WordPress security plugins compared: what each one does and how to choose

A security plugin does up to five jobs. Which of them it does is what separates one plugin from another.

Malware scanning. It looks for code that should not be there, often by comparing WordPress, your plugins and your themes with the original files.
Login protection. It limits failed logins, adds two-factor authentication, or puts a CAPTCHA on the login page.
Hardening switches. Settings you could make by hand, such as turning off the file editor in the dashboard, offered as a list of options.
A firewall. It checks each request against a set of rules and refuses the ones that look like attacks.
A log. A record of who logged in and what was changed.

It does not replace updates, backups or good passwords. A plugin with a known hole stays open until it is updated. A scan does not bring back what an attacker deleted, and a backup does. A login with a password that someone guessed or stole looks like any other login. The listing of one of the plugins below puts it this way: "Nothing replaces diligence and good practice." The WordPress security guide covers that groundwork.

How to choose

What the free version leaves out. Every plugin here has a free version, and each draws the line in a different place. In some the malware scan is free and the cleanup is paid. In others there is no malware scan without paying.
Where the work is done. A plugin that scans on your own server uses that server while it scans, and keeps what it finds there. A plugin that scans on its maker's servers is lighter on your hosting, needs an account with that company, and sends it information about your site.
What you already have. Ask your host what it does: a firewall, a malware scan of your files, cleanup if the site is infected. You need only the parts it does not cover.
Who will read it. Alerts and scan results help only when someone reads them and acts.

Run one security plugin, not two. Two plugins that both control the login page, or both filter requests, block the same visitor twice, fill two logs and make it hard to tell which of them refused a request. If you keep a second plugin for one feature the first lacks, switch off every part where the two overlap.

The plugins side by side

Plugin	Free version includes	Needs the paid version	Where the work is done
Wordfence Security	Firewall, malware scan with file repair, two-factor login, login CAPTCHA	New firewall rules and malware signatures as they are released, a real-time blocklist of attacking addresses, country blocking, audit log	On your server
Kadence Security	Two-factor login, password rules, brute force protection, file change detection, a scan for known vulnerabilities	Passwordless login, trusted devices, automatic vulnerability patching, a log of user activity	On your server
Sucuri Security	Activity log, file integrity monitoring, a malware scan from outside, blocklist monitoring, hardening options	The firewall, which is a separate paid service	On your server, with the malware scan run from Sucuri's side
All-In-One Security (AIOS)	Login lockout, two-factor login, firewall rules, file change scanner, audit log	Malware scanning, country blocking, blocking by 404 errors	On your server
Jetpack	Brute force protection, downtime monitoring, a firewall with lists of addresses you keep by hand	Malware scanning, firewall rules that update themselves, real-time backups, spam protection	Through a WordPress.com account
MalCare	Malware scan, firewall, CAPTCHA on the login page	Seeing which files are infected, malware removal, hardening, country blocking	On MalCare's servers, through a MalCare account

The plugins one by one

Wordfence Security

Wordfence puts a firewall, a malware scanner and login protection in one plugin, and all of it runs on your own server. The scanner compares WordPress, your plugins and your themes with the copies on WordPress.org, reports what differs and can put the original file back.

The free version receives new firewall rules and malware signatures 30 days after paying customers do. Wordfence suits an owner who wants the widest set of tools without paying and who will read what the scans report.

Kadence Security

This is the plugin that was called Solid Security and, before that, iThemes Security. Its weight is on logins and user accounts: two-factor authentication, a password policy, lockouts after failed logins, and a network that blocks an address on every site in it once that address has attacked one of them.

The listing describes no scanner that reads your files for malware. Its site scan checks for known vulnerabilities and whether Google has flagged the site. The plugin changes the database and some of the site's files, and its authors ask you to take a complete backup before using it. It suits a site with several users, where logins are the main worry.

Sucuri Security

The free plugin watches and reports. It logs security events, notices when a file changes, checks whether the site is on a blocklist, and has a set of actions for after a hack, such as resetting every user's password. Its malware scan runs from outside and loads the site the way a visitor would, so it sees what a visitor is served. Changes to files on the server are the file monitor's job.

Sucuri's firewall is a separate paid service that runs on Sucuri's network. The plugin suits an owner who wants monitoring and an audit trail, or who already pays for that firewall and wants to manage it from the dashboard.

All-In-One Security (AIOS)

AIOS comes from the team behind UpdraftPlus and is built as a long list of switches, each marked basic, intermediate or advanced. What it collects is stored on your server, and its listing says nothing is sent anywhere else.

Malware scanning is in the paid version, which is an add-on: the free plugin stays installed beside it. Features that rely on .htaccess do not apply on nginx. AIOS suits an owner who wants hardening and login protection with the data kept on the site's own server.

Jetpack

Jetpack is a general-purpose plugin from Automattic, and security is one of the things it does. It needs a WordPress.com account to work. Its listing names brute force protection and downtime monitoring as free. The firewall can be switched on without paying, with lists of addresses that you allow or block yourself. Rules that update themselves need a paid plan, and so does malware scanning.

Jetpack suits a site that already uses it for other things. On a site that does not, it is a lot of plugin to add for login protection.

MalCare

MalCare does its scanning on its own servers and not on yours, which is why it needs a MalCare account. The company says it stores the list of your plugins and themes with their versions, and that it tracks the IP addresses of visitors to your site.

The free scan runs once every 24 hours and tells you that malware was found. Seeing which files are infected is paid, and so is removing the malware. MalCare suits a site on a small hosting plan, where a scan on the server would be felt, and an owner who is content for an outside service to hold that information.

Which one to use when

If you want one free plugin that scans files, filters requests and protects the login, and your hosting has room for scans to run on it, use Wordfence.
If logins are the worry, because authors, clients or customers have accounts, use Kadence Security or AIOS. Neither scans your files for malware in its free version, so find out whether your host does.
If scans slow the site down on a small hosting plan, use MalCare, which scans on its own servers.
If Jetpack is already installed, switch on its brute force protection before you add another plugin.
If you need to know who changed what, Sucuri Security and AIOS keep a log in their free versions.
If you want attacks stopped before they reach your server at all, no plugin does that. It is the job of a firewall that sits in front of the site, and WordPress firewalls compared explains the difference.

If you would rather not run any of this yourself, our WordPress security service does the routine through a care plan: weekly updates, security scanning and daily offsite backups.

Before you switch one on

Take a backup of the files and the database first. Some of these plugins write rules into .htaccess and wp-config.php, and change the database.

If the new plugin replaces another, deactivate the old one before you activate the new one, then open .htaccess and check that the old plugin's rules are gone.

Turn features on a few at a time. After each group, load the site, log out and log back in. If something stops working, the cause is in the group you turned on last.

Login limits and firewall rules can shut out the site's owner. If that happens, how to fix the 403 Forbidden error shows how to switch the plugin off from the file manager and clear the block.