Wordfence Security
Endpoint firewall, malware scanner and login security plugin for WordPress, with paid tiers for real-time threat data and hands-on incident response.
80
Patchstack
Vulnerability intelligence and virtual patching for WordPress: free alerts for up to 3 sites, paid firewall rules that block exploits before you update.
Free installs100K+WordPress.org, active
Est. Pro installs~18KLikely 9K–36K
Rating4.8/562 reviews
Price from$5/moFreemium
Last updated28 Jul 2026Version 2.3.7
Overview
Patchstack approaches WordPress security from the vulnerability side. It runs one of the largest vulnerability disclosure programmes for WordPress plugins and themes, and the plugin matches the software installed on your site against that database. Rather than scanning for malware after an infection, the aim is to stop known flaws from being exploited in the first place.
Free (Personal) plan
The free plan is detection only. It lists vulnerable plugins, themes and core versions, sends email alerts (with intelligence that can arrive up to 48 hours before public disclosure), offers optional automatic updates for vulnerable plugins only, produces snapshot PDF reports and lets you monitor up to three sites from the Patchstack app. It adds no firewall and runs only scheduled tasks, so it has almost no performance impact.
Paid protection
Paid protection, from $5 per site per month or the Developer plan for 25 sites, turns on virtual patching: targeted mitigation rules (Patchstack quotes 12,000+) that block exploit attempts against specific vulnerable components without changing their code. Paid sites also get custom firewall rules, a community IP blocklist, two-factor authentication, login page protection with reCAPTCHA, and a hardening module that disables the theme editor, blocks user enumeration, restricts XML-RPC and the REST API to logged-in users, hides the WordPress version and adds a standard set of security headers through .htaccess. Higher plans add API access, scheduled reports, SLAs and compliance paperwork.
Limitations
Patchstack is deliberately not an all-in-one suite. It has no malware scanner, no file integrity checks and no cleanup service, and its login protection replaces the usual hidden-login trick with a secret-link allowlist. Many people run it alongside another security or backup plugin. Its virtual patching is also offered by several hosts and management tools that resell Patchstack.
It is the best fit for agencies and developers who manage many sites and want early vulnerability warnings and exploit blocking without waiting for every vendor to ship a fix.
Best for: Agencies and developers who want early vulnerability alerts and virtual patching across many WordPress sites.
Patchstack is the specialist pick for stopping plugin vulnerability exploits, and its free alerts are useful on any site. It is not a full security suite, so plan to pair it with a malware scanner or backup tool; the paid plans are worth it mainly when you manage enough sites to justify them.
Pros
- Virtual patches block exploits for known flaws before an official update
- Early vulnerability intelligence from its own disclosure programme
- Free plan alerts on vulnerable plugins, themes and core for 3 sites
- Optional auto-updates for vulnerable plugins only
- Very low performance overhead on the free plan
- SOC 2 and ISO 27001 certified vendor with API access for agencies
Cons
- No malware scanner, file integrity checks or cleanup
- Free plan has no firewall at all
- Hardening, 2FA and login protection need a paid plan
- Developer plan is costly for owners with only a few sites
Key features
What Patchstack highlights on its WordPress.org page and its own website, split by version.
Free version WordPress.org
- Vulnerability detection for plugins, themes, core
- Early warnings up to 48 hours ahead
- Real-time email vulnerability alerts
- Auto-update vulnerable plugins only
- Remote update management
- Dashboard for up to 3 sites
- Snapshot PDF security reports
- Logs and analytics
- Minimal performance impact
Pro / paid adds From $5/mo
- Virtual patching with 12,000+ rules
- Unlimited custom firewall rules
- Community IP blocklist
- WordPress hardening module
- Two-factor authentication
- Login protection and reCAPTCHA
- Security headers via .htaccess
- Weekly and monthly PDF reports
- Slack and custom alerts
- API access and SCA reports
Feature checklist
16 of 26 features we track in Security Plugins, feature score 60/100
Firewall & blocking 4/7
Web application firewall Key
Filters malicious requests (SQL injection, XSS and similar) before they reach WordPress.
Paid plans filter requests with vPatch rules and unlimited custom firewall rules; free has no firewall.
Paid version Personal protection
Cloud / DNS-level firewall
Firewall runs on the vendor's network in front of your server, not inside WordPress.
Rules are enforced by the plugin on each page load, not on a vendor proxy.
Not included
Brute-force protection Key
Limits failed logins and locks out attackers guessing passwords.
Paid login protection blocks wp-login.php except via a secret allowlisting link; rate limiting in hardening.
Paid version Personal protection
Login CAPTCHA
CAPTCHA or Turnstile on login, registration and password reset forms.
reCAPTCHA is part of the paid remote hardening settings.
Paid version Personal protection
Rate limiting & bot blocking
Throttles or blocks aggressive crawlers and bad bots.
Not verified
Country blocking
Block or allow traffic by country.
Not verified
Real-time IP blocklist
Blocks IPs known for attacks using shared threat intelligence.
Community IP blocklist of known attacker addresses on paid plans.
Paid version Personal protection
Scanning & cleanup 3/6
Malware scanner Key
Scans files and database for malware, backdoors and injected code.
Vendor states the product focuses on prevention rather than malware scanning.
Not included
File change detection
Compares core, plugin and theme files with originals and flags changes.
No file comparison or integrity checking is offered.
Not included
Vulnerability alerts Key
Warns when installed plugins, themes or core have known vulnerabilities.
Free detection of vulnerable plugins, themes and core using Patchstack's database.
Included
Scheduled scans
Runs scans automatically on a schedule.
Software versions are checked automatically by scheduled tasks; there are no malware scans.
Partial
Off-site scanning
Scans run on the vendor's servers so they don't slow your site.
Vulnerability matching happens against Patchstack's cloud database; no offsite malware scanning.
Partial
Malware removal
One-click or expert cleanup of infected sites.
No cleanup service; Patchstack positions itself as prevention.
Not included
Login security 2/5
Two-factor authentication Key
Second login factor via authenticator app, email or similar.
Two-factor authentication is included with paid protection.
Paid version Personal protection
Passkeys / WebAuthn
Passwordless login with passkeys or hardware security keys.
Not verified
Password policies
Enforce strong passwords, expiry or breached-password checks.
Not verified
Custom login URL
Move or hide the wp-login.php / wp-admin login page.
Paid option blocks wp-login.php entirely and opens it via a secret link instead of renaming it.
Partial
Session management
View and end active user sessions, limit concurrent logins.
Not verified
Hardening 4/5
One-click hardening
Disable XML-RPC, file editing, user enumeration and similar weak points.
Disable theme editor, block user enumeration, restrict XML-RPC/REST API, hide WP version.
Paid version Personal protection
SSL / HTTPS tools
Enforce HTTPS, fix mixed content and redirects.
Not verified
Security headers
Set HSTS, CSP, X-Frame-Options and other HTTP security headers.
Hardening toggle adds a standard set of security headers via .htaccess.
Paid version Personal protection
Virtual patching
Firewall rules that block exploits for known plugin vulnerabilities before an update is available.
Core paid feature: 12,000+ targeted mitigation rules blocking known exploits.
Paid version Personal protection
Auto-update vulnerable plugins
Automatically updates plugins with known vulnerabilities.
Free option to auto-update only plugins with known vulnerabilities.
Included
Monitoring & management 3/3
Activity log Key
Records logins, changes and admin actions for auditing.
Logs and analytics are included in the free plan as well.
Included
Security alerts
Email or app alerts for attacks, lockouts and scan results.
Real-time email alerts for new vulnerabilities; Slack and custom alerts on paid plans.
Included
Multi-site dashboard
Manage security for many sites from one dashboard.
Patchstack app shows security status for up to 3 sites free, more on paid plans.
Included
Pricing
Free
$0On WordPress.org
Personal protection
$5per month1 site
Adds virtual patching to a site on the free Personal plan (free plan monitors up to 3 sites).
Developer
$828per year25 sites
$69/month billed yearly or $79 monthly; first month free; +5 sites for $12.50/month; 3 team seats. Enterprise and Web Host plans are custom-quoted.
Prices are list prices from the vendor's site, checked 14 Oct 2026. Many vendors discount the first year.
How many sites use Patchstack?
Free installs from WordPress.org, the vendor's own claim, and our estimate of paid installs.
Free version (WordPress.org)
100K+
Active installations reported by WordPress.org.
Vendor claim
—
The vendor does not publish a total.
Estimated Pro / paid installs
~18K
Our estimate, see method below.
How we estimated this: About 150K free installs x 12% (the usual share of free sites that also run the paid version when a hosted service whose free tier is limited) gives 18K. Likely range: 9K to 36K. This counts sites running the paid version, including sites whose licence has lapsed. Estimates are rough and based on public figures as of 14 Oct 2026.
Stats & health
Weekly downloads
6,615 downloads last week, 746.2K all time
Rating breakdown
| Version | 2.3.7 |
|---|---|
| Last updated | 28 Jul 2026 (97 days ago) |
| Tested up to | WordPress 7.0.8 |
| Requires | WordPress 5.2+, PHP 5.6+ |
| Support threads (2 months) | 0 of 1 resolved |
| On WordPress.org since | 1 Nov 2021 |
Company & policy
| Refund policy | 30-day money-back (source, 5 Oct 2026) |
|---|---|
| G2 rating | 4.9 (source, 5 Oct 2026) Rating shown on the Patchstack homepage. |
Patchstack compared
All-In-One Security (AIOS)/Patchstack
Patchstack/Really Simple Security
Jetpack Protect/Patchstack
Patchstack/WP Cerber Security
Limit Login Attempts Reloaded/Patchstack
MalCare Security/Patchstack
Patchstack/Shield Security
Defender Security/PatchstackPatchstack/Wordfence Security
Patchstack/Kadence Security (formerly Solid Security)
Patchstack/Sucuri Security Alternatives to Patchstack
Sucuri Security
Free auditing, file integrity and remote scanning plugin from Sucuri that connects to its paid cloud firewall and malware cleanup platform.
87
Defender Security
WPMU DEV's WordPress security plugin with malware scanning, AntiBot firewall, 2FA with passkeys, hardening and audit logs; Pro adds scheduled scans.
79
Shield Security
Automated WordPress security plugin with firewall, silentCAPTCHA bot detection, 2FA and audit log; ShieldPRO adds malware and vulnerability scanning.
84
MalCare Security
Cloud-scanning WordPress security plugin with a plugin-level firewall, login protection and paid one-click malware cleanup, for site owners and agencies.
80
Kadence Security (formerly Solid Security)
Login-focused WordPress security plugin (formerly Solid Security / iThemes Security) with 2FA, brute-force protection and Patchstack virtual patching in Pro.
77
FAQ
Is Patchstack free?
Yes. Patchstack has a free version on WordPress.org. Paid plans start at $5/mo.
How many sites use Patchstack?
WordPress.org reports 100K+ active installations of the free version. We estimate around 18K sites run the paid version.
Does Patchstack have web application firewall?
Yes: paid version (Personal protection). Paid plans filter requests with vPatch rules and unlimited custom firewall rules; free has no firewall.
Does Patchstack have brute-force protection?
Yes: paid version (Personal protection). Paid login protection blocks wp-login.php except via a secret allowlisting link; rate limiting in hardening.
Does Patchstack have malware scanner?
No: not included. Vendor states the product focuses on prevention rather than malware scanning.
Does Patchstack have vulnerability alerts?
Yes: included. Free detection of vulnerable plugins, themes and core using Patchstack's database.
Does Patchstack have two-factor authentication?
Yes: paid version (Personal protection). Two-factor authentication is included with paid protection.
Does Patchstack have activity log?
Yes: included. Logs and analytics are included in the free plan as well.
Does Patchstack scan for malware?
No. Patchstack focuses on preventing infections by detecting and virtually patching known vulnerabilities. Use a separate scanner or cleanup service for malware.
What is virtual patching?
Targeted firewall rules that block exploit attempts against a specific vulnerable plugin or theme without editing its code, so you are protected before an official fix is installed.
Is the free plan useful on its own?
Yes for awareness: it alerts you to vulnerable software on up to three sites and can auto-update only the vulnerable plugins, but it does not block attacks.
Does it work on multisite?
Yes, but each subsite has to be added to your Patchstack account and uses one site slot.
Last updated 5 Oct 2026. Spotted something wrong? Suggest an edit.