WordPress Security Plugins Compared (2026): What We Actually Run on the Sites We Host

What one week of attack traffic looks like

Our shared hosting server keeps an access log for every site. We took the seven full days from 19 to 25 September 2026 (UTC) for the WordPress site roots on it and measured the requests that matter for security as a share of all traffic. These requests reached our server after Cloudflare’s edge had already filtered traffic for the sites behind it, so the open internet is noisier than this.

• Probes for secret files, 7.7% of all requests: .env files, .git folders, wp-config.php backups, phpinfo pages and SQL dumps. We checked every one that got an HTTP 200. Each was a webmail login page, a homepage with a query string tacked on, or WordPress’s own “already installed” notice. No secret file was served.
• Login attempts, 1.8% (POST requests to /wp-login.php). The busiest site took more than six times as many as a typical one.
• XML-RPC posts, 1.4%, sent to /xmlrpc.php, the old remote-publishing endpoint that bots like because one request can carry many password guesses.
• Requests for plugins the site does not have, 0.7%. These are scanners walking a list of plugins with known vulnerabilities. WooCommerce, Contact Form 7, Ninja Forms, Elementor and Code Snippets were near the top, along with folder names attackers use for backdoors, such as pwnd.
• User-list probes, 0.2% (?author= and /wp-json/wp/v2/users), fishing for administrator usernames.

Together, these five kinds made up about 12% of every request that reached the sites. None of this is targeted. It is the background noise of running WordPress on the public internet. It matters for choosing a plugin because a WordPress plugin can only act after PHP has started WordPress for each of these requests. A proxy at the edge turns most of them away before your server does any work at all.

What the WordPress sites we host actually run

On 26 September 2026 we took an inventory of the plugin folders on the same site roots, leaving out development copies nested inside them.

• All-In-One Security (AIOS): about two-thirds of sites. On nearly 90% of those, its PHP firewall is loaded as a must-use plugin, so it runs before the rest of WordPress on every request.
• Wordfence, Sucuri Security, Solid Security, Jetpack and MalCare: none.
• Patchstack: under 5%.
• No security plugin at all: about 30%. About half of those are staging builds on our own subdomains.
• WordPress core: about 85% on the current 7.1.2 release. The rest are staging or parked copies.

We did not pick AIOS because it tops a list. We picked it because it does the jobs only WordPress can do and leaves the heavy lifting to the layers in front of it. The free version includes login lockouts with a threshold you set, two-factor login, a moved login URL, blocking for user enumeration, PHP and 6G firewall rules, and file-change detection. It comes from Team Updraft, the people behind UpdraftPlus. It does not try to be our CDN or our backup system, which is exactly what we want from the WordPress layer.

An inventory shows what is installed, not how well it is set up. The must-use firewall loader is the best sign we can see from the file system that someone finished the setup.

The plugins, compared by where they work

All-In-One Security (AIOS): what we install

Login security, a firewall layer, and hardening in one free plugin. Its lockout answers with an HTTP 503, and in our week of logs those lockouts alone turned away 21% of all login attempts. Premium adds malware scanning, country blocking and smart 404 blocking, from $70 a year according to the plugin’s own listing. Watch the file-change scanner: without exclusions for cache and upload folders, it sends so many alerts that people stop reading them.

Wordfence

The best-known name and a capable plugin: an endpoint firewall and a malware scanner in one, plus two-factor login and passkeys, all free. The catch is in the free tier. Wordfence’s own pricing page says free firewall rules and malware signatures arrive 30 days after Premium, which costs US$149 a year per site. It runs inside PHP on your server, so scans use your CPU, and you notice that on shared hosting. If Wordfence is going to be your only firewall, pay for Premium.

Sucuri Security

The free plugin is an auditing and hardening tool: an activity log, file-integrity checks and a remote malware scan. Sucuri’s real protection is its paid cloud firewall, a DNS-level proxy. That is the same job Cloudflare does, and running two proxies in front of one small site creates more problems than it solves. It is a good choice if you want Sucuri’s cleanup service on retainer, and redundant if Cloudflare is already in front.

Solid Security (formerly iThemes Security)

A guided hardening wizard with two-factor login and login controls in the free version. Pro adds passkeys and vulnerability patching built on Patchstack’s data. It suits people who want a checklist-style dashboard. If you only need lockouts and two-factor login, it is more plugin than the job requires.

Patchstack

Not a login tool and not a malware scanner. Patchstack tells you which installed plugin has a known vulnerability, and its paid plans add virtual patches that block the specific exploit until the plugin author ships a fix. It pairs well with a login-focused plugin on sites that run a long list of third-party plugins.

Jetpack Protect

Automattic’s option: brute-force protection and a vulnerability scan using the WPScan database. It needs a WordPress.com connection, and the full malware scan and backups sit in paid Jetpack plans. It makes sense if you already use Jetpack for other things.

MalCare

Runs malware scans on its own servers rather than yours, which is easier on shared hosting. The free plan is mainly a scanner, and one-click cleanup is paid. A reasonable pick when malware detection is the main worry and nothing else in the stack handles it.

Where each layer belongs

1. The edge. A proxy such as Cloudflare with managed WAF rules, bot rules and rate limits. It absorbs the junk before your server spends any work on it. Nearly 90% of our hosting clients’ domains resolve through Cloudflare’s proxy (public DNS, 26 September 2026).
2. The server. A current PHP version, accounts isolated from each other, sane file permissions, and updates on a schedule. This is the host’s job, and it is the part you cannot fix with a plugin.
3. WordPress. One security plugin for what only WordPress knows: which account is logging in, whether it has two-factor enabled, which usernames exist, and which files changed.
4. Recovery. Off-site backups, a restore you have actually tested, and someone to call. This is the layer that saves you when the other three miss. Our 3-2-1 backup guide shows what that looks like for a small business.

One plugin, not three. Two firewalls fight over the same requests, two lockout systems lock out your own staff, and every extra security plugin is more code that needs patching. Our notes on the plugins we see in support work cover what happens when plugins collide.

Three sites, three different lessons

Viacore is a business site that was under constant low-grade attack: credential stuffing, bot probes and the occasional malicious file upload. Swapping plugins was not what moved the needle. We cleaned the existing malware, locked down admin access, and deployed targeted WAF rules with sensible rate limits, which now block about 12,000 threats a month, plus monitoring that surfaces real incidents instead of noise.

NuGlass was hacked with no recent backup to restore from. No security plugin could have fixed that morning. We rebuilt the site from scraped content and cached references, cleaned the compromised code, and relaunched it on hardened hosting with WAF rules, uptime monitoring and daily off-site backups going forward. Layer four is the one that was missing.

SkinFit MD is a medical aesthetics clinic where page speed affects bookings. We moved it to managed WordPress hosting, turned on the CDN and image optimization, and hardened admin access with two-factor login and firewall rules. For a clinic site, security and speed turned out to be the same project.

The AIOS settings we turn on

1. Login lockout: a small number of failed attempts, then a timed lockout.
2. Rename the login page, so bots posting to /wp-login.php get a 404. That filtered about 17% of login attempts in our week of logs. It filters noise; it is not a lock, so keep the lockout on too.
3. Two-factor authentication for every administrator and shop manager.
4. The PHP firewall and 6G rules, set up so they load before WordPress.
5. XML-RPC blocked unless Jetpack, the WordPress mobile app or another integration needs it. Check before you turn it off.
6. User-enumeration prevention, so ?author=1 and the REST users endpoint stop handing out usernames.
7. The theme and plugin file editor disabled, or DISALLOW_FILE_EDIT set in wp-config.php.
8. File-change detection, tuned to skip cache and upload folders so the alerts stay worth reading.

For everything outside the plugin, including updates, backups, admin accounts and old themes, our 21-point WordPress security checklist goes step by step.

What we recommend today (26 September 2026)

This is the setup Metro Vancouver IT stands behind as of this date:

• One security plugin: AIOS, free, configured as above. Wordfence Premium (US$149 a year) is a sound alternative when nothing filters traffic in front of the site. Add Patchstack when a site depends on many third-party plugins.
• A proxy in front: Cloudflare with the managed WAF rules switched on.
• Hosting that does its part: our WordPress hosting Standard plan is $15 CAD a month and includes the Cloudflare CDN and WAF, free SSL, off-site backups and uptime monitoring. Pro at $35 CAD a month adds advanced WAF rules management and priority incident response.
• Updates on a schedule: WordPress Care at $90 CAD an hour; a monthly cycle typically takes about two hours ($180).
• If it is already hacked: hacked WordPress cleanup is billed at $90 CAD an hour and typically totals $180–$270. If the same entry point is reinfected within 30 days, we clean it again at no charge, and you get a written report. You can read a redacted sample report first.

Printable checklist

1. One security plugin per site, never two.
2. Site proxied through Cloudflare with the managed WAF rules switched on.
3. Login lockout on, and the login URL moved off /wp-login.php.
4. Two-factor login for every administrator account.
5. XML-RPC off unless an app or Jetpack actually needs it.
6. REST user list and ?author= scans blocked.
7. Theme and plugin file editor disabled.
8. Core, plugins and themes updated this month, and unused plugins deleted.
9. An off-site backup restored at least once.
10. A named person to call if the site gets hacked, with their number on file.