Wordfence Security
Endpoint firewall, malware scanner and login security plugin for WordPress, with paid tiers for real-time threat data and hands-on incident response.
80
MalCare Security
Cloud-scanning WordPress security plugin with a plugin-level firewall, login protection and paid one-click malware cleanup, for site owners and agencies.
Free installs100K+WordPress.org, active
Est. Pro installs~22KLikely 11K–44K
Vendor claims400K+Vendor's own figure
Rating4.4/5559 reviews
Price from$99/yrFreemium
Last updated30 Oct 2026Version 6.81
Overview
MalCare is a WordPress security service built by the team behind BlogVault. The plugin connects your site to MalCare’s web dashboard, and the heavy work of malware scanning happens on MalCare’s own servers rather than on your hosting, so scans do not add load to the site. A firewall runs inside the plugin and inspects every request before WordPress handles it.
The free plan covers cloud malware scanning, the firewall with basic rules, CAPTCHA-based login protection, vulnerability alerts, SSL monitoring and email two-factor authentication for a small number of admins. MalCare’s pricing page lists free scans as weekly, while the WordPress.org readme still describes a daily cadence, so expect the pricing page to be the current rule. Free sites also receive new firewall and virtual-patch rules on a delay.
Paid plans
- Protect adds daily scans, the advanced firewall with OWASP and custom rules, real-time IP blacklisting, bot protection, geo-blocking and immediate virtual patching.
- Repair adds automated one-click malware removal with a cleanup report, 12-hourly scans and a short activity log.
- Fortify adds hourly scans, unlimited manual cleanups by MalCare’s analysts, 60-day activity logs, host suspension recovery and an annual audit.
Paid plans also unlock hardening actions such as blocking PHP execution in upload folders, disabling the file editor, blocking plugin and theme installs, rotating security keys and forcing password resets. Agencies get white labelling and client reports.
Strengths and limitations
The main appeal is that scanning has essentially no performance cost and that cleanup is built into the product instead of being a separate service. The firewall needs no setup and sits inside the site, so it cannot be bypassed by hitting the server IP directly. On the other hand, MalCare offers little for login hardening: there is no login URL changer, password policy, passkey support or session manager, and it does not set HTTP security headers. Malware removal starts at the Repair tier, which costs considerably more than most competitors’ entry plans.
MalCare suits owners who want hands-off scanning and a reliable way to clean up a hacked site, and agencies that already manage client sites from a central dashboard.
Best for: Site owners who want zero-load cloud scanning and built-in malware cleanup, and agencies managing many client sites.
MalCare is a strong pick if your main concern is detecting and cleaning malware without slowing the site, and its firewall needs no tuning. It is thin on login-hardening tools and the plans that include cleanup are expensive, so pair it with a lightweight login plugin if you need 2FA policies or a hidden login URL.
Pros
- Malware scans run on MalCare's servers, so they do not slow the site
- Firewall works out of the box and runs before WordPress loads
- Free plan includes vulnerability alerts, SSL monitoring and login CAPTCHA
- One-click automated malware removal with cleanup report on Repair and up
- Virtual patching for known plugin and theme flaws on paid plans
- Central dashboard, white label and client reports for agencies
Cons
- Malware removal is not available until the $299/yr Repair plan
- No login URL change, password policy, passkeys or session management
- Geo-blocking and bot protection are paid-only
- Free plan scans less often and receives firewall rules days later
- Requires connecting the site to a MalCare account
Key features
What MalCare Security highlights on its WordPress.org page and its own website, split by version.
Free version WordPress.org
- Cloud-based malware scanning
- On-demand scans with no server load
- Plugin-level web application firewall
- CAPTCHA login protection against brute force
- Vulnerability alerts for plugins and themes
- Email two-factor authentication for admins
- Traffic and login logs
- SSL certificate monitoring
- IP whitelisting
Pro / paid adds From $99/yr
- One-click automated malware removal
- Unlimited expert manual cleanups (Fortify)
- Instant virtual patching of vulnerabilities
- Geo-blocking by country
- Bot protection and real-time IP blacklist
- Custom firewall rules and OWASP coverage
- Scans up to hourly
- Hardening actions in one click
- Activity log up to 60 days
- White label and client reports
- Uptime monitoring
Feature checklist
20 of 26 features we track in Security Plugins, feature score 80/100
Firewall & blocking 6/7
Web application firewall Key
Filters malicious requests (SQL injection, XSS and similar) before they reach WordPress.
Plugin-level firewall blocks SQLi, XSS and other OWASP classes; advanced rule set on Protect and up.
Included
Cloud / DNS-level firewall
Firewall runs on the vendor's network in front of your server, not inside WordPress.
Firewall runs inside the WordPress site, not as a proxy on MalCare's network.
Not included
Brute-force protection Key
Limits failed logins and locks out attackers guessing passwords.
Login protection with rate limiting of failed logins on every plan, including XML-RPC.
Included
Login CAPTCHA
CAPTCHA or Turnstile on login, registration and password reset forms.
CAPTCHA challenge on the login page is part of the free login protection.
Included
Rate limiting & bot blocking
Throttles or blocks aggressive crawlers and bad bots.
Bot protection that blocks malicious crawlers is listed from the Protect plan.
Paid version Protect
Country blocking
Block or allow traffic by country.
Geo-blocking with per-country toggles on Protect and higher.
Paid version Protect
Real-time IP blocklist
Blocks IPs known for attacks using shared threat intelligence.
Real-time IP blacklisting from MalCare's network on Protect+; free blocks known bad IPs with slower updates.
Paid version Protect
Scanning & cleanup 6/6
Malware scanner Key
Scans files and database for malware, backdoors and injected code.
Scans every file, database table and scheduled task for known and unknown malware.
Included
File change detection
Compares core, plugin and theme files with originals and flags changes.
Unexpected file changes are flagged as part of the malware scan rather than a separate checker.
Included
Vulnerability alerts Key
Warns when installed plugins, themes or core have known vulnerabilities.
Vulnerability alerts for plugins, themes and core are included in the free plan.
Included
Scheduled scans
Runs scans automatically on a schedule.
Automatic scans weekly on Free, daily on Protect, 12-hourly on Repair, hourly on Fortify.
Included
Off-site scanning
Scans run on the vendor's servers so they don't slow your site.
Scans are processed on MalCare's servers so they do not load the site.
Included
Malware removal
One-click or expert cleanup of infected sites.
Automated one-click cleanup on Repair; unlimited manual fixes by analysts on Fortify.
Paid version Repair
Login security 1/5
Two-factor authentication Key
Second login factor via authenticator app, email or similar.
Email-based 2FA; free covers 2 admin users, rising to all users on Fortify.
Included
Passkeys / WebAuthn
Passwordless login with passkeys or hardware security keys.
No passkey or hardware-key login mentioned in features or pricing.
Not included
Password policies
Enforce strong passwords, expiry or breached-password checks.
Offers a reset-all-passwords action but no strength, expiry or breached-password rules.
Not included
Custom login URL
Move or hide the wp-login.php / wp-admin login page.
No option to move or hide the login page is listed.
Not included
Session management
View and end active user sessions, limit concurrent logins.
No session listing or concurrent-login controls are listed.
Not included
Hardening 4/5
One-click hardening
Disable XML-RPC, file editing, user enumeration and similar weak points.
Paid hardening: block PHP in untrusted folders, disable file editor, block installs, rotate keys.
Paid version Protect
SSL / HTTPS tools
Enforce HTTPS, fix mixed content and redirects.
SSL certificate monitoring on all plans; no HTTPS enforcement or mixed-content fixing.
Partial
Security headers
Set HSTS, CSP, X-Frame-Options and other HTTP security headers.
HTTP security header configuration is not part of the feature set.
Not included
Virtual patching
Firewall rules that block exploits for known plugin vulnerabilities before an update is available.
Free gets virtual patches about 7 days late; immediate patching from Protect.
Partial
Auto-update vulnerable plugins
Automatically updates plugins with known vulnerabilities.
Plugins and themes can be updated from the central dashboard; auto-updating only vulnerable items is not stated.
Partial
Monitoring & management 3/3
Activity log Key
Records logins, changes and admin actions for auditing.
Activity log of logins and changes kept 7 days on Repair and 60 days on Fortify.
Paid version Repair
Security alerts
Email or app alerts for attacks, lockouts and scan results.
Email alerts for detected hacks, vulnerabilities and security events.
Included
Multi-site dashboard
Manage security for many sites from one dashboard.
Sites are managed from MalCare's web dashboard; white label and client reports are paid extras.
Included
Pricing
Free
$0On WordPress.org
Protect
$99per year1 site
5-site option $299/yr. Daily scans, advanced firewall, geo-blocking, bot protection, instant virtual patching.
Repair
$299per year1 site
5-site option $899/yr. Adds automated malware cleanup, 12-hourly scans, 7-day activity log.
Fortify
$499per year1 site
5-site option $1,499/yr. Hourly scans, unlimited manual cleanups, 60-day logs, host suspension recovery.
Prices are list prices from the vendor's site, checked 14 Oct 2026. Many vendors discount the first year.
How many sites use MalCare Security?
Free installs from WordPress.org, the vendor's own claim, and our estimate of paid installs.
Free version (WordPress.org)
100K+
Active installations reported by WordPress.org.
Vendor claim
400K+
Sites/users claimed on the vendor's website. source
Estimated Pro / paid installs
~22K
Our estimate, see method below.
How we estimated this: About 150K free installs x 12% (the usual share of free sites that also run the paid version when a hosted service whose free tier is limited) gives 18K. The vendor claims 400K+ sites in total. Taking away about 150K free installs leaves 250K, and 80% of that is 200K. Vendor totals are loose, so we only move our figure part of the way toward it, from 18K to 22K. Likely range: 11K to 44K. This counts sites running the paid version, including sites whose licence has lapsed. Estimates are rough and based on public figures as of 14 Oct 2026.
Stats & health
Weekly downloads
57,526 downloads last week, 18.9M all time
Rating breakdown
| Version | 6.81 |
|---|---|
| Last updated | 30 Oct 2026 (4 days ago) |
| Tested up to | WordPress 7.1.4 |
| Requires | WordPress 4.0+, PHP 7.0+ |
| Support threads (2 months) | 2 of 2 resolved |
| On WordPress.org since | 30 Jan 2018 |
Company & policy
| Founded | 2014 (source, 5 Oct 2026) |
|---|---|
| Refund policy | 14-day money-back (not refundable if a cleanup was already performed) (source, 5 Oct 2026) |
MalCare Security compared
Jetpack Protect/MalCare Security
MalCare Security/Shield Security
Defender Security/MalCare Security
MalCare Security/Patchstack
MalCare Security/WP Cerber Security
Limit Login Attempts Reloaded/MalCare SecurityMalCare Security/Wordfence Security
MalCare Security/Kadence Security (formerly Solid Security)
MalCare Security/Sucuri Security
All-In-One Security (AIOS)/MalCare Security
MalCare Security/Really Simple Security Alternatives to MalCare Security
Sucuri Security
Free auditing, file integrity and remote scanning plugin from Sucuri that connects to its paid cloud firewall and malware cleanup platform.
87
Defender Security
WPMU DEV's WordPress security plugin with malware scanning, AntiBot firewall, 2FA with passkeys, hardening and audit logs; Pro adds scheduled scans.
79
Shield Security
Automated WordPress security plugin with firewall, silentCAPTCHA bot detection, 2FA and audit log; ShieldPRO adds malware and vulnerability scanning.
84
Kadence Security (formerly Solid Security)
Login-focused WordPress security plugin (formerly Solid Security / iThemes Security) with 2FA, brute-force protection and Patchstack virtual patching in Pro.
77
WP Cerber Security
Self-distributed WordPress security plugin with firewall, anti-spam, malware scanner, 2FA and custom login URL; PRO adds GEO rules and scheduled scans.
69
FAQ
Is MalCare Security free?
Yes. MalCare Security has a free version on WordPress.org. Paid plans start at $99/yr.
How many sites use MalCare Security?
WordPress.org reports 100K+ active installations of the free version. The vendor claims 400K+ sites in total. We estimate around 22K sites run the paid version.
Does MalCare Security have web application firewall?
Yes: included. Plugin-level firewall blocks SQLi, XSS and other OWASP classes; advanced rule set on Protect and up.
Does MalCare Security have brute-force protection?
Yes: included. Login protection with rate limiting of failed logins on every plan, including XML-RPC.
Does MalCare Security have malware scanner?
Yes: included. Scans every file, database table and scheduled task for known and unknown malware.
Does MalCare Security have vulnerability alerts?
Yes: included. Vulnerability alerts for plugins, themes and core are included in the free plan.
Does MalCare Security have two-factor authentication?
Yes: included. Email-based 2FA; free covers 2 admin users, rising to all users on Fortify.
Does MalCare Security have activity log?
Yes: paid version (Repair). Activity log of logins and changes kept 7 days on Repair and 60 days on Fortify.
Does the free version of MalCare remove malware?
No. The free plan detects malware and alerts you, but automated cleanup starts on the Repair plan and unlimited manual cleanups need Fortify.
Will MalCare slow down my site?
Scanning runs on MalCare's servers rather than your hosting, so scans add little load. The firewall does run inside the site, but it is a lightweight request filter.
Is MalCare's firewall a cloud proxy like Cloudflare?
No. It runs at plugin level inside WordPress, using rules learned from MalCare's network. You can still put a CDN or proxy in front of it.
Can I get a refund?
MalCare offers refunds within 14 days of purchase, except when its team has already cleaned malware from the site in that period.
Last updated 5 Oct 2026. Spotted something wrong? Suggest an edit.