Wordfence
about £110 a year
$149 a year
about €132 a year
Protects against: Known attacks, malware, backdoors and password guessing. It has a firewall, a malware scan and login security.
Suits: Most sites that want one plugin for firewall and scans.
What we recommend
WordPress security
Why WordPress sites are a target, and the security plugins, services and hosts we recommend. No tool makes a site safe on its own: keep WordPress, plugins and themes up to date too.
Security questions
Why do WordPress sites get hacked?
WordPress runs 39.5% of all websites. So one bug in a popular plugin can put many sites at risk at once. Source: W3Techs, 2 Nov 2026.
How fast do attacks start after a bug goes public?
Attacks can start within hours of a bug going public. In early 2024, scripted attacks on a bug in the Bricks Builder theme began a few hours after it was made public. A third of the WordPress bugs reported in 2024 had no fix yet when they went public. Source: Patchstack, 2025.
What is the difference between a security plugin and a security service?
A security plugin runs inside your site, such as Wordfence with its firewall, malware scan and login security. A service works outside your site, or watches it for you: Cloudflare stops bad traffic before it reaches your site. No tool makes a site safe on its own: keep WordPress, plugins and themes up to date too. See Wordfence.
Free or paid security plugin?
Wordfence has a free version that covers most needs. Paid plans add more: MalCare's higher plans clean up malware for you, and Sucuri's firewall is a paid service. See MalCare.
What if my site is already hacked?
Some services clean up for you. If you are hacked, Sucuri's team cleans up the malware. MalCare's higher plans clean up malware too. See Sucuri.
Security plugins
These run inside your site.
All-In-One Security (AIOS)
50% off
50% off
50% off
about £33 a year
Was about £66. You save about £33.
$44.50 a year
Was $89. You save $44.50.
about €39 a year
Was about €79. You save about €40.
Protects against: Password guessing and common attacks. It has a firewall, login lockout and two-factor login.
Suits: Sites that want firewall and login protection in one plugin.
SecuPress
about £50 a year
about $68 a year
€60 a year
Protects against: Weak security settings. It checks your site and fixes the problems it finds.
Suits: Owners who want a security check-up of their site.
MalCare
Click to get priceProtects against: Malware, and attacks such as SQL injection and cross-site scripting (bad code put into your pages). Its higher plans clean up malware for you.
Suits: Sites that must stay fast: the scan runs on MalCare's servers, not yours.
Services: firewall, malware clean-up and bug alerts
These work outside your site, or watch it for you.
Patchstack
about £613 a year
$828 a year
about €735 a year
Protects against: Known bugs in plugins, themes and WordPress itself: it warns you and blocks attacks on them. It does not scan for malware.
Suits: Developers and agencies who look after many sites.
Cloudflare
Click to get priceProtects against: Bad traffic and widely used attacks, stopped before they reach your site. The full set of firewall rules needs a paid plan.
Suits: Any site, as a first layer in front of it.
Sucuri Security
Click to get priceProtects against: Hacks, DDoS attacks (floods of traffic) and attacks on new bugs, with a firewall in front of your site. If you are hacked, its team cleans up the malware.
Suits: Sites that want experts to clean up after a hack.
WPScan
Click to get priceProtects against: Known bugs. It keeps a list of more than 90,000 bugs in WordPress, plugins and themes, and tells you about the ones that affect your site.
Suits: Developers and teams who want bug alerts.
Hosts that keep WordPress up to date for you
From our hosting list. The host updates WordPress, so a fixed bug is not left open on your site.
SiteGround
85% off
88% off
87% off
£1.99 a month
Was £13.99. You save £12 a month.
$1.99 a month
Was $17.99. You save $16 a month.
€1.99 a month
Was €15.99. You save €14 a month.
Protects against: Out-of-date software: its plans include managed updates.
Suits: Small businesses that are growing.
Pressable
about £185 a year
$250 a year
about €222 a year
Protects against: Out-of-date WordPress: Pressable makes core updates for all its customers.
Suits: Agencies and growing sites.
WordPress.com
Click to get priceProtects against: Out-of-date WordPress: sites run the latest stable release and update by themselves.
Suits: Small sites that want no upkeep.
Deal alerts
Never miss a big WordPress deal
One short email when a big deal starts. Black Friday first. No spam, leave any time.
Join before 27 November to get the Black Friday deals first.
🎉Great decision.
Now check your inbox. Click the link in our email to confirm.