TL;DR: feature-by-feature
Solid Security's checklist of 30+ hardening toggles is genuinely useful. But hardening alone isn't protection; sites with every Solid Security toggle enabled still get hacked, because hardening doesn't stop a vulnerable plugin from being exploited. You need active detection too.
| Feature | Solid Security | Guardian Gaze | Winner |
|---|---|---|---|
| Site hardening checklist | Excellent | Built in | Solid |
| Active malware scanner | Add-on | Built in | ✓ Guardian Gaze |
| Database malware scanner | No | First-class | ✓ Guardian Gaze |
| Real-time HTTP WAF | No | Yes | ✓ Guardian Gaze |
| Brute-force protection | Strong | Strong | Tie |
| Two-factor authentication | Free | Free | Tie |
| AI-assisted detection | No | Yes | ✓ Guardian Gaze |
| Starting paid price | $99/yr | $149.99/yr | Solid |
| Multi-site pricing | $199 / $399 tiers | Per site, from $1,341/yr for 10 | Solid |
Pricing comparison
Solid Security's basic paid tier starts at $99/yr, undercutting both Guardian Gaze and most competitors. The trade-off is that the lower price reflects a narrower scope; Solid is a hardening tool with detection bolted on, where Guardian Gaze is built around detection.
Solid Security
Formerly iThemes Security; site hardening and brute-force protection.
- FreeFree
- Basic$99/yr
- Plus$199/yr
- Agency$399/yr
Guardian Gaze
AI-powered, server-side malware detection.
- FreeFree
- Pro$149.99/yr per site
- Agencyfrom $1,341/yr
$50/yr more than Solid Security's basic plan covers AI-assisted detection, real-time WAF, and database malware scanning that Solid doesn't ship.
Solid Security pricing checked on 21 July 2026, taken from Solid Security’s own pricing page. Prices change — confirm on their site before deciding.
Where each tool wins
Solid Security strengths
- Strong site-hardening checklist, a lot of "30+ ways to secure WordPress" delivered as toggles.
- Mature brute-force protection and two-factor flows.
- Bundled with the StellarWP plugin family, comfortable for sites already in that ecosystem.
- Reasonable agency pricing.
Solid Security weaknesses
- Primarily a hardening tool, not a malware detector. No native malware scanner in the free tier; the paid scanner relies on external services.
- No real-time WAF, relies on rate limiting and login restrictions rather than HTTP-layer rule blocking.
- Doesn't address database-resident malware.
- Trusted devices and passkey features lean on operating-system biometric APIs that don't help server-side compromises.
Hardening vs detection: different jobs
Solid Security's value is in hardening: blocking the admin login URL, enforcing strong passwords, disabling file editing, preventing XML-RPC abuse, checking file permissions. Done well, these reduce your attack surface meaningfully.
What hardening can't do is stop a vulnerable plugin from being exploited. If you have an outdated copy of WooCommerce with a known SQL injection, Solid Security's checklist doesn't help; the attacker isn't trying to log into wp-admin, they're sending crafted requests to the vulnerable endpoint.
Guardian Gaze covers that gap. The WAF blocks known exploit patterns, virtual patching protects vulnerable plugins before the official patch ships, and the malware scanner catches anything that does get through. Hardening plus detection is the right answer; either alone is incomplete.
Active malware scanning
Solid Security's malware scanner uses external services, historically the free Sucuri SiteCheck and more recently their own paid scanner. It runs remotely, sees your site as a visitor sees it, and reports findings. This is fine for spotting visible damage (defacements, redirects, blacklisted status) but it can't see things that aren't surfaced to anonymous visitors: hidden admin users, encoded payloads in wp_options, mu-plugins backdoors, files in upload directories that don't render.
Guardian Gaze runs locally on your server with full filesystem and database access. It sees what a remote scanner can't.
Trusted devices and passkeys
This is something Solid does well. Their passkey implementation and trusted device fingerprinting raise the bar on login security materially. We don't match this and don't pretend to; most of our customers use 2FA + login lockout, which is sufficient against the common attack patterns.
If you specifically want a polished passkey experience, Solid is the better tool for that specific feature.
What we'll concede about Solid Security
If you want a one-page hardening checklist that takes you from "vanilla install" to "reasonably defended" in twenty minutes, Solid Security does that better than most.
Verdict: which should you pick?
Pick Solid Security if…
Sites that already use the StellarWP family (or formerly iThemes products) and want a checklist-driven hardening tool more than a malware platform.
Pick Guardian Gaze if…
You already harden your sites manually (or with Solid) and want active malware detection on top, you need WordPress-specific WAF rules and virtual patching, or you want database-malware scanning that Solid doesn't ship.
If you've checked off every Solid Security hardening item and still want active malware detection, particularly for the database-resident threats Solid doesn't touch, Guardian Gaze adds the layer they don't ship.
The free plugin installs in two minutes. Run a side-by-side scan and decide for yourself.
Install Guardian Gaze freeHow to switch from Solid Security to Guardian Gaze
You can run Solid Security and Guardian Gaze together; they cover different jobs and don't conflict. Many of our customers do exactly this: Solid for hardening, Guardian Gaze for detection and WAF.
- Install Guardian Gaze. Leave Solid Security in place.
- Configure Guardian Gaze's WAF. Solid doesn't have a real-time WAF, so this is purely additive.
- Run a baseline malware scan. Solid's external scanner sees the perimeter; Guardian Gaze sees the internals, findings should be additive, not conflicting.
- Decide on long-term split. Some customers keep both; some migrate to Guardian Gaze entirely and use our hardening checklist (under Tools → Site hardening). The choice depends on whether you value Solid's checklist UX enough to keep paying for it.
Frequently asked questions
Can I just use Solid Security and skip Guardian Gaze?
If your sites have never had a serious compromise, are kept patched, and run a small number of well-known plugins, possibly, yes. But hardening doesn't stop plugin exploitation, and if a vulnerable plugin gets attacked, Solid Security won't catch the resulting malware.
Do I need both products?
Not strictly. Guardian Gaze includes a hardening checklist that covers the essentials. But if you've already invested time learning Solid's UI, the two products coexist fine.
Is Guardian Gaze's WAF better than Solid's brute-force protection?
Different layer. Solid's brute-force protection is excellent at what it does (stopping repeated login failures). Guardian Gaze's WAF blocks attack patterns at the HTTP layer before they reach WordPress at all, including non-login attacks like SQL injection, XSS, and exploit attempts against vulnerable plugins.
What about Solid's network attack reporting?
Useful, but limited to attacks that hit Solid users' login endpoints. Guardian Gaze's threat feed pulls from a broader set of public sources (AbuseIPDB, Spamhaus) plus our own telemetry.
Will Solid's file change detection conflict with Guardian Gaze's?
No, both look at the same data but report independently. You'll get two alerts for the same change, which is mildly annoying but not harmful.