Pro is the plan
the product was designed around.
All four detection layers plus the LLM scanner that reasons about intent, the firewall, virtual patching, live threat intelligence and one-click removal: at $99 per site per year, which is about $8.25 a month.
Best for: Sites where being compromised costs real money: ecommerce, membership, lead generation, anything client-facing.
Reasoning about intent, not matching a pattern
Signature matching answers one question: have we seen this exact thing before? It is fast, cheap and correct, and it is blind to anything written last week. Heuristics widen the net by looking for suspicious construction, and pay for it in false positives, because a great deal of legitimate WordPress code is constructed suspiciously, caching layers evaluate generated code, minifiers produce dense unreadable output, licence checks obfuscate deliberately.
The LLM layer asks a different question: what is this code written to accomplish? A function that reads a request parameter, decodes it and executes the result is a backdoor regardless of how it is spelled, whether it has been catalogued, or how many layers of encoding it hides behind. A minifier's output is unreadable but has no interest in your request parameters.
That distinction is why the AI layer is the Pro boundary rather than something sprinkled across the tiers. It is the part that handles the malware nobody has catalogued yet, which is the malware most likely to be on a site that four other scanners called clean.
Every finding also comes with a plain-English explanation: what the code does, why it was flagged, what an attacker would use it for, and what to do about it. A file path and a severity score tell an experienced developer plenty and tell a site owner nothing, and the person who has to decide at nine on a Sunday evening is usually the second one.
The firewall, virtual patching and live threat data
The WAF filters requests at the HTTP layer before they reach WordPress, which is the only place some attacks can be stopped at all, a request exploiting a vulnerable plugin has already succeeded by the time PHP is executing it.
Virtual patching covers the window between a plugin vulnerability being publicly disclosed and the vendor shipping a fix. That window is historically the most dangerous fortnight in the WordPress calendar: the vulnerability is public, automated scanning for it begins within hours, the patch does not exist yet, and even after it ships a large share of sites do not apply it for weeks. Virtual patching blocks the exploit at the request layer so the gap stops being the site's problem.
Pro also connects to the Security Intelligence API, so detection uses live threat data rather than only the definitions bundled with the plugin. New campaigns are recognised as they are observed rather than at the next plugin release, and the IP reputation feed brings in networks with a current history of attack traffic.
One-click removal, and what it is worth
Detection without remediation leaves you with an accurate description of a problem you still have to solve. One-click removal cleans confirmed malware from files and database rows, with quarantine underneath so the action is reversible.
The commercial comparison is worth stating plainly, because it is the whole argument for the price. A professional malware cleanup typically costs between $200 and $500 per incident, and several competitors sell cleanup separately from detection, you pay for the scanner, then pay again when it finds something. Pro includes removal at roughly $8 a month. One incident, once, pays for several years.
Scanning frequency changes at Pro as well: hourly rather than daily, with unlimited on-demand scans. Hourly matters for the same reason real-time monitoring does, it compresses the interval in which an unnoticed payload is free to operate. Unlimited on-demand matters during a cleanup, when you need to verify each fix rather than ration your checks.
Five sites, one dashboard, and notifications where you work
Pro covers up to five sites under one licence with a single dashboard across them. That suits the shape most people are actually in: a main site, a staging copy, a client project, an old site nobody has retired. Checking one dashboard is the difference between reviewing security and intending to.
Slack and webhook notifications put findings where the people who act on them already are. Security email is filtered, ignored and eventually rerouted to a folder nobody opens; a message in the channel a team already watches gets read. The webhook makes findings available to whatever else you run, which matters if security events belong in a system you already use.
Beyond five sites, Agency is the better licence: not only on price but because fleet management needs different tools: bulk scheduling, configuration sync, digest emails and white-label client reports.
Everything included in Pro
Read from the same definition the checkout and the plugin backend use, so this list cannot drift away from what you actually get.
- Signature malware scanning
- Heuristic analysis
- Database malware scanning
- One-click cleanup of infected database records
- File integrity monitoring
- Targeted scan modes: core, plugins, themes or uploads
- Scheduled scans, daily or weekly
- On-demand scans (3 per day)
- IP block lists and allow lists
- Country-level IP blocking
- Security score and A–D risk grade
- Bundled malware definitions, updated with the plugin
- One-click security hardening
- Brute-force lockout, 2FA and reCAPTCHA
- Real-time file monitoring with SHA-256 baselines
- File quarantine and restore
- Security audit log
- Email security notifications
- LLM scanning: reasoning about code intent
- Plain-English AI explanations on every finding
- Security Intelligence API: live threat feed
- Hourly scheduled scans
- Unlimited on-demand scans
- Web application firewall
- Virtual patching for zero-days
- IP reputation feed
- One-click malware removal
- Slack and webhook notifications
- Multi-site dashboard
How the plans differ
| Pro | Free | Basic | Agency | |
|---|---|---|---|---|
| LLM scanning: reasoning about code intent | Yes | No | No | Yes |
| Database malware scanning | Yes | Yes | Yes | Yes |
| Web application firewall | Yes | No | No | Yes |
| One-click malware removal | Yes | No | No | Yes |
| Real-time file monitoring with SHA-256 baselines | Yes | No | Yes | Yes |
| Security audit log | Yes | No | Yes | Yes |
| Multi-site dashboard | Yes | No | No | Yes |
| White-label client reports | No | No | No | Yes |
| Price | $99 per site, per year | $0 forever, one site | $4.99 per site, per month | $149 per site, per year, before volume discount |
Pro questions
What does Pro have that Free does not?
The LLM scanner, plain-English AI explanations on every finding, the Security Intelligence API for live threat data, hourly rather than daily or weekly scans, unlimited on-demand scans, the WAF and virtual patching, the IP reputation feed, Slack and webhook notifications, one-click malware removal, and the multi-site dashboard for up to five sites. It also carries everything Basic adds, hardening, login protection, real-time monitoring, quarantine and the audit log.
Is database scanning a Pro feature?
No: the database scanner is in the free plugin, including one-click cleanup. What Pro adds is the LLM layer reasoning about what a flagged entry is for, rather than only that it matched a pattern.
How much is Pro per month?
Pro is billed annually at $99 per site, about $8.25 a month. If you specifically need monthly billing, that is Basic, but Basic has no AI layer, no firewall and no one-click removal.
Does Pro cover five sites or one?
Up to five sites under one licence, with a single dashboard across them. Beyond five, Agency is cheaper per site and adds the fleet tooling.
Does the AI scanner send my code to a third party?
Scanning runs on our infrastructure rather than inside your server. What is analysed is the code and security metadata needed to assess it, not your customers' personal data. The privacy policy sets out exactly what is transmitted.
What happens if Pro finds something it cannot remove?
You get the full finding with its file path, severity and explanation, and quarantine to isolate it safely. Some things (a compromised host account, a vulnerable server configuration) sit outside what any plugin can fix from inside WordPress, and we would rather say so than pretend the button covers everything.
Start free, upgrade to Pro when it earns it
The free scan tells you whether you have a problem. Everything above it is about how much of the fixing you want to do yourself.
No credit card for the free tier. Upgrade from inside the dashboard when you want to.