Wordfence Security
Endpoint firewall, malware scanner and login security plugin for WordPress, with paid tiers for real-time threat data and hands-on incident response.
80
WP Cerber Security
Self-distributed WordPress security plugin with firewall, anti-spam, malware scanner, 2FA and custom login URL; PRO adds GEO rules and scheduled scans.
Est. Pro installs~6KLikely 3K–12K
Price from$99/yrFreemium
Overview
WP Cerber Security is a long-running security, anti-spam and malware-scanning plugin developed by Cerber Tech Inc. It was closed on WordPress.org in September 2022 and is now distributed only from wpcerber.com, with its own update mechanism that does not depend on WordPress.org. The plugin is still actively maintained, with several releases in mid-2026.
Free version
The free plugin covers a wide range: a Traffic Inspector firewall that screens suspicious requests and code-injection attempts, login attempt limits by IP or subnet, IP access lists, bot detection using traps and honeypots, reCAPTCHA for WordPress and WooCommerce forms, and anti-spam for comments and registrations. Login security includes two-factor authentication and a custom login URL that replaces wp-login.php. Hardening options restrict XML-RPC, apply role-based REST API access and stop user enumeration. A malware scanner and integrity checker compares files with originals and can remove suspicious files, and an activity log records logins and other events, with email notifications and reports.
Cerber PRO
The Professional version adds automated hourly and daily scans with flexible alerts, rich GEO rules that restrict access by country, the cloud-based Global Black List maintained by Cerber Lab, a console for managing user sessions, a Cloudflare add-on, management of multiple Cerber installs from one dashboard and expert support. A single-site licence is $99 a year.
Considerations
Because it is not on WordPress.org, you install it manually from the vendor and rely on Cerber’s own update channel, which some hosts and management tools handle less smoothly. Its interface is dense and aimed at people comfortable with security settings. We found no virtual patching, security header tools or hands-on cleanup service in its documentation.
WP Cerber suits experienced administrators who want granular firewall, anti-spam and access rules in one plugin and are happy to install it outside the official directory.
Best for: Experienced admins who want detailed firewall, anti-spam and access-control rules and are comfortable installing outside WordPress.org.
WP Cerber packs a lot of control into its free version and remains actively developed, but leaving WordPress.org makes installation and updates less convenient. Choose it if you value its granular rules and anti-spam; otherwise mainstream alternatives are easier to manage at scale.
Pros
- Free version includes firewall, 2FA, custom login URL and reCAPTCHA
- Granular IP, subnet and REST API access rules
- Built-in anti-spam for comments, registrations and WooCommerce
- Malware scanner and integrity checker with file removal
- Free licence can be used on unlimited sites
Cons
- No longer on WordPress.org; manual install and vendor update channel
- Country rules, scheduled scans and cloud blocklist need PRO
- Dense settings screens with a learning curve
- No virtual patching or security header tools
Key features
What WP Cerber Security highlights on its own website, split by version.
Free version Free
- Traffic Inspector request firewall
- Limit login attempts by IP or subnet
- Two-factor authentication
- Custom login URL
- reCAPTCHA for WordPress and WooCommerce forms
- Bot traps and anti-spam
- IP and subnet access lists
- REST API and XML-RPC restrictions
- Malware scanner and integrity checker
- Activity log with email reports
- Free use on unlimited sites
Pro / paid adds From $99/yr
- Hourly and daily scheduled scans
- Flexible scan alerts and reports
- GEO country access rules
- Cerber Lab cloud global blocklist
- User session management console
- Cloudflare add-on
- Manage many sites from one dashboard
- Registration limits per IP
- Developer and 24/7 premium support
Feature checklist
17 of 26 features we track in Security Plugins, feature score 69/100
Firewall & blocking 6/7
Web application firewall Key
Filters malicious requests (SQL injection, XSS and similar) before they reach WordPress.
Traffic Inspector screens suspicious requests and code injection attempts.
Included
Cloud / DNS-level firewall
Firewall runs on the vendor's network in front of your server, not inside WordPress.
Not verified
Brute-force protection Key
Limits failed logins and locks out attackers guessing passwords.
Limits login attempts by IP address or Class C subnet.
Included
Login CAPTCHA
CAPTCHA or Turnstile on login, registration and password reset forms.
reCAPTCHA for WordPress and WooCommerce forms.
Included
Rate limiting & bot blocking
Throttles or blocks aggressive crawlers and bad bots.
Bot detection with traps and honeypots blocks automated and hacker activity.
Included
Country blocking
Block or allow traffic by country.
Rich GEO country rules are listed as a Professional version feature.
Paid version PRO
Real-time IP blocklist
Blocks IPs known for attacks using shared threat intelligence.
Cloud Global Black List maintained by Cerber Lab is a PRO feature.
Paid version PRO
Scanning & cleanup 4/6
Malware scanner Key
Scans files and database for malware, backdoors and injected code.
Malware scanner checks files for trojans and injected code.
Included
File change detection
Compares core, plugin and theme files with originals and flags changes.
Integrity checker compares WordPress files with originals.
Included
Vulnerability alerts Key
Warns when installed plugins, themes or core have known vulnerabilities.
Not verified
Scheduled scans
Runs scans automatically on a schedule.
Automated hourly and daily scans with email alerts are PRO.
Paid version PRO
Off-site scanning
Scans run on the vendor's servers so they don't slow your site.
Not verified
Malware removal
One-click or expert cleanup of infected sites.
Scanner can clean up malware and suspicious files; no expert cleanup service.
Partial
Login security 3/5
Two-factor authentication Key
Second login factor via authenticator app, email or similar.
Two-factor authentication for WordPress accounts.
Included
Passkeys / WebAuthn
Passwordless login with passkeys or hardware security keys.
Not verified
Password policies
Enforce strong passwords, expiry or breached-password checks.
Not verified
Custom login URL
Move or hide the wp-login.php / wp-admin login page.
Custom login URL that renames wp-login.php.
Included
Session management
View and end active user sessions, limit concurrent logins.
Console to monitor and terminate active user sessions in the PRO version.
Paid version PRO
Hardening 1/5
One-click hardening
Disable XML-RPC, file editing, user enumeration and similar weak points.
Disable XML-RPC, role-based REST API access, stop user enumeration.
Included
SSL / HTTPS tools
Enforce HTTPS, fix mixed content and redirects.
Not verified
Security headers
Set HSTS, CSP, X-Frame-Options and other HTTP security headers.
Not verified
Virtual patching
Firewall rules that block exploits for known plugin vulnerabilities before an update is available.
No virtual patching for specific plugin vulnerabilities is described.
Not included
Auto-update vulnerable plugins
Automatically updates plugins with known vulnerabilities.
Not verified
Monitoring & management 3/3
Activity log Key
Records logins, changes and admin actions for auditing.
Logs logins, logouts and other user activity.
Included
Security alerts
Email or app alerts for attacks, lockouts and scan results.
Email notifications plus weekly or monthly reports.
Included
Multi-site dashboard
Manage security for many sites from one dashboard.
Manage multiple WP Cerber installations from one dashboard.
Paid version PRO
Pricing
Free
$0Free version available
Single
$99per year1 site
Also $29 per quarter. Includes developer support and 30-day money-back guarantee.
5 Value Pack
$399per year5 sites
Also $39/month. Adds 24/7/365 premium support.
Prices are list prices from the vendor's site, checked 14 Oct 2026. Many vendors discount the first year.
How many sites use WP Cerber Security?
Free installs from WordPress.org, the vendor's own claim, and our estimate of paid installs.
Free version (WordPress.org)
—
No free version on WordPress.org.
Vendor claim
200K+
Paying customers claimed by the vendor. source
Estimated Pro / paid installs
~6K
Our estimate, see method below.
How we estimated this: No WP.org figure (closed 2022). Took the 200K+ claim as total users and assumed 2-4% on PRO -> 4K-8K, midpoint ~6K. Likely range: 3K to 12K. This counts sites running the paid version, including sites whose licence has lapsed. Estimates are rough and based on public figures as of 14 Oct 2026.
Company & policy
| Paying customers claimed | 200K+ (source, 5 Oct 2026) Homepage says 'Trusted by 200000+ customers'; likely counts free users too. |
|---|---|
| Founded | 2017 (source, 5 Oct 2026) Homepage: 'Since 2017'. |
| Refund policy | 30-day money-back (source, 5 Oct 2026) |
WP Cerber Security compared
All-In-One Security (AIOS)/WP Cerber Security
Really Simple Security/WP Cerber Security
Jetpack Protect/WP Cerber Security
Limit Login Attempts Reloaded/WP Cerber Security
MalCare Security/WP Cerber Security
Shield Security/WP Cerber Security
Defender Security/WP Cerber Security
Patchstack/WP Cerber SecurityWordfence Security/WP Cerber Security
Kadence Security (formerly Solid Security)/WP Cerber Security
Sucuri Security/WP Cerber Security Alternatives to WP Cerber Security
Sucuri Security
Free auditing, file integrity and remote scanning plugin from Sucuri that connects to its paid cloud firewall and malware cleanup platform.
87
Defender Security
WPMU DEV's WordPress security plugin with malware scanning, AntiBot firewall, 2FA with passkeys, hardening and audit logs; Pro adds scheduled scans.
79
Shield Security
Automated WordPress security plugin with firewall, silentCAPTCHA bot detection, 2FA and audit log; ShieldPRO adds malware and vulnerability scanning.
84
MalCare Security
Cloud-scanning WordPress security plugin with a plugin-level firewall, login protection and paid one-click malware cleanup, for site owners and agencies.
80
Kadence Security (formerly Solid Security)
Login-focused WordPress security plugin (formerly Solid Security / iThemes Security) with 2FA, brute-force protection and Patchstack virtual patching in Pro.
77
FAQ
Is WP Cerber Security free?
Yes. WP Cerber Security has a free version. Paid plans start at $99/yr.
How many sites use WP Cerber Security?
We estimate around 6K sites run the paid version.
Does WP Cerber Security have web application firewall?
Yes: included. Traffic Inspector screens suspicious requests and code injection attempts.
Does WP Cerber Security have brute-force protection?
Yes: included. Limits login attempts by IP address or Class C subnet.
Does WP Cerber Security have malware scanner?
Yes: included. Malware scanner checks files for trojans and injected code.
Does WP Cerber Security have two-factor authentication?
Yes: included. Two-factor authentication for WordPress accounts.
Does WP Cerber Security have activity log?
Yes: included. Logs logins, logouts and other user activity.
Is WP Cerber still on WordPress.org?
No. It was closed in the directory in September 2022 and is now downloaded from wpcerber.com, which also provides updates.
Is WP Cerber still maintained?
Yes. The vendor's release notes list several versions in 2026, including 9.9.5 in August 2026.
What does Cerber PRO add?
Scheduled hourly or daily scans with alerts, country-based access rules, the Cerber Lab global blocklist, session management, a Cloudflare add-on, multi-site management and expert support.
Can I use the free version on several sites?
Yes, the free version can be installed on an unlimited number of websites.
Last updated 5 Oct 2026. Spotted something wrong? Suggest an edit.