WordPress is a secure platform, but with so many websites powered by this software, it makes sense for hackers to focus their attentions on finding ways to exploit any weaknesses, no matter how small they are.
In this sense, the popularity of WordPress could be considered a downside of using the software. On the other hand, this large user base means that there is not only a huge community of users providing information on securing your WordPress site, there is also a great selection of tools and services dedicated to protecting your website.
Today, we will take a look at the best security plugins for WordPress. We will give you all the information you need to help you decide which plugin is right for your needs.
Essential Security Plugins You Should be Using
As these plugins are all free, with some having premium versions for those who need more features, there is no reason not to install a plugin that can improve the security of your WordPress site.
Just like backing up your website, taking measures to secure your site is often left until it’s too late and the damage has already been done. If you are yet to learn the hard way about the destruction a site hack can do, then now is the perfect time to install one of these free WordPress security plugins to ensure it never happens to your site.
BulletProof Security
This is a free security plugin for WordPress which is highly rated and popular. BulletProof Security has been downloaded over 1.1 million times and has an impressive 4.8 out of 5 star rating from users.
The plugin uses .htaccess security protection to defend many of the core WordPress files, including wp-config.php and php.ini, from attack. BulletProof Security also protects against attempts from hackers to carry out code injection and SQL injection, which is used to add content to your site without your permission.
With this plugin, you also get lots of detailed logs of login attempts and records of when users have gained access to your site’s admin area. As well as logging attempts to gain access to your site, BulletProof Security can protect against brute force attacks. The plugin also has the ability to send you email notifications when suspicious activity has been detected. For these email notifications, there are five levels to choose from, which includes triggers such as when a user logs into your site, and when a user gets locked out. This can prevent you from getting overwhelmed with email notifications should you run a busy multi-author blog.
Despite providing a great amount of protection, the developers of BulletProof Security have made it a priority not to impinge on the performance on your site. This means you don’t have to trade site speed for site security and can continue to offer your visitors a fast loading website after you’ve installed this free plugin.
You can also easily put your site into maintenance mode while you are dealing with a security threat with this plugin. This allows you to provide your visitors with some information as to why your full-site isn’t currently available. This is a handy feature that can be used in many ways to great effect.
The above is only a small selection of the many features of this plugin, so if you are looking for a comprehensive WordPress security plugin, BulletProof Security is a suitable choice.
Once BulletProof Security has been installed on your site, all the features can be accessed from a top level menu item that is added to the WordPress admin side menu. The user interface isn’t particularly attractive to look at, and while the warning messages can be a bit obtrusive, the functionality on offer can’t be argued with.
Through the plugin settings, you can do a lot to protect and safeguard your website, but the interface does get in the way of what is otherwise a great tool. However, if you can see past the interesting approach to design, there are a lot of useful features here.
BulletProof Security is a great choice thanks to its many features; however the lack of a user friendly interface could make other options in this post a better choice for those new to website security.
As this is a free plugin hosted at the WordPress plugin directory, it can be downloaded via your site’s dashboard or downloaded and uploaded via FTP.
Acunetix WP Security Scan
The Acunetix WP Security Scan plugin is another free tool that has been created to keep your WordPress site protected from those with malicious intent. Like BulletProof Security, it’s a popular option with over 1.3 million downloads and a 3.4 out of 5 star rating.
This plugin is ideal for scanning your site, determining how secure it is, and then finding out how to fix any weaknesses that are detected.
Once the plugin is installed on your site, the tools can be accessed from the WP Security top level menu item. As this is a feature packed plugin, there is a lot you can do with it, but a good place to start is the WP Security dashboard where you can see any of the potential security issues the plugin has detected.
A nice feature of this plugin is that each alert can be filtered by its level of importance. There is also a handy tooltip for each alert which provides a detailed explanation of why each item has been flagged, and a link to a solution. This allows you to take action to fix the issue before it becomes a problem.
This is a great security plugin that is ideal for those who already have a site up and running but have not yet chosen a tool to protect their site with. This is thanks to the plugin’s ability to carry out a scan and then provide you with a way to fix any legacy issues that are detected.
This is a free plugin so you can install it via your site’s dashboard or download the plugin and upload it via FTP.
Sucuri Security – SiteCheck Malware Scanner
Sucuri is a well-known name in the online security field, with services available to protect many different online publishing platforms including WordPress. They also offer a well-regarded clean-up service if your site has already fallen victim to an attack.
While this free plugin has only been downloaded a comparatively small amount of times compared to the other plugins here, it’s still a good choice for anyone looking for a credible tool to protect their site with.
This WordPress plugin is used to protect sites from security threats, including malware, spam, unauthorised .htaccess, and a whole lot more. If you want to get a sense of what Sucuri does before installing the plugin, then you can try the free online site scanner on their website.
Once the plugin is installed, the site scanner can be run from inside your WordPress admin area. The other features and tools of this plugin can all be accessed via a top level menu item on the admin side bar menu.
From within the plugin dashboard, you can run a site scan and see which problems, if any, your site is afflicted with. Through the nicely designed interface you can easily tighten up security on your site in a number of ways, all by simply clicking on a few buttons.
However, some of the settings and features which can be enabled from within your site take you to a sign up page for premium services, should you try to activate them.
This is a good freemium WordPress security plugin that gives you a lot of free tools to work with, while also making it easy to upgrade to the premium website security services offered by Sucuri.
iThemes Security (formerly Better WP Security)
With over 2.3 million downloads, and a 4.7 out of 5 star rating, it’s safe to say that this is the most popular WordPress security plugin available. The plugin was originally known as Better WP Security, before being acquired by iThemes in late 2013, with the plugin’s original developer joining the iThemes team and continuing to work on the project.
While the core plugin is still free, users get the opportunity to upgrade to the premium iThemes Security Pro plugin should they need any extra features and functionality.
A nice feature of this plugin is that as soon as it is activated on your site, an alert message is prominently displayed, giving you the option to secure your site now.
While a constant barrage of alert messages from plugins is almost always annoying, in this case it is used to good effect to allow users to quickly put this plugin to work, without having to locate the controls and get started in a more traditional way.
After clicking on the button to secure your site, you can then walkthrough the quick start for the plugin which includes creating a backup, setting permissions, and securing your site.
This approach to deploying the plugin is entirely optional and you can explore the settings and decide how to use iThemes Security in a more granular way if you want more control over how it works on your site.
The user interface of this plugin uses the native WordPress UI so it blends in seamlessly with the rest of the default admin pages. The settings and configuration options for iThemes Security are huge, so it’s good to see that there is a lot of online documentation available for this plugin, including a video walkthrough which can be accessed directly from within your WordPress admin area.
The free version of iThemes Security is easily the most user friendly security plugin for WordPress and thanks to the 30-plus ways it can protect your site from attacks, it could well be the most useful and feature packed security plugin for WordPress too.
Wordfence
This is the free plugin from the Wordfence security team and it’s another very popular option with close to 2 million downloads and an almost perfect rating of 4.9 stars out of 5.
The Wordfence homepage features a great map that displays in real-time, attacks that are taking place on WordPress sites, including where they are originating from and those that are blocked by Wordfence. It’s a great way to get a visual overview of this type of online attack as they are launched.
The map does more than just display where attacks are being launched from. It is also used as part of the Wordfence crowd sourced approach to blocking attacks. If one site using the Wordfence plugin is attacked, the attacker is then blocked by all the other sites using the plugin. This is a unique feature amongst WordPress security plugins and allows your site to be protected by using a live list of attackers that is updated in real-time.
Once the plugin is installed, it can be used to perform a deep scan of your website to check for any infections. Once the scan is complete, Wordfence can secure your website to fend off future attacks. The plugin also claims to make your site run up to 50 times faster, thanks to the caching features it includes.
The service compares all of the core WordPress files in use at your site against an archive of files, to check for any changes that have been made without your knowledge. The Wordfence plugin also helps you to fix these issues should any be found. As part of this source code verification feature, the plugin can also scan some open source themes and plugins that you might have installed on your site.
The tools and features of this plugin are broken down into sub-sets, and each can be accessed via the top level Wordfence menu item that is added to the admin sidebar of your site. The interface is well designed and fairly easy to navigate your way around when first starting out with the plugin.
There is also a premium version of Wordfence available for those who need a higher level or protection and support. Amongst the pro features, is cell-phone sign-in, which can be used to make it harder for hackers to gain access to your site via the login page. Visitors or attackers from entire countries can also be prevented from accessing your site if you sign up to the premium version.
Conclusion
While the popularity of WordPress can make it a target for those with nefarious intentions, this is vastly outweighed by the number of experts, tools, and services that are on hand, to ensure that the security-risk to your WordPress site is minimised.
With these five excellent WordPress security plugins you have plenty of options for keeping your site safe and secure. While it’s hard to pick a winner out of the group, iThemes Security is an ideal choice for anyone who wants an easy to use security plugin for their site, which also has all the necessary features to keep your site secure.
However, as these options are all free, you can easily install each of them and give them a try to determine which is the best choice for you.
What security plugin do you use to protect your WordPress website? Please let us know in the comment area below.
Thanks,
Joe