Wordfence Security
Endpoint firewall, malware scanner and login security plugin for WordPress, with paid tiers for real-time threat data and hands-on incident response.
80
Sucuri Security
Free auditing, file integrity and remote scanning plugin from Sucuri that connects to its paid cloud firewall and malware cleanup platform.
Free installs600K+WordPress.org, active
Est. Pro installs~33KLikely 17K–66K
Rating4.2/5386 reviews
Price from$9.99/moFreemium
Last updated14 Oct 2026Version 2.8.1
Overview
Sucuri Security is the free WordPress.org plugin from Sucuri, a website security company owned by GoDaddy. On its own it is a monitoring and hardening tool; the parts most people associate with the Sucuri name, the cloud firewall and the malware cleanup service, are paid Sucuri platform subscriptions that the plugin connects to with an API key.
What the free plugin does
The plugin records security events such as logins, content changes and user actions in a searchable audit log, and builds a baseline of your files so it can report anything added, changed or removed in core, plugins and themes. Remote scanning uses Sucuri SiteCheck, which loads your site from Sucuri’s servers like a visitor would to look for visible malware, errors and outdated software, and blocklist monitoring checks services such as Google Safe Browsing, Norton and McAfee.
- Hardening: remove the WordPress version, block PHP in uploads and other folders, disable the file editor, one-click XML-RPC disabling and secret-key rotation.
- Post-hack tools: reset passwords, rotate keys and reinstall plugins after an incident.
- Two-factor authentication with one-time backup codes, plus last-login and failed-login reports and email alerts.
What the paid platform adds
Sucuri’s Website Security Platform plans start at $229 a year for one site and add the cloud WAF and CDN, server-side malware scanning every 30 minutes to 12 hours depending on plan, unlimited manual malware cleanups, and SSL. Firewall-only plans start at $9.99 a month. Because the firewall sits in front of your host, it can filter attacks and absorb DDoS traffic before requests reach WordPress, and it adds virtual patching, geo-blocking and protected login pages.
Limitations
SiteCheck only sees what is publicly visible, so the free plugin can miss malware that hides in server files. Brute-force protection, country blocking and vulnerability scanning are tied to the paid firewall, and the plugin has no passkeys, password policy or login URL change. The paid plans are expensive next to plugin-only rivals.
Who should pick it
Pick it if you want lightweight auditing and integrity monitoring for free, or if you plan to buy Sucuri’s firewall and cleanup service and want the WordPress side integrated. If you need an all-in-one plugin firewall without a subscription, other options cover more for free.
Best for: Sites that want free auditing and integrity monitoring now, with the option of a managed cloud firewall and malware cleanup service.
The free plugin is a tidy monitoring and hardening tool, but on its own it is not a full security suite. Its real strength is as the WordPress companion to Sucuri's paid cloud firewall and cleanup plans, which are worth it for sites that want a managed service and DDoS protection.
Pros
- Free audit log of logins and content changes
- File integrity monitoring against a known-good baseline
- Remote SiteCheck scans and blocklist monitoring at no cost
- Lightweight plugin with practical hardening toggles
- Paid cloud WAF filters attacks and DDoS before your server
- Paid plans include unlimited manual malware cleanups
Cons
- Free scanning only sees publicly visible malware
- Brute-force protection and vulnerability scans need the paid firewall
- No passkeys, password policy or login URL change in the plugin
- Paid platform plans cost more than plugin-only rivals
Key features
What Sucuri Security highlights on its WordPress.org page and its own website, split by version.
Free version WordPress.org
- Security activity audit log
- File integrity monitoring
- Remote SiteCheck malware scan
- Blocklist monitoring across major services
- One-click hardening options
- Disable XML-RPC in one click
- Post-hack recovery actions
- Two-factor authentication with backup codes
- Successful and failed login reports
- Configurable email alerts
Pro / paid adds From $9.99/mo
- Cloud web application firewall
- DDoS mitigation on Anycast network
- Virtual patching and hardening rules
- Brute-force and bot protection
- Geo-blocking and IP allowlisting
- Protected pages with CAPTCHA or 2FA
- CDN for faster page loads
- Server-side scans up to every 30 minutes
- Unlimited manual malware cleanups
- SSL certificate included
Feature checklist
22 of 26 features we track in Security Plugins, feature score 87/100
Firewall & blocking 7/7
Web application firewall Key
Filters malicious requests (SQL injection, XSS and similar) before they reach WordPress.
Paid Sucuri firewall filters malicious requests; the plugin only connects to it.
Paid version Basic Firewall
Cloud / DNS-level firewall
Firewall runs on the vendor's network in front of your server, not inside WordPress.
WAF and CDN run on Sucuri's network in front of your host.
Paid version Basic Firewall
Brute-force protection Key
Limits failed logins and locks out attackers guessing passwords.
Brute-force blocking is a firewall feature; the free plugin only logs failed logins.
Paid version Basic Firewall
Login CAPTCHA
CAPTCHA or Turnstile on login, registration and password reset forms.
Firewall protected pages can add CAPTCHA to login areas.
Paid version Basic Firewall
Rate limiting & bot blocking
Throttles or blocks aggressive crawlers and bad bots.
Firewall blocks bad bots and layer 3/4/7 DDoS traffic.
Paid version Basic Firewall
Country blocking
Block or allow traffic by country.
Geo-blocking is part of the cloud WAF.
Paid version Basic Firewall
Real-time IP blocklist
Blocks IPs known for attacks using shared threat intelligence.
Firewall blocks known malicious traffic using Sucuri signatures and intel.
Paid version Basic Firewall
Scanning & cleanup 6/6
Malware scanner Key
Scans files and database for malware, backdoors and injected code.
Free SiteCheck scans the public site only; server-side scans need a platform plan.
Partial
File change detection
Compares core, plugin and theme files with originals and flags changes.
Baseline comparison flags added, modified or removed core, plugin and theme files.
Included
Vulnerability alerts Key
Warns when installed plugins, themes or core have known vulnerabilities.
Core, plugin and theme vulnerability scans unlock with a firewall API key.
Paid version Basic Firewall
Scheduled scans
Runs scans automatically on a schedule.
Integrity checks and remote scans run automatically; platform plans scan up to every 30 min.
Included
Off-site scanning
Scans run on the vendor's servers so they don't slow your site.
SiteCheck runs from Sucuri's servers, not your host.
Included
Malware removal
One-click or expert cleanup of infected sites.
Unlimited manual cleanups by Sucuri analysts on every platform plan.
Paid version Basic Platform
Login security 2/5
Two-factor authentication Key
Second login factor via authenticator app, email or similar.
Authenticator-app 2FA with one-time backup codes (added in 2.5/2.8).
Included
Passkeys / WebAuthn
Passwordless login with passkeys or hardware security keys.
No passkey or hardware-key login.
Not included
Password policies
Enforce strong passwords, expiry or breached-password checks.
Offers password resets after a hack, but no password rules.
Not included
Custom login URL
Move or hide the wp-login.php / wp-admin login page.
Firewall can set unique login URLs and protect login pages.
Paid version Basic Firewall
Session management
View and end active user sessions, limit concurrent logins.
Lists recent logins; ability to end sessions not confirmed.
Not verified
Hardening 4/5
One-click hardening
Disable XML-RPC, file editing, user enumeration and similar weak points.
Disable file editor and XML-RPC, block PHP in uploads, hide WP version.
Included
SSL / HTTPS tools
Enforce HTTPS, fix mixed content and redirects.
SSL certificates are included with firewall/platform plans, not the plugin.
Paid version Basic Firewall
Security headers
Set HSTS, CSP, X-Frame-Options and other HTTP security headers.
Can configure CSP (report-only), CORS and Cache-Control headers.
Partial
Virtual patching
Firewall rules that block exploits for known plugin vulnerabilities before an update is available.
Firewall applies virtual patches for known software vulnerabilities.
Paid version Basic Firewall
Auto-update vulnerable plugins
Automatically updates plugins with known vulnerabilities.
Does not auto-update vulnerable plugins.
Not included
Monitoring & management 3/3
Activity log Key
Records logins, changes and admin actions for auditing.
Searchable audit log of security events, logins and content changes.
Included
Security alerts
Email or app alerts for attacks, lockouts and scan results.
Customisable email alerts for security events.
Included
Multi-site dashboard
Manage security for many sites from one dashboard.
Sucuri account dashboard manages scans and firewall for all your sites.
Paid version Basic Platform
Pricing
Free
$0On WordPress.org
Basic Platform
$229per year1 site
Cloud WAF/CDN, malware scans every 12 hours, unlimited cleanups with 30-hour response; up to 30% off for multi-year terms.
Pro Platform
$339per year1 site
Scans every 6 hours, 12-hour cleanup response, advanced SSL.
Business Platform
$549per year1 site
Scans every 30 minutes, 6-hour cleanup response.
Basic Firewall
$9.99per month1 site
Firewall and CDN only, without malware cleanup; Pro Firewall is $19.98/month.
Prices are list prices from the vendor's site, checked 14 Oct 2026. Many vendors discount the first year.
How many sites use Sucuri Security?
Free installs from WordPress.org, the vendor's own claim, and our estimate of paid installs.
Free version (WordPress.org)
600K+
Active installations reported by WordPress.org.
Vendor claim
—
The vendor does not publish a total.
Estimated Pro / paid installs
~33K
Our estimate, see method below.
How we estimated this: About 650K free installs x 5% (the usual share of free sites that also run the paid version when a hosted service whose free tier is generous) gives 33K. Likely range: 17K to 66K. This counts sites running the paid version, including sites whose licence has lapsed. Estimates are rough and based on public figures as of 14 Oct 2026.
Stats & health
Weekly downloads
75,540 downloads last week, 37.6M all time
Rating breakdown
| Version | 2.8.1 |
|---|---|
| Last updated | 14 Oct 2026 (20 days ago) |
| Tested up to | WordPress 7.1.4 |
| Requires | WordPress 6.0+, PHP 7.4+ |
| Support threads (2 months) | 2 of 2 resolved |
| On WordPress.org since | 18 Nov 2011 |
Company & policy
| Refund policy | 30-day money-back (source, 5 Oct 2026) |
|---|
Sucuri Security compared
MalCare Security/Sucuri Security
Shield Security/Sucuri Security
Defender Security/Sucuri Security
Patchstack/Sucuri Security
Sucuri Security/WP Cerber Security
Limit Login Attempts Reloaded/Sucuri SecuritySucuri Security/Wordfence Security
Kadence Security (formerly Solid Security)/Sucuri Security
All-In-One Security (AIOS)/Sucuri Security
Really Simple Security/Sucuri Security
Jetpack Protect/Sucuri Security Alternatives to Sucuri Security
Defender Security
WPMU DEV's WordPress security plugin with malware scanning, AntiBot firewall, 2FA with passkeys, hardening and audit logs; Pro adds scheduled scans.
79
Shield Security
Automated WordPress security plugin with firewall, silentCAPTCHA bot detection, 2FA and audit log; ShieldPRO adds malware and vulnerability scanning.
84
MalCare Security
Cloud-scanning WordPress security plugin with a plugin-level firewall, login protection and paid one-click malware cleanup, for site owners and agencies.
80
Kadence Security (formerly Solid Security)
Login-focused WordPress security plugin (formerly Solid Security / iThemes Security) with 2FA, brute-force protection and Patchstack virtual patching in Pro.
77
WP Cerber Security
Self-distributed WordPress security plugin with firewall, anti-spam, malware scanner, 2FA and custom login URL; PRO adds GEO rules and scheduled scans.
69
FAQ
Is Sucuri Security free?
Yes. Sucuri Security has a free version on WordPress.org. Paid plans start at $9.99/mo.
How many sites use Sucuri Security?
WordPress.org reports 600K+ active installations of the free version. We estimate around 33K sites run the paid version.
Does Sucuri Security have web application firewall?
Yes: paid version (Basic Firewall). Paid Sucuri firewall filters malicious requests; the plugin only connects to it.
Does Sucuri Security have brute-force protection?
Yes: paid version (Basic Firewall). Brute-force blocking is a firewall feature; the free plugin only logs failed logins.
Does Sucuri Security have malware scanner?
Yes: partial. Free SiteCheck scans the public site only; server-side scans need a platform plan.
Does Sucuri Security have vulnerability alerts?
Yes: paid version (Basic Firewall). Core, plugin and theme vulnerability scans unlock with a firewall API key.
Does Sucuri Security have two-factor authentication?
Yes: included. Authenticator-app 2FA with one-time backup codes (added in 2.5/2.8).
Does Sucuri Security have activity log?
Yes: included. Searchable audit log of security events, logins and content changes.
Is the Sucuri firewall included in the free plugin?
No. The plugin only connects to the Sucuri Website Firewall; the WAF itself is a paid subscription, either as a firewall plan from $9.99/month or as part of a Website Security Platform plan.
Does the free plugin remove malware?
No. It offers post-hack tools such as resetting passwords and keys, but cleanup by Sucuri analysts requires a paid platform plan, which includes unlimited manual cleanups.
How does Sucuri's scanning differ from Wordfence?
The free SiteCheck scan runs from Sucuri's servers and inspects your site as a visitor would, so it costs no server resources but cannot see malware hidden in files. Paid plans add server-side scanning.
Does the firewall require DNS changes?
Yes. Like other cloud firewalls, traffic must be routed through Sucuri's network, normally by pointing your DNS records to Sucuri.
Last updated 5 Oct 2026. Spotted something wrong? Suggest an edit.