Everything in Pro,
across the whole fleet.
Agency licences start at 10 sites and add the tooling that only matters when you are managing many at once, bulk scheduling, configuration sync, digest emails, and reports you can send a client without editing them first.
Best for: Agencies and groups managing many sites, who need one dashboard and reports a client can read.
Per site, with volume discount
Agency is $149 per site per year at list, before the volume discount. The discount is banded: 10% from 10 sites, 15% from 20, and 20% from 50. A 10-site licence therefore comes to $1,341 a year, and a 50-site licence to $5,960.
The bands are applied automatically at checkout rather than negotiated, and they match what the payment system actually charges: the same numbers, from the same source, so the quote and the invoice agree.
There is no per-seat charge. Everyone at your agency who needs the dashboard has it, because charging per seat encourages password sharing and then punishes you for it.
What changes when you manage twenty sites
The problems change shape at scale, and they change into administration rather than security. Configuring hardening once per site stops being reasonable at about site eight, so configuration sync pushes a profile across the fleet and keeps new sites consistent with it from the day they are added.
Checking twenty dashboards stops being reasonable immediately, so digest emails summarise the whole estate (what changed, what needs attention, what is fine) in something you can read over coffee. The failure mode at scale is not missing a finding; it is a dashboard nobody has opened in three weeks because opening it costs twenty minutes.
Scheduling scans one at a time stops being reasonable too, so bulk scheduling handles the fleet, including staggering scans so twenty sites are not all scanned in the same hour.
White-label reports are what agencies ask about first
Not detection. Reports. A report you can forward to a client under your own branding, written so a non-technical reader can follow it, is the difference between security being an invisible cost you absorb and something you can show, justify and charge for.
That is a commercial argument rather than a technical one, and it is the honest reason agencies buy. Retainers get cut when the client cannot see what they pay for. A monthly report showing what was scanned, what was found, what was blocked and what was fixed makes the line item defensible, and turns a security tool from a cost into a service you sell.
The reports are genuinely white-label: your branding, your name on it, forwardable as-is with no editing pass to strip ours out.
A four-hour SLA and a path to the research team
Priority support carries a four-hour SLA, which exists because an agency's incident is several clients' incident at once and the clock is being watched by people who are not your staff.
For critical findings there is an escalation path to the RedSecLabs research team: the people who build the detection, not a first-line queue reading from a script. If you have found something genuinely novel, that matters, and it is also how novel samples end up improving detection for everyone.
Everything in Pro is included across every site: the LLM scanner, the firewall and virtual patching, live threat intelligence, hourly scanning, one-click removal, quarantine and the audit log. Agency adds the layer above them rather than replacing any of it.
Everything included in Agency
Read from the same definition the checkout and the plugin backend use, so this list cannot drift away from what you actually get.
- Signature malware scanning
- Heuristic analysis
- Database malware scanning
- One-click cleanup of infected database records
- File integrity monitoring
- Targeted scan modes: core, plugins, themes or uploads
- Scheduled scans, daily or weekly
- On-demand scans (3 per day)
- IP block lists and allow lists
- Country-level IP blocking
- Security score and A–D risk grade
- Bundled malware definitions, updated with the plugin
- One-click security hardening
- Brute-force lockout, 2FA and reCAPTCHA
- Real-time file monitoring with SHA-256 baselines
- File quarantine and restore
- Security audit log
- Email security notifications
- LLM scanning: reasoning about code intent
- Plain-English AI explanations on every finding
- Security Intelligence API: live threat feed
- Hourly scheduled scans
- Unlimited on-demand scans
- Web application firewall
- Virtual patching for zero-days
- IP reputation feed
- One-click malware removal
- Slack and webhook notifications
- Multi-site dashboard
- White-label client reports
- Bulk scan scheduling
- Multi-site configuration sync
- Multi-site digest emails
- Priority support with a 4-hour SLA
- Escalation to the RedSecLabs research team
How the plans differ
| Agency | Free | Basic | Pro | |
|---|---|---|---|---|
| LLM scanning: reasoning about code intent | Yes | No | No | Yes |
| Database malware scanning | Yes | Yes | Yes | Yes |
| Web application firewall | Yes | No | No | Yes |
| One-click malware removal | Yes | No | No | Yes |
| Real-time file monitoring with SHA-256 baselines | Yes | No | Yes | Yes |
| Security audit log | Yes | No | Yes | Yes |
| Multi-site dashboard | Yes | No | No | Yes |
| White-label client reports | Yes | No | No | No |
| Price | $149 per site, per year, before volume discount | $0 forever, one site | $4.99 per site, per month | $99 per site, per year |
Agency questions
How does the Agency discount work?
Volume bands applied automatically: 10% from 10 sites, 15% from 20, 20% from 50. A 10-site licence is $1,341/yr and a 50-site licence is $5,960/yr, about $119 per site.
What is the minimum?
10 sites. Below that, buying Pro per site is cheaper and you would not use the fleet tooling anyway.
Can I add sites mid-term?
Yes. Additional sites are added at your current band, and crossing a band threshold moves the whole licence to the better rate.
Are the client reports really white-label?
Yes: your branding, written for a non-technical reader, and forwardable as-is. This is the feature agencies ask about before any detection question.
Do my clients need their own accounts?
No. The sites sit under your licence and your dashboard. Clients receive reports; they do not need logins, and there is no per-seat charge for your own team either.
What if a client leaves?
Remove the site and add another in its place. Licences are counted by active sites rather than tied to specific domains, because agency rosters change and a licence that punishes that is a licence you work around.
Start free, upgrade to Agency when it earns it
The free scan tells you whether you have a problem. Everything above it is about how much of the fixing you want to do yourself.
No credit card for the free tier. Upgrade from inside the dashboard when you want to.