WordPress Security Features
Everything WP SecureGate does, grouped by the problem it solves. Every plan includes all of it; plans differ only in the number of sites.
Card testing, fake orders, spam accounts and checkout bots.
WooCommerce securityCheckout protection for WooCommerce shops plus the firewall, scanning and login security the store runs on.Card-testing protectionA shop-wide alarm for card-testing attacks, per-address checkout limits and no orders from throwaway billing emails.Fake ordersRefuses orders with throwaway billing emails and limits card-testing and coupon abuse at WooCommerce checkout.Spam registrationsSign-up limits, throwaway-inbox checks and an unused-accounts review for WordPress and WooCommerce.WooCommerce CAPTCHATurnstile, hCaptcha or reCAPTCHA on WooCommerce login, sign-up and checkout, always or only during an attack.
What gets refused before WordPress does any work.
FirewallA web application firewall that runs before your theme, refuses critical attacks and learns your team's work first.IP blockingManual block and allow lists, country blocking and automatic blocks for addresses that attack your site.Monitoring and alertsLive traffic, a weekly summary and opt-in email alerts that say who, from where and on what device.
Password guessing, two-factor, CAPTCHA and getting back in.
Login securityLockouts, a custom login URL, password checks and 2FA, with a way back in if you ever lock yourself out.Brute-force protectionLogin lockouts per address and per account, instant locks on fake admin usernames, and XML-RPC off by default.Two-factor loginAuthenticator-app codes for WordPress, required by role, with 10 backup codes and recovery if a phone is lost.Form CAPTCHATurnstile, hCaptcha, reCAPTCHA or a math challenge on login, comment and form-builder forms, plus a hidden honeypot.
Finding changed files, cleaning up and closing the door behind you.
Malware scannerFile integrity checks, stray PHP detection and a database scan, run daily and after every plugin change.Malware removalRestore official files, quarantine or delete malware, remove planted options and follow a recovery checklist.Activity logA tamper-evident log of sign-ins, user changes, settings changes and security events, kept for 90 days.
Signed updates, safer settings and what leaves your site.
Signed updatesSigned plugin updates for WP SecureGate itself: seven checks run before any new version installs.HardeningClose the side doors WordPress leaves open, with safe defaults and an undo for every change.PrivacySecurity that runs on your own server, collects little and lists exactly what it sends elsewhere.
Protecting the client sites you build and look after.
Also in every plan: warnings about abandoned and vulnerable plugins, a tamper-evident activity log, live traffic, a weekly security report and lockout recovery. See them on the homepage or compare plans and pricing.