A security plugin will not make a WordPress site safe on its own, but the right one closes the gaps attackers use most: weak logins, known plugin vulnerabilities and malicious requests. The hard part is choosing. Several plugins that were popular a few years ago have been renamed, sold or closed, and running three overlapping security plugins usually causes more trouble than it prevents.
This guide covers the WordPress security plugins that are still maintained in November 2026, what each one is actually for, which once-popular plugins you should remove, and how to check a plugin’s status yourself before you trust it.
Note Install counts and update dates below come from the WordPress.org plugin directory in November 2026. Prices and plans change often, so check the vendor’s site before you buy.
How to choose: one plugin per job
Most security plugins try to do everything, so it is easy to end up with two firewalls and three malware scanners fighting each other. Think in jobs instead, and pick one tool for each:
- Firewall and login protection: blocks malicious requests and brute-force login attempts.
- Vulnerability alerts or virtual patching: tells you when an installed plugin or theme has a known flaw, and ideally blocks the exploit until you update.
- Malware scanning: finds changed core files and injected code after something has gone wrong.
- Activity log: records who changed what, so you can trace a problem.
- Backups: the only thing that gets you back after a bad hack.
For most sites, one all-in-one plugin plus a backup plugin is enough. Add a vulnerability service if you run many third-party plugins.
The best WordPress security plugins in 2026
1. Wordfence Security
Wordfence is still the most installed security plugin, with more than 5 million active installs and updates as recent as 10 November 2026. The free version includes an endpoint firewall that runs inside WordPress, a malware scanner, login security with two-factor authentication, and brute-force protection. Paid plans add real-time firewall rules and malware signatures; free sites receive them after a delay.
Best for: a single plugin that covers firewall, scanning and logins.
Watch out for: the scanner can be heavy on small shared hosting. Schedule scans for quiet hours.
2. Kadence Security (formerly iThemes Security and Solid Security)
If you used iThemes Security, it is the same plugin under a new name. The WordPress.org listing now calls it Kadence Security and notes it was formerly iThemes Security. It has about 700,000 active installs. Its strength is hardening and login security: two-factor authentication, password requirements, brute-force protection, user lockouts and a vulnerability scanner.
Best for: locking down logins and applying hardening settings without editing files.
Watch out for: some hardening options can break plugins that rely on what you disable, such as XML-RPC. Turn them on one at a time.
3. Patchstack
Patchstack focuses on one job and does it well: it identifies known vulnerabilities in your plugins, themes and core, and its paid plans apply virtual patches that block the exploit before the official update arrives. It has about 100,000 active installs. It pairs well with a general security plugin rather than replacing one.
Best for: sites with many third-party plugins, and agencies looking after several sites.
4. Sucuri Security
The free Sucuri plugin (about 600,000 installs) is an auditing and hardening tool: it logs security events, checks core file integrity, scans for known malware from the outside and applies hardening options. The website firewall and malware clean-up service are separate paid products that work at the DNS level, in front of your server.
Best for: an activity audit and integrity checks, or as the dashboard for Sucuri’s paid firewall.
5. All-In-One Security (AIOS)
AIOS, formerly All In One WP Security & Firewall, has about 1 million active installs. It is a good free choice if you want firewall rules, login lockdown, two-factor authentication and file-change detection with clear settings grouped by difficulty. It is made by the team behind UpdraftPlus, which helps if you already use that for backups.
Best for: beginners who want a guided, all-in-one setup.
6. Jetpack Protect
Jetpack Protect (about 100,000 installs) scans WordPress core, plugins and themes against the WPScan vulnerability database, which Automattic owns. It does not need the full Jetpack plugin. If you only want to know when something you run has a known vulnerability, this is the lightest option.
Tip The standalone WPScan plugin still exists, but it has only around 8,000 installs. For most sites, Jetpack Protect is the easier way to use the same vulnerability data.
7. MalCare
MalCare (about 100,000 installs) runs its malware scans on its own servers instead of yours, so scanning does not slow your site. Its paid plans include one-click malware removal. It is a reasonable pick if Wordfence’s on-server scans are too heavy for your hosting.
8. Shield Security
Shield Security (about 30,000 installs) concentrates on bot blocking: it scores visitors by behaviour and blocks bad bots and brute-force attempts before they reach your login form. It is smaller than the others but actively maintained, with a release in late October 2026.
Plugins that do one job well
- Two Factor (about 100,000 installs) is the feature plugin maintained by WordPress contributors. Use it if you only need two-factor authentication.
- Limit Login Attempts Reloaded (about 1 million installs) is a simple way to stop password guessing if you do not want a full security suite.
- WP Activity Log (about 300,000 installs) is the most complete activity log if you need to see who changed what.
- UpdraftPlus (about 4 million installs) for scheduled off-site backups. Backups are part of security: when everything else fails, they are how you recover.
Plugins to remove: closed or replaced
Warning The WordPress.org directory closes plugins for security issues or when they are abandoned. A closed plugin no longer appears in searches or receives updates through WordPress.org. If you still run one of these, replace it.
- BulletProof Security: closed on WordPress.org on 30 October 2026. The notice says the closure is temporary while the plugin is reviewed, but until it reopens it cannot be installed or updated from the directory. Use another plugin in the meantime.
- WP Cerber Security, Antispam & Malware Scan: closed on WordPress.org on 22 September 2022 for a security issue. The developer distributes updates from its own site instead. If you rely on WordPress.org updates, move to one of the plugins above.
- iThemes Security / Solid Security: not closed, but renamed. Search for Kadence Security if you cannot find it.
How to check a security plugin before you trust it
You do not have to rely on a list like this one. The WordPress.org Plugins API is public and tells you whether a plugin is open, how many sites use it and when it was last updated:
curl -sg "https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&request[slug]=wordfence&request[fields][sections]=0&request[fields][active_installs]=1" \
| python3 -c "import sys, json; d = json.load(sys.stdin); print(d.get('name') or d.get('error'), d.get('active_installs'), d.get('last_updated'), d.get('description', ''))"The -g flag stops curl from treating the square brackets as a pattern. Swap wordfence for any plugin slug, which is the last part of its WordPress.org address. An open plugin prints its name, install count and last update date. A closed plugin prints no install count, followed by a notice saying when it was closed and whether the closure is temporary.
When you compare plugins, look for:
- an update within the last few months
- support for your WordPress version (the “Tested up to” value on the plugin page)
- a public vulnerability disclosure or bug bounty programme
- a large, active install base, which means problems are found and fixed quickly
Recommended setups
- Personal blog or small business site: Wordfence or AIOS, plus UpdraftPlus for backups.
- WooCommerce shop: Wordfence or Kadence Security, Patchstack for vulnerability patching, WP Activity Log and daily off-site backups.
- Agency managing many sites: Patchstack across all sites, one firewall plugin as standard, and centralised backups.
Important Do not run two firewall plugins at once, for example Wordfence and AIOS together. They can block each other, double up on scans and lock you out of the admin.
Security basics no plugin replaces
- Update WordPress, plugins and themes promptly. Most hacked sites run a plugin with a known, already-fixed vulnerability.
- Delete plugins and themes you do not use, rather than just deactivating them.
- Use strong unique passwords and two-factor authentication for every administrator.
- Give each person the lowest role they need. Not everyone needs to be an administrator.
- Keep backups off the server, and test that you can restore one.
- Use HTTPS everywhere and keep PHP on a supported version.
Conclusion
For most WordPress sites in 2026, one well-maintained security plugin such as Wordfence, Kadence Security or AIOS, plus reliable backups, covers the essentials. Add Patchstack or Jetpack Protect if you want earlier warning about vulnerable plugins. Most importantly, remove closed plugins such as BulletProof Security and WP Cerber, and check any plugin’s status in the WordPress.org directory before you depend on it.
Official reference Security plugins on WordPress.org · Hardening WordPress
