Every layer of WordPress
security, in one place.
Grouped by what you get without paying and what the money buys, because that is the question everybody arrives with. The short version: all four detection layers are free, the protection layer starts at Basic, and the AI layer is Pro.
The plugin view: findings, severity and next steps inside the WordPress admin
Two things are being sold, and they are not the same thing
Most WordPress security plugins package detection and protection together and then meter both, so the free tier finds a problem and declines to describe it. That converts a scanner into a lead-generation form, which is why so many people have four of them installed and still do not know whether their site is clean.
We split it differently. Detection is free and complete, signature matching, heuristic analysis, file integrity against the official WordPress.org checksums, and a database scanner that reads four tables and deserialises what it finds. If something is wrong with your site, the free plugin will tell you, in specific terms, with file paths and severity, for as long as you keep it installed.
What costs money is everything after the finding. Basic adds the controls that stop the common attacks and the audit trail that makes an incident reconstructable. Pro adds the reasoning layer for code nothing has catalogued, the firewall that filters requests before WordPress sees them, and removal, which competitors typically bill at $200 to $500 per incident as a separate service.
Free on WordPress.org: no account, no licence key
Four detection layers, scan scoping, traffic filtering and the security score. This is a complete scanner rather than a limited preview of one.
Malware Scanning →
Signature, heuristic, integrity and database layers, cross-referenced before anything surfaces.
Database Scanning →
wp_options, wp_posts, wp_postmeta and wp_comments, deserialised, with one-click cleanup.
File Integrity →
Core hashed against the official WordPress.org checksums; plugins and themes against their baselines.
Scheduled Scanning →
Daily or weekly, plus three on-demand scans a day and scoped scan modes.
IP Blocking →
Block lists, allow lists and country-level filtering, before a request reaches WordPress.
Configuration →
Cadence, scope and exclusions, sensible defaults, deep control when you want it.
The protection layer, via the Premium add-on
Everything above, plus the controls that stop an attack rather than describe one, and the record that lets you reconstruct what happened.
Security Hardening →
One-click configuration changes that remove whole categories of attack.
Login Security →
Brute-force lockout, TOTP two-factor and reCAPTCHA on the login form.
Real-Time File Monitoring →
SHA-256 baselines, watched continuously rather than on the next scan.
Audit Log →
Who did what, and when, the questions an incident is made of.
Instant Email Alerts →
Findings pushed to you, because a monitor nobody is told about is a log file.
The AI layer, the firewall, and removal
The part that handles what nothing has catalogued yet, stops requests before WordPress sees them, and cleans up what gets through.
AI Detection →
Reasoning about what code is written to accomplish, not what it matches.
AI Reports →
Every finding explained in language a site owner can act on.
One-Click Malware Removal →
Quarantine first, remove second, reversible, and included rather than billed per incident.
Notifications →
Slack and webhooks, so findings land where the people who fix them already are.
The full matrix
| Capability | Free | Basic | Pro | Agency |
|---|---|---|---|---|
| Signature malware scanning | Yes | Yes | Yes | Yes |
| Heuristic analysis | Yes | Yes | Yes | Yes |
| File integrity monitoring | Yes | Yes | Yes | Yes |
| Database malware scanning | Yes | Yes | Yes | Yes |
| One-click cleanup of infected database records | Yes | Yes | Yes | Yes |
| Targeted scan modes: core, plugins, themes or uploads | Yes | Yes | Yes | Yes |
| IP block lists and allow lists | Yes | Yes | Yes | Yes |
| Country-level IP blocking | Yes | Yes | Yes | Yes |
| Security score and A–D risk grade | Yes | Yes | Yes | Yes |
| One-click security hardening | No | Yes | Yes | Yes |
| Brute-force lockout, 2FA and reCAPTCHA | No | Yes | Yes | Yes |
| Real-time file monitoring with SHA-256 baselines | No | Yes | Yes | Yes |
| File quarantine and restore | No | Yes | Yes | Yes |
| Security audit log | No | Yes | Yes | Yes |
| Email security notifications | No | Yes | Yes | Yes |
| LLM scanning: reasoning about code intent | No | No | Yes | Yes |
| Plain-English AI explanations on every finding | No | No | Yes | Yes |
| Web application firewall | No | No | Yes | Yes |
| Virtual patching for zero-days | No | No | Yes | Yes |
| One-click malware removal | No | No | Yes | Yes |
| Slack and webhook notifications | No | No | Yes | Yes |
| Multi-site dashboard | No | No | Yes | Yes |
| White-label client reports | No | No | No | Yes |
Generated from the same file the plugin backend is provisioned against, so a row here cannot advertise something a licence will refuse to enable.
Common questions about the feature split
How much of this is actually free?
All four detection layers (signature, heuristic, file integrity and database scanning) plus one-click database cleanup, scoped scan modes, scheduled scanning, IP and country blocking, and the security score. 12 capabilities in total, with no account and no licence key.
Is the Premium add-on a separate install?
Yes. The core plugin comes from WordPress.org and the Premium add-on installs alongside it, then enables features according to your licence. Keeping them separate is what lets the free plugin stay a genuinely complete scanner rather than a locked shell.
Why is database scanning free when competitors charge for it?
Because a scanner that reads only the filesystem answers half the question, and a confident half-answer during an incident is worse than an uncertain whole one. A large share of modern WordPress malware persists in database rows, and a site owner who cannot see that is not being protected: they are being reassured.
What is the single biggest reason to pay?
The LLM layer on Pro, which assesses code by what it is written to do rather than what it matches. That is the layer that handles malware nothing has catalogued, which is precisely the malware most likely to be on a site that several other scanners called clean.
Do I need Basic if I already have the free plugin?
It depends on whether you want to be told or to be defended. Free detects; Basic adds hardening, login protection, real-time monitoring, quarantine and the audit log. If your site takes payments or holds customer accounts, the protection layer is the one that changes outcomes.
What are the minimum requirements?
WordPress 5.3 or later and PHP 7.0 or later, with PHP 8.x recommended. Tested up to WordPress 7.0.2. It works on shared hosting, and because scanning runs off your server rather than in your PHP process, host resource limits do not truncate a scan halfway through.
See it on your own site
The free scan takes under five minutes and tells you the truth.