It’s a statistic that is both thought-provoking and a little chilling. According to security specialist iThemes Security, 50% of cyberattacks are said to target very small businesses and SMEs.
It’s a fact: a hack can affect any website, not just “large” high-profile websites.
To protect yourself, a good practice is to use a security plugin for WordPress.
We present 15 trustworthy ones in this article, along with our advice to help you choose the ones best suited to your needs.
Why secure a WordPress site?
Securing a WordPress site means first asking yourself a question. If the famous CMS (Content Management System) needs to be protected, is it because it is not secure?
The answer is no. The WordPress Core, meaning all the files and folders that make it up when you download it, is secure. Many security experts work on its development and maintenance every day.
In practical terms, as soon as a security flaw is detected by a member of the WordPress community, it is fixed very quickly.
In its analysis of vulnerabilities within the WordPress ecosystem published in 2022, security expert Patchstack reports, for example, that only 0.58% of vulnerabilities detected on WordPress come from the software Core.
Nevertheless, the risks of hacking are very real. So where is the weak point? The main culprits are your plugins. Security vulnerabilities are most often found in their code.
In addition, webmasters also bear some responsibility. Having an up-to-date WordPress site (running on the latest major version) is essential for strengthening a website’s security.
Yet in practice, only 6 out of 10 websites were running the latest version of WordPress at the time of writing.
Protecting yourself against malicious attacks therefore remains essential for several reasons:
- WordPress is a prime target for hackers and other bots (malicious robots) because it is the most widely used CMS on the planet, with 63.5% market share.
- A hacked site can cost you a lot of money. Hackers may first ask you to pay a ransom, not to mention the costs involved in cleaning up and getting your website back up and running.
These hackers can also use your customers’ bank details to carry out fraudulent transactions. - A poorly secured site makes you more vulnerable to the loss and theft of sensitive data (documents, login details, identity and payment information, etc.). Whether it is your own data or your customers’ data.
- With a well-protected site, you take care of your online reputation. A hack can damage your brand image and drive your visitors away.
- Search engines like Google penalize unsecured sites. For example, an error message will be displayed in some browsers if your site is not using HTTPS.
In addition, following a hack, you risk losing positions on Google search results pages. If people can no longer find you, or find you less easily, your organic search engine optimization (SEO) efforts and your revenue will be affected.
By using a security plugin, you will limit this kind of inconvenience. Discover our carefully selected list just below.
The best “general-purpose” WordPress security plugins
Before revealing our list of the best free WordPress security plugins, let’s address a fundamental point of understanding for the rest of this article.
You should know that there are two types of security plugins on the market:
- “General-purpose” plugins such as WordFence Security or Sucuri. They allow you, within a single interface, to implement several security actions at once (firewall, scanner, IP address blocking, protection against brute force attacks, anti-spam, etc.).
- Plugins for targeted use, which allow you to perform one main action “only.” This could be, for example, moving the login page or backing up your website.
To start, discover our selection of 6 general-purpose plugins right away. We have highlighted the ones that seem most effective to us, taking into account their popularity in the official directory (number of active installations).
We have also chosen to present a French plugin, which has the advantage of offering a clear dashboard available in French (which is very rare).
WordFence Security, the giant
With more than 4 million active installations, WordFence Security is the most popular security plugin in the official directory.
WordFence is an excellent plugin, already very comprehensive even in its free version. It is backed by a company specializing in security, which has been present within the ecosystem for many years, reflecting its seriousness and commitment.
Most of its options work automatically, which makes it easier to get started. However, its dashboard is only available in English and the options offered are sometimes quite technical to understand.
Main features of this WordPress security plugin
- WordFence offers a malware scanner to block requests that include malicious code or content.
- Protection against brute force attacks, limiting login attempts to your administration interface.
- Two-factor authentication (2FA, Two Factor Authentication) to log in to your WordPress site and protect yourself from hackers.
- A reCAPTCHA is included to limit spam with WordFence.
- Option to receive email alerts when a security issue is detected.
- WordFence allows certain IP addresses to be blocked manually.
- Managing security for multiple sites at the same time thanks to WordFence Central.
The plugin’s plus point
One of the major advantages of WordFence lies in the presence of a web application firewall (WAF) in its free version. In particular, it is capable of protecting your WordPress sites against cross-site scripting (XSS), SQL injection attacks, or directory traversal attacks.
WordFence Security pricing
WordFence Premium costs $119/year for use on one website. Compared with the free version, the paid plan has the advantage of updating all the tools offered (firewall, scanner, etc.) in real time as soon as a new threat is detected.
With the free version, the delay is extended to 30 days.
Sucuri Security, the audit specialist
Where most of its competitors offer at least a paid version of their free plugin, Sucuri (800,000 active installations) stands out in this area. It is completely free. A real advantage if your budget is tight.
Although it offers a security plugin designed for WordPress, Sucuri Security – owned by the hosting provider GoDaddy – can also be used on other CMSs such as Magento, Drupal, or Joomla.
Technically speaking, the Sucuri tool on WordPress primarily allows you to audit your website for potential security issues (at least in its free version).
Main features of Sucuri
- Automatic analysis of WordPress Core files.
- Web application firewall (Sucuri firewall), but only if you choose a premium plan.
- Display of login attempts on your sites (failed logins).
- Malware scan and detection of outdated software.
- Security notifications by email to the users of your website.
The plugin’s plus point
We appreciate the presence of security hardening options that can be enabled automatically with one click: blocking the execution of certain PHP files, removing the display of your WordPress version, updating security keys, etc.
Pricing
Sucuri is free, but this version is very limited. To benefit at least from its firewall (combined with a CDN), you will need to pay $9.99/month. Sucuri also offers security packages starting at $199/year.
All-in-One Security (AIOS) – Security and Firewall, the highest rated
All-in-One Security (AIOS) is among the highest-rated WordPress security plugins in the official directory (5 stars out of 5).
It is an all-in-one plugin capable of protecting your site’s files, its content, and its access. Not bad for fighting hackers.
AIOS is owned by UpdraftPlus, one of the most famous backup plugins, which you will discover throughout this article.
Main features of All-in-One Security
- Web application firewall capable of monitoring your traffic and blocking malicious incoming requests.
- Malware scanning.
- Two-factor authentication.
- Protection against spam and brute-force attacks.
The plugin’s plus point
Beyond its already comprehensive security options, All-in-One Security stands out for its options to protect your content. For example, you can prevent your content from being copied by disabling right-clicking and secure your iframes.
Pricing
AIOS offers a premium version priced at $80/year for use on one site. It notably includes more advanced options for malware scanning and for setting up two-factor authentication.
iThemes Security, the “long-standing” WordPress security plugin
iThemes Security — formerly Better WP Security — is one of the “old-timers” in this selection. The plugin has been around since the early 2010s and has carved out a prominent place for itself in the official WordPress directory, as it has more than one million active installations.
iThemes Security offers around thirty settings to the user on a dashboard translated into French. To make it easier for beginners to get started, iThemes takes a modular approach: to activate an option, simply click a button.
Main features of iThemes Security
- A clean interface.
- Two-factor authentication.
- Protection against brute force attacks.
- Analysis of your site to detect malicious software.
- Password hardening.
- IP address blocking.
- Security settings based on user role.
- Changing the database table prefix.
- Moving the login page to the URL of your choice (other than yoursite.com/wp-admin or yoursite.com/wp-login).
- Database backup.
- File alteration detection.
- Spam protection.
- Sending email notifications.
The plugin’s advantage
In its offering, iThemes Security provides a setup wizard capable of suggesting optimal security settings based on the category of your site or sites (Blog, Ecommerce, Portfolio, Membership site, etc.).
Pricing for this WordPress security plugin
If you want to benefit from all of iThemes’ features, a Pro version is available starting at $99/year for use on one website. However, it does not offer an application firewall, and its options are fairly limited.
In most cases, the free version will be enough to start protecting your website.
Jetpack, the multitasker
Jetpack is the ultimate Swiss Army knife among WordPress plugins. With more than 5 million active installations, it is one of the 10 most downloaded plugins of all time.
Its free version, made up of around fifty modules that can be activated with one click, allows you to manage features related to the performance, marketing, and therefore the security of your WordPress site.
Main features of Jetpack
- Protection against brute force attacks.
- Monitoring of downtime and availability for your WordPress site.
- Activity log to see all changes made to your site.
- Two-factor authentication.
- Real-time automatic backup option and one-click restore.
- Blocking unwanted comments and form responses.
- Automatic plugin updates.
The plugin’s standout feature
Jetpack has the advantage of being developed and maintained by Automattic, the company that runs WordPress. As a result, the plugin is updated frequently and gains new features quite often.
Pricing
Some Jetpack options are free (brute-force protection + downtime monitoring in particular). For the rest, you’ll have to switch to an expensive paid plan, billed at €25/month. Note that this premium license includes a firewall, a malware detection scanner, and backup options.
SecuPress, the made-in-France security plugin
Among the best-known general-purpose security plugins, SecuPress (30,000 active installations) is the only one that is 100% French. Behind it is security expert Julio Potier, who created and continues to maintain this security plugin for WordPress.
As stated on its presentation page in the official directory, SecuPress is “simple for you to use and difficult for hackers to break into Most recommendations are easy to implement with a simple checkbox, with few actions to be done manually.”
Main features of SecuPress
- A scanner capable of checking more than thirty security points for vulnerabilities and malware, among other things.
- Automatic correction (all you have to do is click a button) of detected security vulnerabilities.
- Presence of a firewall.
- Two-factor authentication.
- Detection of vulnerable themes and plugins.
- Email and Slack alerts.
- Option to schedule backups and the scanner.
- Blocking of bad bots and suspicious IP addresses.
The plugin’s advantage
At SecuPress, we appreciate the meticulous care given to the interface and user experience. The dashboard is clear, and the features are precise and well explained. This makes this security plugin a top choice for beginners. The fact that all settings and support are available in French is also a real plus.
Pricing for this security plugin
SecuPress Pro offers pricing based on how you intend to use the plugin. The more sites you install it on, the less it will cost you. For example, use on one site is billed at €60/year.
Outside of this selection, there are of course other general-purpose plugins for securing a WordPress site. Here are a few to consider during your research: Defender Security, WP Cerber Security, Malcare Security, Security Ninja, ShieldSecurity, BulletProof Security.
They all have at least a free version. So you can try them on your own site without taking any risks.
After general-purpose plugins, it’s time to introduce the second category of security plugins for WordPress: plugins with a targeted purpose. Get to know 9 of them.
The best security plugins with a targeted purpose
Google Authenticator, to enable two-step authentication
Google Authenticator allows you to enable two-factor authentication to log in to your WordPress admin interface.
It requires the use of the Google Authenticator app on your Android smartphone, iPhone, or BlackBerry.
Once the plugin is active in your back office, you will be asked to enter a security code provided by the app after entering your username and password.
This allows you to add an extra layer of protection to access your website if a malicious person obtains your username and password.
Google Authenticator is 100% free.
WP Hide & Security Enhancer, to hide your WordPress files
WP Hide & Security Enhancer is able to hide all core WordPress files, the login page URL, your theme, and all access paths to your plugins.
This way, it will be impossible to know that your website runs on WordPress, which will deter potential attackers and malicious bots.
The plugin states that:
- The plugin code uses URL rewriting techniques and WordPress filters to apply all internal features and functionality. No files or directories are modified.
- No knowledge of PHP is required, since all changes are automatic.
- The plugin not only allows you to modify the default URLs of your WordPress site, but it also hides/blocks these default values.
However, the free version of this WordPress security plugin will not be effective for Nginx servers (it only works with Apache and IIS). To avoid being limited in this respect, you will need to get the Pro version of the plugin, priced at $39/year for use on one site.
UpdraftPlus, the WordPress security plugin for backing up your site
It’s not necessarily the first thing you think of, but regularly backing up your site is an excellent practice for protecting it.
This won’t prevent you from being hacked, but if it happens, you will have a recent copy of your website, which is essential for restoring it as quickly as possible.
One of the most reliable plugins for this is UpdraftPlus. It is one of the most popular plugins in the official directory (3 million active installations) and offers several advantages:
- It allows you to back up your files AND your database.
- You have an option to automatically schedule your backups (no manual action is required in PHP code or elsewhere).
- It is possible to send your backups to the cloud (Dropbox, Google Drive, Amazon S3, etc.) to keep a secure copy of them.
- One-click restoration is possible.
The free version is already very good for backing up your site. If you are looking for even more advanced options, UpdraftPlus Premium (starting at $70/year for use on 2 sites) notably allows you to perform incremental backups (backing up only files modified since the last backup) and migrate your site.
Really Simple SSL, for switching to HTTPS
To secure your site, you need to switch it to HTTPS. This is made possible by activating an SSL certificate, which is generally free with most hosting providers. This is the case with Kinsta, which we recommend.
When your site switches to HTTPS, a padlock will appear in your browser tab to indicate to your visitors that the connection is secure.
If your showcase site, blog, or e-commerce site is not yet using HTTPS, migrating to this protocol can be intimidating, as many technical steps must be followed.
It was from this observation that the WordPress security plugin Really Simple SSL (4 million active installations) was born. Among its features, it offers, for example, an option to migrate to the HTTPS protocol in a single click.
Its Pro version (starting at €39 for use on one site with priority support) notably allows you to analyze and detect mixed content (content that loads over HTTP instead of HTTPS).
WPS Hide Login, to change the login page URL
By default, the URL of the login page for any fresh new WordPress installation can be accessed at one of the following URLs:
- www.votresite.com/wp-login
- www.votresite.com/wp-admin
For a bot or hacker, it is therefore very easy to try to log in to your admin interface by making repeated attempts.
Unless you use a plugin that changes the login page URL, such as WPS Hide Login (a French security plugin, by the way).
With it, you get an option to set the URL of the login form page of your choice. At the same time, the wp-admin directory and the wp-login.php page will become inaccessible.
Patchstack, to identify vulnerabilities
Patchstack is a monitoring plugin in the sense that it instantly informs you by email as soon as a new security vulnerability is detected on one of your sites.
The plugin is capable of analyzing both the WordPress Core, as well as your plugins and your theme.
From the moment a vulnerability is reported, the tool gives you suggestions for resolving it. Another interesting aspect of this plugin: you can add up to 99 sites to monitor in its free version.
Super convenient if you handle the maintenance of several sites and other blogs, whether they are yours or your clients’.
In premium (starting at $13.48/month per site), Patchstack blocks hacking attempts through its firewall and automatically patches security vulnerabilities before they can be exploited.
WP Activity Log, to monitor activity on your WordPress site
WP Activity Log is an activity log plugin. It is capable of recording everything that happens on your WordPress site, such as changes made by users to:
- Pages, posts and custom post types (changes to status, content, title, URL, etc.).
- Tags and categories (creation, modification, deletion).
- User profiles (changes to email, password, name, or role).
- Your themes and plugins (installation, deactivation, deletion, PHP code modification, etc.).
- Your database (modification of a table, for example).
Basically, if something suspicious happens on your site or blog, you will know thanks to WP Activity Log.
A premium version is available starting at $99/year, but it introduces few new features. To benefit from more powerful options (e.g., SMS alerts, real-time overview of logged-in users, support, etc.), you will need to pay at least $149/year.
BBQ Firewall, to enable a firewall
BBQ Firewall, also known as Block Bad Queries, automatically activates a firewall on your WordPress site or blog.
It analyzes incoming traffic, checks all types of requests (GET, POST, PUT, DELETE, etc.), and blocks malicious requests and bad bots.
Thanks to this, you benefit from additional protection against many threats such as SQL injection attacks, directory traversal attacks, and XSS attacks.
The plugin is very easy to use since it requires no configuration. It also offers a Pro version with advanced security rules for a price of $25 for use on one site (one-time payment, lifetime access afterward).
Limit Login Attempts Reloaded, to limit brute-force attacks
By default, WordPress does not impose any limit on the number of attempts you can make to log in to its administration interface.
Unfortunately, this leaves the door open to brute-force attacks. To limit them as much as possible, use the WordPress security plugin called Limit Login Attempts Reloaded.
It allows you to limit the number of login attempts to the WordPress admin by IP address. You can also choose how long one or more users who have made repeated login attempts will be banned.
The plugin can also display the number of attempts remaining before you can log in to the admin.
In its paid version (starting at $8/month for one website), Limit Login Attempts Reloaded notably lets you optimize performance by fending off brute-force attacks in the cloud.
How do you choose a security plugin for WordPress?
While reading our selection, one or more security plugins probably caught your attention. When making your final choice, apply the following tips:
- Enable only one general-purpose plugin at a time, to avoid bugs and incompatibilities. WordFence Security is one of the most effective, but it can slow down your page loading time. Otherwise, go with SecuPress, which has the advantage of being very comprehensive in terms of options, with the best-designed interface on the market.
- Choose an intuitive and easy-to-use plugin, to avoid getting lost in confusing settings menus (and making mistakes). It is also easier to choose a tool that does not require you to get your hands into the code (PHP, CSS, JavaScript, etc.). With the ones suggested in this article, you should be fine.
- Check user ratings and reviews: the higher a plugin is rated, the better.
- Set a budget. While all the plugins presented in this article have a free version, some offer essential options only in their paid plan. All of this comes at a cost.
- Take stock of your needs beforehand. Do you really need this or that option? Does this plugin offer the level of security you expect for your site or blog? Do you want access to support (assistance) in case of a problem? To find out, review its features carefully.
We also recommend that you get in touch with your hosting service before choosing a security plugin.
Some of them, like Kinsta, which we recommend, offer advanced security features such as a firewall, a backup system, a scanner, a free SSL certificate, etc.
Depending on the answers you get, you will be able to decide whether you need a general-purpose plugin as a complement, or whether a few plugins for specific uses are enough to complete the protection you already have.
Finally, don’t forget that using a security plugin is not a 100% foolproof shield. First, because no site is. And second, because it is up to you to apply best practices. We explain them in detail in our article that teaches you how to secure WordPress.
Despite all this advice, do you need professional assistance to ensure the security of your site or repair it after a hack? The Maintenance WP team of experts is available 7 days a week to provide tailored support. Contact us to find out more.
