WPMU DEV - Your All-in-One WordPress Platform

<p><strong>Defender adds the best in WordPress plugin security to your website with just a few clicks, including malware scanner, firewall, password protection, and login security features. Stop brute force login attacks, weak password usage, SQL injections, cross-site scripting (XSS), and other WordPress security vulnerabilities and hacks with Defender’s malware scanner, providing antivirus scans, IP blocking, firewall, activity log, security log, and two-factor authentication (2FA) login security.</strong></p>
<p>No more complex security settings, Defender’s malware scanner, firewall, and login security features add all the hardening and security you need.</p>
<p>Defender is brought to you by the WordPress speed specialists that created Smush image optimization, now active on more than +1 million websites.</p>
<p>Plus, connect for free to WPMU DEV’s AntiBot Global Firewall to block harmful IPs with data from over 500,000 sites.</p>
<p><strong>Enjoy complete site protection from malware, vulnerabilities, bot attacks, and session hijacking from the start with <a href="https://wpmudev.com/project/wp-defender/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme-above-the-fold&utm_content=wp_defender_pro" rel="nofollow ugc">Defender Pro</a>.</strong></p>
<p>Level up security immediately with exclusive Pro features like scheduled malware scanning, Safe Repair for suspicious files, and known WordPress vulnerability detection. <a href="https://wpmudev.com/project/wp-defender/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme-above-the-fold&utm_content=wp_defender_pro" rel="nofollow ugc">Learn more about Pro</a>.</p>
<h3>Security Recommendations</h3>
<p>Defender’s one-click security hardening recommendations instantly adds layers of protection and security to your site.</p>
<h3>Enhance Security and Block Hackers At Every Level:</h3>
<ul>
<li><strong>Malware Scanner</strong> – Scan WordPress core files for modifications and unexpected changes which may be caused by malware. Scan for malware and tighten up the security of your files.</li>
<li><strong>Outdated & Removed Plugins</strong> – Scans for plugins removed from WordPress.org or not updated in 2+ years.</li>
<li><strong>AntiBot Global Firewall</strong> – Connect for free to WPMU DEV to block harmful IPs with data from over 500,000 sites.</li>
<li><strong>WordPress Security Firewall</strong> – Block or allowlist IPs, implement IP blocking, and Geo IP blocking, user agent banning and protect against brute force attacks.</li>
<li><strong>Two-Factor Authentication (2FA)</strong> – Easily set up better security with 2FA to prevent most login attacks such as brute force, App verification, backup codes, lost device email, WooCommerce 2FA, and Web Authentication.</li>
<li><strong>Login Masking</strong> – Change the location of WordPress’s default login area to improve login security.</li>
<li><strong>Login Lockout</strong> – Failed login attempts lockout for even more security assurance.</li>
<li><strong>User Agent Banning</strong> – Fortify security by blocking bad bots and user agents from accessing your site.</li>
<li><strong>Security Headers</strong> – Add an extra layer of defense security and protect against common attacks like: XSS, code injection, and more.</li>
<li><strong>404 Detection Security</strong> – Automated block of bot IPs.</li>
<li><strong>Security Configs</strong> – Create your ideal Defender security plugin settings and export / import saved configs to any other site.</li>
<li><strong>Geolocation IP Lockout Security</strong> – Block users based on location and country (IP blocking).</li>
<li><strong>Disable Trackbacks And Pingbacks</strong> – Disable these notifications to enhance spam protection and site security.</li>
<li><strong>Core And Server Update Security Recommendations</strong> – Stay on top of your system security.</li>
<li><strong>Antivirus Scan</strong> – Scan for active security threats, viruses, and other malware.</li>
<li><strong>Disable File Editor</strong> – If they get in, they won’t get far.</li>
<li><strong>Hide Error Reporting</strong> – Hide code errors on the frontend so hackers can’t exploit site security.</li>
<li><strong>Update Security Keys</strong> – Update old WordPress security keys to be more encrypted and provide better security.</li>
<li><strong>Prevent Information Disclosure</strong> – Improve server security and protect sensitive files by locking down specific file types.</li>
<li><strong>Prevent PHP Execution</strong> – Defender bolsters security by automatically preventing any PHP code from being executed.</li>
<li><strong>Bulk Apply Security Recommendations</strong> – Apply multiple recommended security improvements at once for quicker site hardening.</li>
<li><strong>Google reCAPTCHA Security</strong> – Easy to add, stop fraud and abuse – including BuddyPress and WooCommerce.</li>
<li><strong>Cloudflare Turnstile</strong> – Protect your site from spam and automated attacks without annoying captchas.</li>
<li><strong>Pwned Password Check</strong> – Increase security by protecting against compromised passwords.</li>
<li><strong>Force Password Reset</strong> – Force users with selected roles to reset passwords.</li>
<li><strong>Force Strong Passwords</strong> – Ensure users create secure credentials by enforcing robust password requirements.</li>
<li><strong>User Agent Blocklist Presets</strong> – Easily block unwanted bots and scripts using curated user agent presets.</li>
<li><strong>Known Vulnerability & Suspicious Code Scan (Pro Only)</strong> – Scan WordPress core, themes, and plugins for vulnerabilities and harmful code.</li>
<li><strong>Malicious Bot Detector (Pro Only)</strong> – Block malicious bots with layered defenses, including traps for bots that ignore robots.txt and checks for fake crawlers posing as search engines.</li>
<li><strong>Google Blocklist Monitoring (Pro Only)</strong> – Get instant alerts if your site is flagged by Google.</li>
<li><strong>Session Protection (Pro Only)</strong> – Stop session hijacking and prevent unauthorized account access.</li>
<li><strong>Safe Repair For Suspicious Files (Pro Only)</strong> – Restore or replace compromised files safely with a single click.</li>
<li><strong>Automated Reports (Pro Only)</strong> – Receive scheduled security reports straight to your inbox.</li>
</ul>
<h3>Learn The Ropes With These Hands-On Defender Security Plugin Tutorials</h3>
<ul>
<li><a href="https://wpmudev.com/blog/how-to-get-the-most-out-of-defender-security/" rel="nofollow ugc">How to Get the Most Out of Defender Security</a></li>
<li><a href="https://wpmudev.com/blog/stop-hackers-with-defender-wordpress-security-plugin/" rel="nofollow ugc">How to Stop Hackers in Their Tracks with Defender Security</a></li>
<li><a href="https://wpmudev.com/blog/delete-suspicious-code-defender/" rel="nofollow ugc">Find Out if You’re Hacked: How to Find and Delete Suspicious Code with Defender Security</a></li>
<li><a href="https://wpmudev.com/blog/defender-ip-address-lockout-firewall/" rel="nofollow ugc">How to Create a Powerful and Secure Customized Firewall with Defender Security</a></li>
</ul>
<h3>WordPress Security Scans</h3>
<p>Defender’s malware scanner security checks for suspicious code and malware. It also compares your WordPress install with the WP directory master copy, and reports any changes so you can restore the original file with a click.</p>
<h3>Two-Factor Authentication (2FA) Security</h3>
<p>Easily add an extra layer of protection and security to your WordPress sites with Defender’s two-factor authentication (2FA) features. Including: mobile app verification (Google Authenticator, Microsoft Authenticator, Authy), backup code generation, lost device emails, WooCommerce 2FA, Biometric Authentication (fingerprint/facial recognition), and Hardware Key Authentication (USB security keys). Easily prevent brute force attacks and login security vulnerabilities.</p>
<h3>Login Protection</h3>
<p>Brute force attacks are no match for Defender’s login security. Limit login attempts so hackers can’t guess passwords. Permanently ban IPs or trigger a timed lockout after a set number of failed login attempts. Use Geo IP blocking to ban users from specific countries or locations.</p>
<h3>Firewall Security and IP Manager</h3>
<p>Improve your website security with Defender’s IP manager and firewall. Manually block specific IPs, import a list of banned IPs, and set automated timed and permanent lockouts. Defender makes it easy to block and unblock specific locations quickly thanks to its advanced firewall security(WAF) offering Geographical IP blocking.</p>
<h3>User Agent Banning</h3>
<p>Add user agents to the block or allowlist and stop bad bots from spamming and scraping your site. All major search engines and special network bots are allow-listed out of the box. Easy to set up, Defender’s user agent banning tool now includes built-in bot and script presets to help you quickly block malicious traffic. It does all the security work for you—no editing of the .htaccess file required.</p>
<h3>Google reCAPTCHA Integration</h3>
<p>Add reCAPTCHA security to your login / registration pages, lost password forms, and post comments in a couple of steps to up security and help protect from fraud and abuse. Select reCAPTCHA type, language, location, and style to suit. As well as Google, Defender also supports the following reCAPTCHA types:</p>
<ul>
<li>BuddyPress reCAPTCHA</li>
<li>WooCommerce reCAPTCHA</li>
</ul>
<h3>Login Screen Masking</h3>
<p>Defender makes it easy to move your login screen to a custom URL. Not only does login screen masking improve security, but it also lets you white label your login user experience and improves branding.</p>
<h3>Force Password Reset</h3>
<p>Enhance site security by forcing all users with selected roles to reset their password at any time. Especially helpful if you suspect a possible data breach on your site.</p>
<h3>Security Headers</h3>
<p>Protect your site against common attacks, such as: XSS, code injection, cross site scripting, and more. Enable the following security headers:</p>
<ul>
<li>X-Frame-Options</li>
<li>X-XSS-Protection</li>
<li>X-Content-Type-Options</li>
<li>Strict Transport</li>
<li>Referrer Policy</li>
<li>Permissions-Policy</li>
</ul>
<h3>404 Limiter</h3>
<p>Detect when bots are being used to scan your site for security vulnerabilities and shut them down. The 404 limiter lets you stop the scan by detecting when a bot keeps visiting pages that do not exist, which can also save you from a giant strain on your site’s performance.</p>
<h3>Security Notifications and Reports</h3>
<p>Defender runs surveillance and sends security notifications with information that matters. All activity and notifications are recorded in the activity log to let you see at a glance the website security actions that have been taken by the Defender security plugin.</p>
<h3>Reduce Security Setup Time With Saved Configs</h3>
<p>Save your Defender security plugin configurations and reapply them to your other sites in just a few clicks. You can create and save an unlimited number of security configurations.</p>
<h3>Pwned Password Check</h3>
<p>Entered passwords are checked against public database breach records to further boost security. If a password is identified as compromised, the user will be asked to change it.</p>
<h3>Custom IP Block/Allowlist</h3>
<p>Create your IP block/allow list once, then apply and automatically sync it to all your other sites with just a single click. Save hours by not having to manually add IPs to each individual site. *Note: a [free WPMU DEV account] (https://wpmudev.com/register) is required to access this feature.</p>
<h3>What Do People Say About Defender?</h3>
<p>★★★★★<br />
“I found other pro security plugins a bit too fiddly for my taste…I’m delighted with Defender” – <a href="https://profiles.wordpress.org/keithadv" rel="nofollow ugc">KeithADV</a></p>
<p>★★★★★<br />
“Thank you for bringing back a free and easy to use 2-Factor Authentication after Clef! Defender helps keep me aware of my site’s security.” – <a href="https://wordpress.org/support/users/awijasa/" rel="ugc">awijasa</a></p>
<p>★★★★★<br />
“Defender’s interface is very intuitive with warnings that are very helpful” – <a href="https://wpmudev.com/profile/djohns" rel="nofollow ugc">djohns</a></p>
<p>★★★★★<br />
“Defender Recently blocked over 3000 attacks in one week without any noticeable impact on the website. WPMUDEV knocking it out of the park on this one.” – <a href="https://wpmudev.com/profile/davidoswald/" rel="nofollow ugc">David Oswald</a></p>
<h3>Secure Websites, More Trust, Better Profit</h3>
<p>If you’re running a business website or eCommerce store, privacy, security, uptime and trust are essential.</p>
<p>The Defender security plugin is here to help you: it’s a one of a kind WordPress security plugin that makes web security easy for anyone, for free!</p>
<ul>
<li>Malware scanner</li>
<li>Google two-factor authentication (2FA)</li>
<li>Web Authentication</li>
<li>Firewall setup and configuration</li>
<li>One-click site hardening and security tweaking</li>
<li>WordPress core file scanning and repair</li>
<li>Ongoing firewall security</li>
<li>Google reCAPTCHA</li>
<li>Security headers</li>
<li>One-click security configs</li>
<li>Login Screen Masking</li>
<li>Pwned Password Check</li>
<li>IP Blocklist manager and logging</li>
<li>Geo IP blocking</li>
<li>User agent banning</li>
<li>Unlimited file scans</li>
<li>Timed Lockout brute force login attack shield for login security</li>
<li>404 limiter for blocking vulnerability scans</li>
<li>IP lockout notifications and security reports</li>
</ul>
<p>All the above is free and will enhance WordPress security for you. If you need extra security for your WordPress site, <a href="https://wpmudev.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=you_should_get_wpmudev_membership#trial" rel="nofollow ugc">you should get a WPMU DEV Membership</a>.</p>
<p>Our Membership gives you access to Defender Pro – which security features include automated scanning, scheduled malware scans for Core, themes, plugins and other files, audit logs, firewall protection, Safe Repair, Blocklist monitoring – alongside Snapshot Pro cloud backups, the Hub with automated plugin, theme and core updates and safe-upgrade scans, all our premium WordPress plugins, 24/7 WordPress support and if your sites already been hacked our team of security experts will clean it up at no additional cost.</p>
<p><a href="https://wpmudev.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=and_you_can_find_out_more_here#trial" rel="nofollow ugc">It’s an incredible deal, and you can find out more here</a>.</p>
<h3>About Us</h3>
<p>WPMU DEV is a premium supplier of quality WordPress plugins and themes. For premium support with any WordPress-related issues you can join us here:<br />
<a href="https://wpmudev.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=wpmu_dev_link" rel="nofollow ugc">https://wpmudev.com/</a></p>
<p>Don’t forget to stay up to date on everything WordPress from the Internet’s number one resource:<br />
<a href="https://wpmudev.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=defender-readme&utm_content=wpmu_dev_blog_link" rel="nofollow ugc">WPMU DEV Blog</a></p>
<p>Hey, one more thing… we hope you <a href="https://profiles.wordpress.org/WPMUDEV/" rel="nofollow ugc">enjoy our free offerings</a> as much as we’ve loved making them for you!</p>


Defender Security – Malware Scanner, Login Security & Firewall

WordPress security plugin with malware scanner, IP blocking, audit logs, antivirus scans, firewall, 2FA, brute force login security, and more.

iThemes

Lew Ayotte

SolidWP

Timothy Jacobs

Jared Hill

Lisa Canini

<h4>Reduce your WordPress website’s risk to nearly zero with Solid Security</h4>
<p><a href="https://go.solidwp.com/wporg-security-ithemes" rel="nofollow ugc">Formerly iThemes Security. Looking for iThemes? Learn more here.</a></p>
<p>On average, 30,000 websites are hacked every day.* Cyberattacks in the US increased by 57% in 2022.** Bad actors who want to hack your site, steal your data, and cripple your business are a 24/7/365 threat.</p>
<p>You need a proactive, strategic approach to WordPress website security that protects your site from brute force attacks, malware infections, and other cyber threats.</p>
<p><a href="https://go.solidwp.com/solid-security-pro" rel="nofollow ugc">Solid Security</a> shields your site from cyberattacks and prevents security vulnerabilities. It automatically locks out bad users identified by our Brute Force Protection Network that is nearly 1 million sites strong and leverages your own blacklist. It secures and protects your most commonly attacked part of your WordPress website – user login authentication.</p>
<p>With Patchstack integration (Pro) protects your site before you even have a chance to address vulnerabilities and before a plugin or theme vendor or developer can even issue a patch.</p>
<p>That’s 24/7/365 always-on truly Solid Security.</p>
<p><iframe loading="lazy" title="Welcome to Solid Security, Part of the SolidWP Suite" src="https://player.vimeo.com/video/863249227?dnt=1&app_id=122963" width="750" height="422" frameborder="0" allow="autoplay; fullscreen; picture-in-picture; clipboard-write"></iframe></p>
<h4>🌐 Secure your Website in Minutes</h4>
<p>The Solid Security setup and onboarding experience allows anyone to secure their WordPress website in under 10 minutes, regardless of technical acumen. Knowing that you have enabled all the right security settings for your website will leave you feeling like your site has never been more secure.</p>
<h4>📚 Security Site Templates to Fit Your Type of Site</h4>
<p>Enabling the correct security settings based on the type of website you are building or maintaining is essential for proper security. An eCommerce site requires a different level of security than a basic blog. Solid Security Site Templates make it quick and easy to apply the right security settings for your website.</p>
<p>Choose from six different site templates to apply the type of security your site needs:</p>
<ol>
<li><strong>Ecommerce</strong> – websites that sell products or services</li>
<li><strong>Network</strong> – websites that connect people or communities</li>
<li><strong>Non-Profit</strong> – websites that promote your cause and collect donations</li>
<li><strong>Blog</strong> – websites that share your thoughts or start a conversation</li>
<li><strong>Portfolio</strong> – websites that showcase your craft</li>
<li><strong>Brochure</strong> – simple websites that promote your business</li>
</ol>
<h4>⌚ Real-Time Website Security Dashboard</h4>
<p>Every day, lots of activity is happening on your website that you can’t see. Many of these activities can be related to your site’s security, so monitoring these events is vital to keeping your site secure.</p>
<p>The <a href="https://go.solidwp.com/solid-security-pro" rel="nofollow ugc">Solid Security Pro</a> plugin provides a real-time WordPress security dashboard that monitors security-related events on your site around the clock. The Solid Security Dashboard is a dynamic dashboard with all your WordPress website’s security activity stats in one place, including brute force attacks, banned users, active lockouts, site scan results, and user security stats (Pro).</p>
<h4>🗝️ WordPress Login Security</h4>
<p>Setting up and maintaining proper WordPress configurations and managing user account access are essential aspects of hardening your site against threats and vulnerabilities. Basic and Pro include features that address both of these factors.</p>
<ul>
<li>
<p><strong>Two Factor Authentication (2FA)</strong> – Make your WordPress login nearly impenetrable to attack by requiring users to enter a security code along with a password to login. The Solid Security plugin allows you to add two-factor authentication to your WordPress login with several authentication methods, including mobile apps like Authy and Google Authenticator, email, and backup codes.</p>
</li>
<li>
<p><strong>Password Requirements</strong> – Create and enforce a password policy for your users in less than a minute.</p>
</li>
<li>
<p><strong>reCAPTCHA</strong> (Pro) – Stop bad bots from engaging in abusive activities on your website, such as attempting to break into your website using compromised passwords, posting spam, or even scraping your content.</p>
</li>
<li>
<p><strong>Passwordless Logins</strong> (Pro) – WordPress security made easy. Secure your user accounts with 2fa & strong passwords while allowing real users login with a click of a mouse.</p>
</li>
<li>
<p><strong>Trusted Devices</strong> (Pro) – Identify the devices you and other users use to block session hijacking attacks and limit Administrator privileges to Trusted Devices.</p>
</li>
<li>
<p><strong>Automated Vulnerability Patching</strong> (Pro) – Solid Security Pro includes Patchstack which patches vulnerabilities before you have a chance to and applies fixes even before a plugin developer or vendor has issued a patch.</p>
</li>
</ul>
<p>Learn more about how <a href="https://go.solidwp.com/wporgpasswordless" rel="nofollow ugc">passwordless login is the future</a> and how Solid Security can help you implement it today.</p>
<h4>👨‍👩‍👧‍👦 The Right Amount of Security for Every User Level</h4>
<p>Different types of user levels require different levels of security. During the Solid Security setup process, you can identify your website’s key user groups. Once the different types of users are identified, you can apply the level of security that is just right for each user group.</p>
<p>Here are a couple of examples of how User Groups are useful for securing your site:</p>
<ul>
<li>
<p><strong>For Clients</strong> – Let’s say you are configuring Solid Security on a client’s website. You will decide whether or not they are required to use two-factor authentication and if they should have access to the Solid Security settings.</p>
</li>
<li>
<p><strong>For Customers</strong> – If you have an eCommerce website, you will decide whether or not you want to protect customer accounts with a password policy.</p>
</li>
</ul>
<p><strong>Privilege Escalation</strong> (Pro) also adds a safe, secure way to grant temporary admin-level access to your website.</p>
<h4>🤖 Block Bad Bots & Ban User Agents with Lockouts</h4>
<ul>
<li>
<p><strong>Ban Users</strong> (Basic and Pro) – Permanently block repeat offenders from accessing your site.<br />
Local Brute Force Protection – Automatically identify and stop the most common method of attack on WordPress sites.</p>
</li>
<li>
<p><strong>Local Brute Force Protection</strong> (Basic and Pro) – Automatically identify and stop the most common method of attack on WordPress sites.</p>
</li>
<li>
<p><strong>Network Brute Force Protection</strong> (Basic and Pro) – The network is the Solid Security community and is nearly one million websites strong. If someone tries to break into websites in the Solid Security community, Solid Security will block them across the network.</p>
</li>
<li>
<p><strong>Magic Links</strong> (Pro) – Security shouldn’t get in your way. Magic Links allow you to log in to your WordPress site while your username is locked out by the Solid Security Local Brute Force Protection feature.</p>
</li>
</ul>
<h4>🔍 Monitor Your Site’s Security Health</h4>
<ul>
<li>
<p><strong>File Change Detection</strong> (Basic and Pro) – Solid Security logs changes made to your website that can help detect malicious activity on your website.</p>
</li>
<li>
<p><strong>Site Scanner (Basic and Pro)</strong> – Schedule checks to run four times per day (Basic) or hourly (Pro) for known vulnerabilities of WordPress core file, plugins and themes. Using the Google Safe Browsing API, the Site Scan also checks your Google’s blocklist status and will alert you if Google has found any malware on your website.</p>
</li>
<li>
<p><strong>Patchstack integration (Pro)</strong> – Automated virtual patching of some vulnerabilities before you even have a chance to address them yourself, and before a plugin or theme vendor or developer can even issue a patch.</p>
</li>
<li>
<p><strong>Site Scanner</strong> (Pro) – Unlock Version Management to automatically apply a patch to vulnerable software detected by the Site Scan when one is available.</p>
</li>
<li>
<p><strong>User Logging</strong> (Pro) – Keep a record of user activity in your WordPress security logs, including login/logout, user registration, adding/removing plugins, switching themes, changes to posts and pages, and more.</p>
</li>
<li>
<p><strong>Version Management</strong> (Pro) – The Version Management feature in Solid Security Pro allows you to auto-update WordPress, plugins, and themes. Beyond that, Version Management also has options to harden your website when you are running outdated software and scan for old websites.</p>
</li>
</ul>
<h4>🧠 Smarter, More Actionable Vulnerability Prioritization</h4>
<p>Not all vulnerabilities pose the same level of risk, and the traditional Common Vulnerability Scoring System (CVSS) score doesn’t always reflect the realities of running a WordPress site.</p>
<p>Solid Security now uses the Patchstack Priority score, which goes beyond CVSS to provide a real-world risk assessment tailored to WordPress. It factors in how likely a vulnerability is to be exploited and its actual impact on your site.</p>
<p>With Patchstack Priority, you get a clearer picture of what really matters, helping you focus on the vulnerabilities that pose the greatest risk, and worry less about noise from low-impact issues.</p>
<h4>🛠️ Website Security Utilities</h4>
<ul>
<li>
<p><strong>Enforce SSL</strong> – Force all connections to the website to be made over SSL/TLS.</p>
</li>
<li>
<p><strong>Database Backups</strong> – Create backups of your WordPress database. (Not a complete backup.)</p>
</li>
<li>
<p><strong>Geolocation</strong> (Pro) – Improve Trusted Devices by connecting to an external location or mapping API.</p>
</li>
</ul>
<h4>🚀 Advanced Security Tools</h4>
<ul>
<li><strong>Identify Server IPs</strong> – Prevent issues caused by inadvertently locking out your server IPs.</li>
<li><strong>Change User ID 1</strong> – Change the user ID for the first WordPress user, potentially preventing attacks that assume the user with ID1 exists and is an administrator.</li>
<li><strong>Change Database Prefix</strong> – Change the database prefix that WordPress uses, potentially preventing attacks that assume the database prefix is “wp_”.</li>
<li><strong>Check File Permission</strong> – See the file and directory permissions of key areas of your site.</li>
<li><strong>Server Config Rules</strong> – View or flush the server security rules generated by Solid Security.</li>
<li><strong>wp-config.php Rules</strong> – View or flush the wp-config.php security rules generated by Solid Security.</li>
<li><strong>Change WordPress Salts</strong> – Secure your site after a successful attack by changing the WordPress salts used to secure cookies and security tokens.</li>
<li><strong>Hide Login URL</strong> – change the login URL of your site, making it harder for bots to find your login page and attack it.</li>
</ul>
<h4>🛟 Need Help?</h4>
<p>Free support may be available with the community’s help in the WordPress.org support forums. Our Solid Security support team provides top-notch technical support to all our Solid Security Basic users there.</p>
<p><strong><a href="https://go.solidwp.com/security-help-center" rel="nofollow ugc">Our Help Center will help you become an iThemes Security expert.</a></strong></p>
<p>Get additional peace of mind with professional support from our expert team and pro features to take your site’s security to the next level with Solid Security Pro.</p>
<h4>Recover From a Hacked Site</h4>
<p>Solid Security makes regular backups of your WordPress database, allowing you to get back online quickly in the event of a hack or security breach. Use Solid Security to create and email database backups on a customizable schedule.</p>
<p>For complete site backups and the ability to restore or move WordPress to a new host or domain, check out <a href="https://go.solidwp.com/security-basic-solid-backups" rel="nofollow ugc">Solid Backups</a>.</p>
<h4>Solid Central Integration</h4>
<p>Manage more than one WordPress site? Release lockouts and keep your themes, plugins, and WordPress core up to date from one dashboard with <a href="https://go.solidwp.com/security-basic-solid-central" rel="nofollow ugc">Solid Central</a>.</p>
<p>*Zippia. “30 Crucial Cybersecurity Statistics [2023]: Data, Trends And More” Zippia.com. Jun. 15, 2023, https://www.zippia.com/advice/cybersecurity-statistics/</p>
<p>**https://blog.checkpoint.com/2023/01/05/38-increase-in-2022-global-cyberattacks/</p>
<h3>License</h3>
<p>Released under the terms of the GNU General Public License.</p>


Solid Security – Password, Two Factor Authentication, and Brute Force Protection

The Best WordPress Security Plugin to Secure & Protect WordPress


When paired with Cloudflare for added security, this plugin is nice and lightweight. It's secure enough when you already have other security measures on your website and good hosting.



I do wish they had an option to disable reporting vulnerable software every time a plugin was one miner version behind on updates, especially since I have an auto update plugin on my website.



Other than that, if you have good and secure hosting, and are using a cloudflare dns, this is a good and lightweight plugin. (note: I'm also using nginx instead of apache).


Decent Plugin When Paired With Cloudflare


My experience was when testing this plugin on behalf of some of my customer's complaints.



Right after installing it, some dynamic images stopped working due to modifications this plugin makes to .htaccess file.



Such modifications are registered as being part of iThemes Security which makes it even harder to identify.



Because most of my customers don't even use git or any version control system, it gets even harder to identify such changes.



Also, by deactivating or even removing the plugin (using wp-cli or via panel) will not undo those intrusive changes.



Same goes to changes made in wp-config.php disallowinging file editing, regardless you configure the plugin to not alter your wp-config.php file.


Inadivertly changes .htaccess configuration


This plugin makes website protection simple with real-time monitoring and automatic blocking that works quietly in the background. I feel more confident knowing threats are stopped before they cause damage. The cost of the premium plan could be a hurdle for smaller projects but the features are impressive.


Reliable Security You Can Count On

Harden your site security with Login Security, Two-Factor Authentication (2FA), Vulnerability Scanner, Firewall, and more. Formerly iThemes Security.

Defender Security – Malware Scanner, Login Security & Firewall vs Solid Security – Password, Two Factor Authentication, and Brute Force Protection