WordPress security
Review suspicious changes, unsafe settings, login abuse, and other security signals directly in WordPress. Start with local checks, then add connected monitoring and response workflows when Pro becomes available.
Free and Pro available
Problem and solution
WordPress security issues often start as small warnings: risky settings, exposed uploads, weak login controls, suspicious file changes, or forms that invite abuse. This product gives owners a local security baseline and a paid path for teams that need shared security policies, cloud-assisted checks, scheduled reports, temporary protection for known vulnerabilities, approved remote task coordination, and incident workflows.
Web Plura Security Center groups the relevant work into a clearer WordPress workflow with practical next steps.
Start locally with Free, then add connected history, monitoring, collaboration, or automation only when those capabilities are available and useful.
Key benefits
Bring suspicious files, configuration weaknesses, login abuse, and administrator drift into one review.
Apply practical login, firewall, upload, permission, and exposure controls from WordPress.
Add policy oversight, vulnerability intelligence, reports, and incident follow-up as the security workload grows.
Start with a local security review before committing to a paid workflow.
Workflow
Free version
Choose Free for practical local security scans, login protection, file-change review, firewall controls and WordPress-native incident visibility without a cloud account.
Find common WordPress security risks and act locally.
Check files and recent changes for malware indicators so unusual activity is easier to investigate.
Rate-limit repeated requests and temporarily block abusive traffic to reduce routine login pressure.
Find risky administrators, permissions, uploads, debug logs, archives, XML-RPC, and REST exposure.
Pro version
Pro includes everything in Free and adds the connected capabilities below. Choose Pro if your team needs connected policy, vulnerability intelligence, scheduled reporting and cloud-assisted incident workflows.
Keep security posture consistent across time and sites.
Apply consistent protection expectations across connected sites instead of configuring each site independently.
See relevant vulnerability intelligence and virtual-patch status so urgent exposure receives attention sooner.
Review recurring security reports and coordinate incident follow-up with a retained response trail.
Free vs Pro
Choose Free for practical local security scans, login protection, file-change review, firewall controls and WordPress-native incident visibility without a cloud account. Choose Pro if your team needs connected policy, vulnerability intelligence, scheduled reporting and cloud-assisted incident workflows.
| Feature | Free | Pro |
|---|---|---|
| Free features | ||
| Suspicious-file scanningCheck files and recent changes for malware indicators so unusual activity is easier to investigate. | YesIncluded in Free. | YesIncluded in Pro. |
| Login and firewall controlsRate-limit repeated requests and temporarily block abusive traffic to reduce routine login pressure. | YesIncluded in Free. | YesIncluded in Pro. |
| Access and exposure reviewFind risky administrators, permissions, uploads, debug logs, archives, XML-RPC, and REST exposure. | YesIncluded in Free. | YesIncluded in Pro. |
| Local security reviewsLocal security reviews for suspicious file changes, public-risk indicators, and risky configuration. | YesIncluded in Free. | YesIncluded in Pro. |
| Form Abuse & Lead Security advisorForm Abuse & Lead Security advisor for form plugins, lead pages, outgoing email delivery, privacy-page status, plugin updates, and risky form markers. | YesIncluded in Free. | YesIncluded in Pro. |
| Firewall rulesFirewall rules with rate limiting and temporary blocking controls. | YesIncluded in Free. | YesIncluded in Pro. |
| Incident and audit tracking inside the WordPress adminIncident and audit tracking inside the WordPress admin panel. | YesIncluded in Free. | YesIncluded in Pro. |
| Email notification supportEmail notification support for new local issues. | YesIncluded in Free. | YesIncluded in Pro. |
| Local baseline checks that remain availableLocal baseline checks that remain available without a paid plan or Web Plura Cloud connection. | YesIncluded in Free. | YesIncluded in Pro. |
| Pro features | ||
| Managed security policiesApply consistent protection expectations across connected sites instead of configuring each site independently. | NoPro feature only. | YesIncluded in Pro. |
| Vulnerability and patch visibilitySee relevant vulnerability intelligence and virtual-patch status so urgent exposure receives attention sooner. | NoPro feature only. | YesIncluded in Pro. |
| Scheduled reports and incidentsReview recurring security reports and coordinate incident follow-up with a retained response trail. | NoPro feature only. | YesIncluded in Pro. |
| Cloud-assisted checks and monitoringCloud-assisted checks and monitoring when the active plan allows them. | NoPro feature only. | YesIncluded in Pro. |
| Scheduled reports and incident workflowsScheduled reports and incident workflows for teams that need recurring oversight. | NoPro feature only. | YesIncluded in Pro. |
Who it helps
Use Free to establish a local security baseline; add Pro when recurring oversight becomes important.
Review file, user, configuration, and update risks before maintenance handoffs.
Use Pro for consistent policies, scheduled reports, and incident coordination across client sites.
Common use cases
Run a first-pass WordPress security review after taking over a site or before handing it to a client.
Check suspicious file and configuration signals without requiring a cloud account.
Review form-abuse and administrator-risk posture before campaigns, launches, or support handoffs.
Move business-critical sites to Pro when scheduled reporting, policy sync, virtual patching, and incident workflow support are required.
Trust and control
Free is the local foundation. Pro extends that workflow without taking away the Free capabilities that already work on the site.
Availability and requirements
The Free plugin and paid Pro workflow are available now.
Free runs in the supported WordPress workflow described here. Connected Pro services require Web Plura Cloud and an available Pro plan.
The plugin helps you start from your WordPress dashboard. Web Plura cloud plans add deeper protection, reporting, and team coordination when you need more.
FAQ
Yes. Choose Free for practical local security scans, login protection, file-change review, firewall controls and WordPress-native incident visibility without a cloud account.
No. The verified Free workflow runs locally in WordPress without a cloud account or paid subscription.
Choose Pro if your team needs connected policy, vulnerability intelligence, scheduled reporting and cloud-assisted incident workflows.
Yes. The local Free workflow remains available. Pro services are separate and add connected capabilities when they are available and useful.
Free findings and incident history stay in WordPress. Connected Pro services receive only the information required for an approved cloud check or report.
No. Security Center identifies risks and provides controls, but it does not promise automatic malware removal or complete protection. The administrator decides what action to take.
Use Pro for consistent policies, scheduled reports, and incident coordination across client sites.
Free works with WordPress security, login, form, user, file, and permission signals. Pro adds supported Web Plura Cloud monitoring and response workflows for active plans.
Next step
Install Free and run a local security review. Add Pro later when recurring monitoring, shared policy, reporting, or response coordination becomes necessary.
