Did you know that about 170,000 WordPress sites were hacked in one single year? Most of these (51%) were hacked because they used insecure or vulnerable templates and/or plugins, and 8% were hacked because of weak passwords. Prevention is better than cure, therefore a firewall that prevents hackers from gaining access to your wordpress via Brute Force of SQL Injection is better than an antivirus.
Continue ➤ 5 Free CDN For WordPress – Speed Up And Improve Blog’s SEO
Why pay when there are free WordPress Antivirus and Firewall security plugins? I believe there is always a price for something, either direct or indirect. When I pay for a product, I know there is a dedicated team of programmers working to create a really good product, most important of all, they are committed to making the best plugin, bug free and compatible.
Alternatively, CloudFlare is a different kind of security plugin for WordPress. CloudFlare’s Web application firewall (WAF) rulesets are available on all of Cloudflare’s paid plans, the WAF has built-in rulesets, including rules that mitigate WordPress specific threats and vulnerabilities. These security rules are always kept up-to-date, once the WAF is enabled, you can rest easy knowing your site is protected from even the latest threats.
1. Smart Security Tools + Firewall Addon
Smart Security Tools: Firewall Addon adds 5 extra scanners for URL and user agent used for requests to filter out known and potential vulnerabilities. This addon performs similar tasks as some of the .htaccess tweaks Smart Security Tools plugin has already, but in many cases users report that they can’t use .htaccess tweaks due to server limitations (it works with Apache only and in some cases hosting company can limit what .htaccess can be used for).
If you can’t use .htaccess tweaks for security, this Firewall addon is what you need and must use with the Smart Security Tools plugin. This addon includes 5 scanners:
- Detect SQL Injection
- Scanner for Request URI
- Scanner for Query String
- Detect Bad User Agents
- Trap Bad Request Scripts attempts
2. WordFence Premium
Our WordPress security plugin provides the best protection available for your website. Powered by the constantly updated Threat Defense Feed, WordFence Firewall stops you from getting hacked. Wordfence Scan leverages the same proprietary feed, alerting you quickly in the event your site is compromised.
Our Live Traffic view gives you real-time visibility into traffic and hack attempts on your website. A deep set of additional tools round out the most comprehensive WordPress security solution available.
- Web Application Firewall – The Web Application Firewall stops you from getting hacked by identifying malicious traffic, blocking attackers before they can access your website. Powered by the Threat Defense Feed, it is automatically updated with new firewall rules that protect you from the latest threats. Even if you are running a vulnerable plugin or theme, Wordfence will protect you from being hacked by blocking attacks based on known and constantly updated attack patterns.
- Block Brute Force Attacks – It takes just one look at the live login activity on your site to quickly realize how many failed login attempts you receive. Wordfence monitors these and will lock out any attempts to brute-force guess your WordPress password or WordPress usernames.
- Real-Time Threat Defense Feed – Wordfence protects over 1 million WordPress websites, giving us unmatched access to information about how hackers compromise sites, where attacks originate from and the malicious code they leave behind. The team in their Forensic Lab are constantly adding updates as they discover new threats. Premium members receive the real-time version of the Threat Defense Feed. Free users receive the community version, which is delayed by 30 days.
3. All In One WP Security & Firewall
All In One WP Security and Firewall also uses an unprecedented security points grading system to measure how well you are protecting your site based on the security features you have activated. The security and firewall features are categorized as “Basic”, “Intermediate” or “Advanced”. This allows you to safely enable a group of security features without breaking functionality of your site as soon as you activate the plugin.
4. BulletProof Security Pro
BulletProof Security Pro has an amazing track record. BPS Pro has been publicly available for 5+ years and is installed on over 30,000 websites worldwide. Not a single one of those 30,000+ websites in 5+ years have been hacked.
BPS Pro protects your website files and database with multiple overlapping outer and inner layers of website security protection. The most powerful innermost countermeasure website security layer is AutoRestore|Quarantine Intrusion Detection and Prevention System (ARQ IDPS). A brief description of ARQ IDPS is below.
ARQ IDPS is a file monitor that automatically quarantines malicious hacker files and autorestores legitimate website files if they have been altered or tampered with. Quarantined files can be viewed, restored or deleted. ARQ IDPS can monitor and protect any/all website files under your entire Hosting Account.
ARQ IDPS uses a much more reliable method of checking and monitoring website files instead of scanning files for malicious code. Hacker files that do not contain any malicious code will never be detected by any/all scanners. ARQ IDPS quarantines all hacker files whether or not they contain malicious code.
5. Sucuri Basic
Sucuri is a globally recognized authority in all matters related to website security, with specialization in WordPress Security. The Sucuri Security WordPress Security plugin is free to all WordPress users. It is a security suite meant to complement your existing security posture with seven key security features:
- Distributed Denial of Service (DDoS) Mitigation
- Website Application Firewall (WAF)
6. Solid Security
Solid Security (formerly Better iThemes and WP Security) gives you over 30+ ways to secure and protect your WordPress site. On average, 30,000 new websites are hacked each day. WordPress sites can be an easy target for attacks because of plugin vulnerabilities, weak passwords and obsolete software.
Most WordPress admins don’t know they’re vulnerable, but Solid Security works to lock down WordPress, fix common holes, stop automated attacks and strengthen user credentials. With advanced features for experienced users, their WordPress security plugin can help harden WordPress. Solid Security works to protect your site by blocking bad users and increasing the security of passwords and other vital information.
- Prevents brute force attacks by banning hosts and users with too many invalid login attempts
- Scans your site to instantly report where vulnerabilities exist and fixes them in seconds
- Bans troublesome user agents, bots and other hosts
- Strengthens server security
- Enforces strong passwords for all accounts of a configurable minimum role
- Forces SSL for admin pages (on supporting servers)
- Forces SSL for any page or post (on supporting servers)
- Turns off file editing from within WordPress admin area
- Detects and blocks numerous attacks to your filesystem and database
7. Swift Security Bundle
[ Discontinued ] Hide WordPress, Firewall, Code Scanner. With the Swift Security plugin you can make your WordPress website more secure with a single click. A great advantage of the plugin is that you don’t need any special technical knowledge. Swift Security is an incredible WordPress security plugin, which turns your WordPress site into a secure, “bulletproof” website.
- Hide WordPress version
- Built-in Firewall
- IP/GEO Filter
- Scheduled Code Scanner
- Anti-Brute Force
- Comment Spam Blocker
Indeed, an excellent compilation. To prevent from brute force attack one can easily:
– Change the WordPress login URL
and/or
– Use limit login attempts
and/or
– Use htaccess to disallow all IP addresses expect yours.
Excellent list. I have been using All in One Wp Security on my WordPress blogs. However, someone recently suggested using Ninja Firewall. It also works great!
Thanks!