 2.7M all time
Rating breakdown
| Version | 6.1.0 |
|---|---|
| Last updated | 12 Aug 2026 (83 days ago) |
| Tested up to | WordPress 7.0.8 |
| Requires | WordPress 6.9+, PHP 7.2+ |
| Support threads (2 months) | 3 of 4 resolved |
| On WordPress.org since | 31 May 2022 |
Jetpack Protect compared
All-In-One Security (AIOS)/Jetpack Protect
Jetpack Protect/Patchstack
Jetpack Protect/WP Cerber Security
Jetpack Protect/Limit Login Attempts Reloaded
Jetpack Protect/MalCare Security
Jetpack Protect/Shield Security
Defender Security/Jetpack ProtectJetpack Protect/Wordfence Security
Jetpack Protect/Kadence Security (formerly Solid Security)
Jetpack Protect/Sucuri Security
Jetpack Protect/Really Simple Security Alternatives to Jetpack Protect
Sucuri Security
Free auditing, file integrity and remote scanning plugin from Sucuri that connects to its paid cloud firewall and malware cleanup platform.
87
Defender Security
WPMU DEV's WordPress security plugin with malware scanning, AntiBot firewall, 2FA with passkeys, hardening and audit logs; Pro adds scheduled scans.
79
Shield Security
Automated WordPress security plugin with firewall, silentCAPTCHA bot detection, 2FA and audit log; ShieldPRO adds malware and vulnerability scanning.
84
MalCare Security
Cloud-scanning WordPress security plugin with a plugin-level firewall, login protection and paid one-click malware cleanup, for site owners and agencies.
80
Kadence Security (formerly Solid Security)
Login-focused WordPress security plugin (formerly Solid Security / iThemes Security) with 2FA, brute-force protection and Patchstack virtual patching in Pro.
77
FAQ
Is Jetpack Protect free?
Yes. Jetpack Protect has a free version on WordPress.org. Paid plans start at $119.40/yr.
How many sites use Jetpack Protect?
WordPress.org reports 100K+ active installations of the free version. We estimate around 18K sites run the paid version.
Does Jetpack Protect have web application firewall?
Yes: paid version (Jetpack Scan). Free allows manual IP rules only; automatic WAF rules need Jetpack Scan.
Does Jetpack Protect have brute-force protection?
Yes: included. Blocks botnet and repeated login attempts by default.
Does Jetpack Protect have malware scanner?
Yes: paid version (Jetpack Scan). Daily malware scanning with Jetpack Scan.
Does Jetpack Protect have vulnerability alerts?
Yes: included. Daily scans of core, plugins and themes against WPScan data.
Does Jetpack Protect have two-factor authentication?
No: not included. No 2FA in the plugin.
Does Jetpack Protect have activity log?
Yes: partial. Activity Log page added in v6.1; full 30-day history is in Jetpack Security.
Do I need the main Jetpack plugin to use Jetpack Protect?
No. Protect runs on its own, though it connects the site to a WordPress.com account so that scans can run on Jetpack's servers.
What is the difference between Jetpack Protect and Jetpack Scan?
Protect is the free plugin with vulnerability scans, brute-force protection and manual firewall rules. Jetpack Scan is the paid upgrade that adds malware scanning, one-click fixes, automatic firewall rules and email alerts.
Does Jetpack Protect include two-factor authentication?
No. Protect has no 2FA or passkey features; you would need another plugin or WordPress.com account-level 2FA for logins handled through Jetpack.
Will it work on a local or staging site?
Scanning requires a publicly accessible site, so local development sites are not supported.
Last updated 5 Oct 2026. Spotted something wrong? Suggest an edit.