WordPress Security for Agencies and the Client Sites You Look After

The same protection on every client website

There are no feature tiers to keep track of across a portfolio. The firewall, malware scanner, login protection, two-factor sign-in, CAPTCHA, hardening, activity log and WooCommerce checkout protection are on every plan. A plan covers a number of sites, and the per-site price drops as the plan grows; pricing lists them all.

Our terms allow a licence to be used on your own sites and on clients' sites you manage. If you buy on a client's behalf, you confirm you may accept the terms for them.

Client admins can't switch it off

On a client site, other people often hold administrator accounts. The ownership lock ties the plugin to the owners you name. Every other administrator, including a hijacked admin account, can't deactivate it, delete it or even see it. It also disappears from the REST plugin list, the Updates screen, Site Health and the auto-update email.

The lock works inside WordPress. Someone with FTP, SSH or WP-CLI access can still remove the plugin, so keep those credentials with you, not with the client.

Off by default. Once you turn it on, hiding the plugin is on too.

Move a licence when a client leaves

Your wpsecuregate.com account lists every site using your licences, with when it was activated and when it was last seen. When a client moves on, release their site there and activate the licence on the next one. Your plan sets how many sites can be active at once.

There is no central security console for all your sites. Each site's settings, logs and alerts live in its own WordPress admin, so the account is for licences and sites, not for managing security remotely.

Set up a new client site in minutes

A new install starts with the firewall in Block mode and spends its first 7 days learning your team's own requests, so normal editing isn't mistaken for an attack. On a WooCommerce shop, the checkout and coupon limits are on from day one, and the card-testing alarm watches the whole shop.

For the rest, the Recommended settings card gathers the changes worth making on most sites into one list. Untick anything a client needs left alone, apply the rest, and undo the lot with one click for 7 days afterwards.

Block mode and the learning week apply to new installs; a site that ran an older version keeps its settings.

Never locked out of a site you maintain

Lockouts happen on client sites: an office address changes, a phone with an authenticator app is lost, a custom login URL is forgotten. Every lock has a way back for the owner:

• a single-use emergency link, emailed only to administrator addresses;
• 8 one-time recovery codes you generate in advance and keep in your password manager;
• the WP-CLI commands wp securegate recover and wp securegate recovery-codes;
• the WPSG_SAFE_MODE constant in wp-config.php, which lifts the login URL, login gate, role rules, ownership lock, lockout and two-factor, and WPSG_FIREWALL_OFF for the firewall.

Always available. Recovery codes work only once generated.

Keep clients informed

Alert emails go to the recipients you list on each site, so you can include yourself, the client or both. Once you switch alerts on, each email says who did what, from which address, location, device and browser. Stopped attacks are gathered into a daily summary, so a client isn't woken by every blocked bot.

A weekly security summary goes out by default, to the alert recipients or the site's admin email: what the firewall stopped, the week's settings changes and anything that needs attention. The activity log keeps 90 days of events in a hash chain, which helps when a client asks who changed something. Status reports leave out database names and hosts, so you can paste them into a support thread.

Weekly summary on by default. Event alerts are off until you switch them on.

WordPress security for multiple websites and multisite

Many client sites usually means many separate installs, each with its own licence seat. WP SecureGate also runs on WordPress multisite networks, where the main site's settings apply across the network and two-factor works for users on every site.

Updates reach every site the same way. Each release is signed and checked against the key built into the plugin before it installs, and when a release ships, wpsecuregate.com sends a signed notice so sites with auto-updates turned on fetch it straight away. Auto-updates are a one-click opt-in on each site.

For freelancers, web designers and developers

If you build and hand over sites, the same features fit your workflow on a smaller scale. A few that developers tend to ask about:

• WP-CLI recovery commands, and constants for safe mode and turning the firewall off;
• firewall exceptions learned narrowly, one rule at one endpoint, and only from a signed-in editor or admin;
• opt-in extended protection that runs the firewall before WordPress loads, on hosts that allow it;
• CAPTCHA for Contact Form 7, Elementor Pro and WPForms, with a warning if another plugin already challenges the same form.