Wordfence Security
Endpoint firewall, malware scanner and login security plugin for WordPress, with paid tiers for real-time threat data and hands-on incident response.
80
Kadence Security (formerly Solid Security)
Login-focused WordPress security plugin (formerly Solid Security / iThemes Security) with 2FA, brute-force protection and Patchstack virtual patching in Pro.
Free installs700K+WordPress.org, active
Est. Pro installs~140KLikely 70K–280K
Vendor claims~1MVendor's own figure
Rating4.6/53,992 reviews
Price from$299/yrFreemium
Last updated14 Oct 2026Version 10.0.6
Overview
Kadence Security is the current name of the plugin long known as iThemes Security and, more recently, Solid Security. It is owned by Liquid Web (StellarWP), and version 10 of the free WordPress.org plugin switched the branding from SolidWP to Kadence in mid-2026. The WordPress.org slug is unchanged, so existing installs update in place and keep their settings.
What the free version covers
The free plugin concentrates on accounts and logins. It offers two-factor authentication by app, email or backup codes, password requirements, local brute-force lockouts and a Network Brute Force Protection service that shares attacker IPs across nearly a million sites. A Site Scan runs four times a day to flag known vulnerabilities in core, plugins and themes and checks Google Safe Browsing. You also get file change detection, user groups, a guided setup with six site templates, SSL enforcement, a hidden login URL and tools such as changing the database prefix, checking file permissions and regenerating salts.
What Pro adds
- A firewall with Patchstack virtual patching that blocks exploits before plugin authors release fixes.
- Passkeys, passwordless magic links, Trusted Devices and CAPTCHA (reCAPTCHA, hCaptcha or Cloudflare Turnstile).
- Hourly site scans, user activity logging and Version Management, which can auto-update vulnerable software.
Pro is no longer sold on its own. It is bundled into the Kadence Pro and Elite plans together with Kadence theme, blocks and WooCommerce tools; Elite also adds Kadence Central for multi-site management.
Limitations
There is no real malware file scanner: the firewall documentation says plainly that it does not include malware scanning, and Site Scan relies on vulnerability data and blocklist checks. Country restrictions apply only to admin logins, not to visitor traffic. The plugin also warns that it makes significant changes to the database and server configuration files, and the 2026 rebrand caused some confusion among long-time users.
Who should pick it
It suits site owners who mainly want strong login protection and vulnerability alerts, and Kadence users who already pay for a Pro or Elite bundle. Anyone who needs malware detection, cleanup or a standalone security licence should compare other options.
Best for: Sites that mainly need strong login protection and vulnerability alerts, especially those already on a Kadence Pro or Elite plan.
Kadence Security's free tier is among the better options for login hardening, with 2FA, network brute-force protection and regular vulnerability checks. It is not a malware scanner, and Pro now only comes inside the pricier Kadence bundles, so it is best value for people who already want the rest of that stack.
Pros
- Free 2FA by authenticator app, email and backup codes
- Network brute-force protection shared across ~1M sites
- Free vulnerability Site Scan four times a day
- Guided setup with security templates for common site types
- Pro adds Patchstack virtual patching and passkeys
- Version Management can auto-update vulnerable plugins
Cons
- No real malware file scanner or cleanup service
- Pro only available inside Kadence bundles from $299/year
- Country restriction limits admin logins only
- Modifies wp-config.php and server rules, which can break some setups
- 2026 rename from Solid to Kadence confused existing users
Key features
What Kadence Security (formerly Solid Security) highlights on its WordPress.org page and its own website, split by version.
Free version WordPress.org
- Two-factor authentication with backup codes
- Password requirement policies
- Local brute-force lockouts
- Network brute-force protection
- Ban repeat offenders
- File change detection
- Vulnerability Site Scan four times daily
- Guided setup with site templates
- User groups with role-based rules
- Enforce SSL
- Hide the login URL
- Change database prefix and salts
Pro / paid adds From $299/yr
- Firewall with Patchstack virtual patching
- Passkey and passwordless logins
- Magic links during lockouts
- Trusted Devices against session hijacking
- CAPTCHA incl. Cloudflare Turnstile
- Hourly site scans
- User activity logging
- Auto-update vulnerable software
- Temporary privilege escalation
- Kadence Central multi-site portal (Elite)
Feature checklist
23 of 26 features we track in Security Plugins, feature score 77/100
Firewall & blocking 5/7
Web application firewall Key
Filters malicious requests (SQL injection, XSS and similar) before they reach WordPress.
Firewall with Patchstack rules and custom request rules is part of Pro.
Paid version Kadence Pro
Cloud / DNS-level firewall
Firewall runs on the vendor's network in front of your server, not inside WordPress.
Firewall runs inside WordPress on your server.
Not included
Brute-force protection Key
Limits failed logins and locks out attackers guessing passwords.
Local lockouts plus network-wide brute-force protection in the free plugin.
Included
Login CAPTCHA
CAPTCHA or Turnstile on login, registration and password reset forms.
Pro CAPTCHA on login, registration, reset and comments (reCAPTCHA, hCaptcha, Turnstile).
Paid version Kadence Pro
Rate limiting & bot blocking
Throttles or blocks aggressive crawlers and bad bots.
No documented throttling for crawlers or bots found.
Not verified
Country blocking
Block or allow traffic by country.
Restrict Admin Access by Country limits admin logins only; tier not stated.
Partial
Real-time IP blocklist
Blocks IPs known for attacks using shared threat intelligence.
Network Brute Force Protection blocks IPs reported across ~1M sites.
Included
Scanning & cleanup 5/6
Malware scanner Key
Scans files and database for malware, backdoors and injected code.
Site Scan checks Google Safe Browsing; no signature-based file malware scan.
Partial
File change detection
Compares core, plugin and theme files with originals and flags changes.
File change detection flags modified files; not a full original-file comparison.
Partial
Vulnerability alerts Key
Warns when installed plugins, themes or core have known vulnerabilities.
Site Scan checks core, plugins and themes for known vulnerabilities.
Included
Scheduled scans
Runs scans automatically on a schedule.
Site Scan runs 4x daily free, hourly in Pro.
Included
Off-site scanning
Scans run on the vendor's servers so they don't slow your site.
Site Scan is processed through the vendor's scanning service; file checks run locally.
Partial
Malware removal
One-click or expert cleanup of infected sites.
No malware cleanup tool or service included.
Not included
Login security 5/5
Two-factor authentication Key
Second login factor via authenticator app, email or similar.
2FA via authenticator app, email or backup codes in the free plugin.
Included
Passkeys / WebAuthn
Passwordless login with passkeys or hardware security keys.
Passkey (WebAuthn) login requires Pro; not available on multisite.
Paid version Kadence Pro
Password policies
Enforce strong passwords, expiry or breached-password checks.
Create and enforce password requirements by user group.
Included
Custom login URL
Move or hide the wp-login.php / wp-admin login page.
Hide Login URL tool moves the login page.
Included
Session management
View and end active user sessions, limit concurrent logins.
Pro Trusted Devices helps block session hijacking; no full session manager found.
Partial Kadence Pro
Hardening 5/5
One-click hardening
Disable XML-RPC, file editing, user enumeration and similar weak points.
Advanced tools: change user ID 1, DB prefix, file permissions, salts, wp-config rules.
Included
SSL / HTTPS tools
Enforce HTTPS, fix mixed content and redirects.
Free option to enforce SSL across the site.
Included
Security headers
Set HSTS, CSP, X-Frame-Options and other HTTP security headers.
Settings for X-Frame-Options, X-Content-Type-Options, Referrer-Policy and CSP; no HSTS.
Partial
Virtual patching
Firewall rules that block exploits for known plugin vulnerabilities before an update is available.
Patchstack virtual patching blocks exploits before vendor fixes.
Paid version Kadence Pro
Auto-update vulnerable plugins
Automatically updates plugins with known vulnerabilities.
Version Management can auto-update or patch vulnerable software.
Paid version Kadence Pro
Monitoring & management 3/3
Activity log Key
Records logins, changes and admin actions for auditing.
User logging of logins, plugin, theme and content changes is Pro.
Paid version Kadence Pro
Security alerts
Email or app alerts for attacks, lockouts and scan results.
Security events and lockout notifications; site scan alert emails.
Included
Multi-site dashboard
Manage security for many sites from one dashboard.
Kadence Central multi-site portal is included in the Elite plan.
Paid version Kadence Elite
Pricing
Free
$0On WordPress.org
Kadence Pro
$299per yearNot stated
Security Pro bundled with Kadence theme/blocks Pro and Shop Kit; no standalone Security Pro price listed; site allowance not shown on pricing page.
Kadence Elite
$499per yearNot stated
Everything in Pro plus Kadence Central multi-site portal and white-label branding; vendor notes plans are priced per site.
Prices are list prices from the vendor's site, checked 14 Oct 2026. Many vendors discount the first year.
How many sites use Kadence Security (formerly Solid Security)?
Free installs from WordPress.org, the vendor's own claim, and our estimate of paid installs.
Free version (WordPress.org)
700K+
Active installations reported by WordPress.org.
Vendor claim
~1M
Sites/users claimed on the vendor's website. source
Estimated Pro / paid installs
~140K
Our estimate, see method below.
How we estimated this: About 750K free installs x 16% (the usual share of free sites that also run the paid version when some key features are paid, and Pro is included in a wider membership) gives 120K. The vendor claims ~1M sites in total. Taking away about 750K free installs leaves 250K, and 80% of that is 200K. Vendor totals are loose, so we only move our figure part of the way toward it, from 120K to 140K. Likely range: 70K to 280K. This counts sites running the paid version, including sites whose licence has lapsed. Estimates are rough and based on public figures as of 14 Oct 2026.
Stats & health
Weekly downloads
57,514 downloads last week, 40.2M all time
Rating breakdown
| Version | 10.0.6 |
|---|---|
| Last updated | 14 Oct 2026 (20 days ago) |
| Tested up to | WordPress 7.1.4 |
| Requires | WordPress 6.5+, PHP 7.4+ |
| Support threads (2 months) | 3 of 12 resolved |
| On WordPress.org since | 23 Oct 2010 |
Kadence Security (formerly Solid Security) compared
Kadence Security (formerly Solid Security)/Wordfence Security
Shield Security/Kadence Security (formerly Solid Security)
Defender Security/Kadence Security (formerly Solid Security)
Patchstack/Kadence Security (formerly Solid Security)
Kadence Security (formerly Solid Security)/WP Cerber Security
Limit Login Attempts Reloaded/Kadence Security (formerly Solid Security)
MalCare Security/Kadence Security (formerly Solid Security)
Kadence Security (formerly Solid Security)/Sucuri Security
All-In-One Security (AIOS)/Kadence Security (formerly Solid Security)
Really Simple Security/Kadence Security (formerly Solid Security)
Jetpack Protect/Kadence Security (formerly Solid Security) Alternatives to Kadence Security (formerly Solid Security)
Sucuri Security
Free auditing, file integrity and remote scanning plugin from Sucuri that connects to its paid cloud firewall and malware cleanup platform.
87
Defender Security
WPMU DEV's WordPress security plugin with malware scanning, AntiBot firewall, 2FA with passkeys, hardening and audit logs; Pro adds scheduled scans.
79
Shield Security
Automated WordPress security plugin with firewall, silentCAPTCHA bot detection, 2FA and audit log; ShieldPRO adds malware and vulnerability scanning.
84
MalCare Security
Cloud-scanning WordPress security plugin with a plugin-level firewall, login protection and paid one-click malware cleanup, for site owners and agencies.
80
WP Cerber Security
Self-distributed WordPress security plugin with firewall, anti-spam, malware scanner, 2FA and custom login URL; PRO adds GEO rules and scheduled scans.
69
FAQ
Is Kadence Security (formerly Solid Security) free?
Yes. Kadence Security (formerly Solid Security) has a free version on WordPress.org. Paid plans start at $299/yr.
How many sites use Kadence Security (formerly Solid Security)?
WordPress.org reports 700K+ active installations of the free version. The vendor claims ~1M sites in total. We estimate around 140K sites run the paid version.
Does Kadence Security (formerly Solid Security) have web application firewall?
Yes: paid version (Kadence Pro). Firewall with Patchstack rules and custom request rules is part of Pro.
Does Kadence Security (formerly Solid Security) have brute-force protection?
Yes: included. Local lockouts plus network-wide brute-force protection in the free plugin.
Does Kadence Security (formerly Solid Security) have malware scanner?
Yes: partial. Site Scan checks Google Safe Browsing; no signature-based file malware scan.
Does Kadence Security (formerly Solid Security) have vulnerability alerts?
Yes: included. Site Scan checks core, plugins and themes for known vulnerabilities.
Does Kadence Security (formerly Solid Security) have two-factor authentication?
Yes: included. 2FA via authenticator app, email or backup codes in the free plugin.
Does Kadence Security (formerly Solid Security) have activity log?
Yes: paid version (Kadence Pro). User logging of logins, plugin, theme and content changes is Pro.
Is Kadence Security the same plugin as Solid Security and iThemes Security?
Yes. It is the same WordPress.org plugin (slug better-wp-security), renamed from Solid Security to Kadence Security in version 10 in 2026. Settings carry over on update.
Can I buy Kadence Security Pro on its own?
Not at the moment. Pro features are included in the Kadence Pro ($299/year) and Elite ($499/year) plans; the Essentials plan does not include them.
Does it scan for malware?
Only indirectly. Site Scan checks for known vulnerabilities and Google Safe Browsing status, and file change detection logs modified files, but there is no signature-based malware scanner.
What does the Pro firewall do?
It applies Patchstack virtual-patching rules that block exploits for known plugin and theme vulnerabilities, plus custom rules that can block, redirect, log or allow requests.
Last updated 5 Oct 2026. Spotted something wrong? Suggest an edit.