WordPress security,
done properly.
The all-in-one WordPress security plugin: a firewall, malware and vulnerability scanning, brute-force login protection, two-factor authentication and WooCommerce checkout CAPTCHA — with signed updates and every feature in every plan.
Real-time security monitoring
for every WordPress site
See what's hitting your site, what's been stopped, and the single next thing to do — in plain language.
Malware & integrity scanning
Every core, plugin and theme file is compared with its official wordpress.org release, and anything unexpected is checked for malware. Quarantine, restore or view the diff in one click.
Watch. Block.
Sleep better.
Live traffic and blocks as they happen, a tamper-evident activity log, and an email the moment something matters.
One plugin.
Every layer of WordPress security.
Replace a stack of single-purpose security plugins with one console. Sensible, reversible protections start working the moment you activate — no config archaeology.
Web application firewall
Stops SQL injection, XSS, file inclusion and code injection before your theme does any work, with bot signatures, geo-blocking, rate limits and a daily IP reputation list. Monitor first, then block.
Malware scanner & removal
Checks every core, plugin and theme file against its official wordpress.org release, finds unexpected PHP and code injected into the database, then quarantines, restores or deletes it.
Vulnerability scanner
A cryptographically signed feed flags plugins, themes and WordPress core with known vulnerabilities — and plugins their authors have abandoned — so you can patch first.
Brute-force login protection
Limit login attempts, lock out repeat offenders, move wp-login.php to a custom URL, add a CAPTCHA, and refuse passwords already exposed in data breaches.
Two-factor authentication
Authenticator-app codes with backup codes, required for the roles you choose, plus an alert whenever an account signs in from a new device.
WooCommerce protection
A CAPTCHA on the classic and block checkout and the Store API stops card-testing bots, backed by checkout rate limits and blocks after repeated failed payments.
One-click hardening
Turn off XML-RPC, stop user enumeration, add security headers, hide version numbers and disable file editing — and lock the plugin's settings to the owners you name.
Tamper-evident activity log
Every login, setting change and security event is hash-chained to the one before it, so an edited or deleted entry shows. Know who did what, and when.
Live traffic & instant alerts
Watch requests, blocks and sign-ins as they happen, get an email the moment something matters, and a weekly security report built from real numbers.
Protects your site without watching your visitors
Self-hosted console
Fonts and scripts ship inside the plugin, so the security console loads nothing from a CDN and works on offline and firewalled installs.
Private by design
Device fingerprinting is opt-in, kept only as a salted hash, and never sent anywhere.
Leaked-password checks, privately
The optional breached-password check sends five characters of a password's SHA-1 hash. The password itself is never stored, logged or sent.
Safe to paste
Status reports hide database names and hosts when copied into a public support thread.
Simple, honest pricing
One licence covers every feature. Pick the number of sites you need — the more you protect, the less each one costs.