Securing WordPress with Wordfence or Solid Security

Every WordPress site on Ultra Web Hosting already sits behind a server-level firewall, ModSecurity rules, and automated malware scanning that run whether or not you install anything. A WordPress security plugin like Wordfence or Solid Security adds a second layer inside WordPress itself: login protection, file-change detection, and two-factor authentication tied to your admin accounts. This guide covers what those plugins actually add on top of what we run for you, which one to pick, how to set it up without slowing your site down, and the things a plugin will never fix for you.

01. What a Security Plugin Adds on Top of Our Server

Your account already has protection running at the server level before any traffic reaches WordPress. Our network and host firewall block known-bad IP addresses and brute-force sources, ModSecurity inspects incoming requests and drops common exploit patterns, and we run scheduled malware scanning across the filesystem. You do not configure any of that, and it protects your site around the clock. For a picture of what runs at that layer, see article 81.

A security plugin lives inside WordPress and sees things the server cannot. It adds four capabilities worth having:

• Application-layer login protection - limiting login attempts per user, locking out repeat offenders, and blocking known-bad usernames like admin. The server firewall counts connections; the plugin understands WordPress logins.
• Malware scanning from inside WordPress - comparing your core, theme, and plugin files against known-good copies and flagging injected code, on your schedule.
• File-change detection - telling you when a file was modified, added, or deleted, which is often the first sign of a compromise.
• Two-factor authentication - a second login factor tied to each admin account, which is the single most effective control on this list.

02. What a Plugin Does Not Replace

Be honest with yourself about the limits. A security plugin is not a substitute for basic hygiene, and installing one does not make a neglected site safe. The following stay your responsibility no matter which plugin you run:

• Good passwords. A firewall cannot help if you use password123 or reuse the same login across ten sites. Use long, unique passwords and a password manager.
• Updates. Most sites we clean up were running an outdated plugin with a public exploit. A security plugin does not patch your other plugins for you. See section 10 and article 309.
• Backups. Security is about reducing the odds of a break-in; backups are what get you back online after one. No scanner replaces a working, tested backup.
• Removing abandoned code. Every deactivated theme and plugin still sitting in your wp-content folder is attack surface. Delete what you do not use.

03. The Main Options and Honest Trade-offs

There are four names you will run into. You only need one. Here is the practical read on each.

• Wordfence. The most popular option. Bundles an application firewall and a thorough scanner, with a live traffic view and login security including 2FA. The free tier is genuinely useful. The trade-off is weight: the live traffic feature and on-demand scans can add real load on a busy shared site if you leave everything cranked up. Tune it (section 08) and it behaves.
• Solid Security (formerly iThemes Security). Lighter than Wordfence and opinionated about sensible defaults. Strong on login hardening, 2FA, and file-change detection, with less of the live-traffic overhead. A good pick if you want protection without babysitting a dashboard. Its file scanning leans on external services rather than a heavy local engine.
• Sucuri. Its real strength is the cloud WAF, which filters traffic before it reaches your site, plus solid scanning and post-hack cleanup on paid plans. The free plugin is mostly monitoring and hardening. The cloud WAF overlaps with what our server firewall already does, so weigh whether you need it.
• Jetpack Protect. Basic brute-force protection and a vulnerability scan, light and simple. Fine as a floor if you already run Jetpack, but thinner than the others on scanning and file monitoring. If Jetpack ever blocks legitimate access, article 348 covers that.

04. Installing and First-Run Setup

Installation is the same for any of these. Do it from inside WordPress.

1. Log in to wp-admin and go to Plugins > Add New.
2. Search for Wordfence Security or Solid Security (whichever you chose), then click Install Now and Activate.
3. The plugin launches a setup wizard. Accept the sensible defaults for now. You can refine settings once it is running.
4. If it asks for an email address for alerts, use one you actually read. This is where lockout and scan notices go.
5. If it offers a premium license, the free tier is fine to start. You can upgrade later if you want real-time firewall rules or scheduled cleanups.

05. Login Hardening and Two-Factor Authentication

This is where these plugins earn their keep. If you do nothing else, do this section.

1. Limit login attempts. In the plugin's login security settings, cap failed attempts (five is reasonable) and set a lockout window. This shuts down password guessing at the WordPress layer.
2. Enforce strong passwords. Turn on the setting that requires strong passwords for any account that can publish or administer. Reset any weak existing admin passwords now.
3. Enable two-factor authentication for every administrator and editor account. Both Wordfence and Solid Security support authenticator apps (TOTP). Scan the QR code with an app like Google Authenticator or Authy, save the recovery codes somewhere safe, and confirm you can log in with the code before you log out.
4. Optionally rename or limit the login URL. Moving wp-login.php to a custom path, or restricting it, cuts down the automated noise hitting the default login. Keep the new path recorded so you do not lock yourself out.

06. The Malware Scanner: Scheduling and Reading Results

The scanner compares your files against known-good copies of WordPress core and repository plugins and themes, and flags anything that looks injected. Remember that we already run server-side malware scanning across your account on our own schedule, so the plugin scan is a second opinion, not the only line of defense.

1. Run one full scan right after setup to get a baseline. Note anything it flags so you know what "normal" looks like for your site.
2. Schedule scans to run on a sensible cadence. Daily or every other day is plenty for most sites. Set it to run overnight when traffic is low.
3. Read the results in context. Scanners flag by pattern and produce false positives, especially on vendored libraries inside legitimate plugins. A flag is a prompt to investigate, not proof of infection.
4. Quarantine before deleting. If the plugin offers a quarantine or "restore original file" action for a genuinely modified core or plugin file, prefer that over an outright delete so you can undo a mistake.

07. File-Change and Integrity Monitoring

File-change detection is quietly one of the most valuable features. When a legitimate site is compromised, the attacker almost always writes or modifies files. If you get an alert that files changed at 3 a.m. when nobody was working, that is your early warning.

1. Enable file-change scanning in the plugin. It records a fingerprint of your files and compares on each scan.
2. Learn your normal churn. Legitimate updates change files too. Expect alerts right after you update core, a theme, or a plugin. The signal you care about is changes with no update to explain them.
3. Investigate off-hours changes fast. New PHP files in wp-content/uploads, modifications to wp-config.php, or edits to core files that you did not update are the ones to act on.

08. Keeping the Plugin From Slowing Your Site Down

A security plugin does work on every request or on a schedule, and on shared hosting that work competes with serving your pages. Wordfence in particular can add noticeable load if you leave the live traffic view and frequent full scans running. You do not have to accept that.

• Turn off live traffic logging unless you are actively investigating something. It writes a database row for every hit and is the single biggest source of Wordfence overhead.
• Scan on a schedule, not constantly. Daily overnight is fine. Continuous or hourly full scans are overkill for almost every site and eat CPU and I/O.
• Trim the scan scope if scans run long. Exclude large media libraries and backup directories that do not contain executable code.
• Never run two firewall plugins. Beyond the conflicts in section 04, two plugins doing the same scanning doubles the load for no added protection.

09. When the Scanner Finds an Infection

A real infection needs a methodical response, not panic-deleting. Deleting flagged files at random can take the site down or leave the actual backdoor in place while you clean up the visible symptom.

1. Do not just delete. Note exactly what was flagged and where. Take a backup of the current (infected) state before you change anything, so you can compare later.
2. Identify the entry point. An infection is a symptom. If you clean the files but not the outdated plugin that let them in, you will be reinfected within days.
3. Restore from a known-clean backup if you have one from before the compromise, then immediately update everything and change all passwords.
4. Follow the full recovery process. Article 478 walks through scoping the infection, cleaning it, closing the hole, and confirming the site is clean. It is the right guide for this, not the security plugin's scan-and-delete button.
5. Open a ticket. If you are unsure, contact us before you start deleting. We can see the server-side scan history and help you scope it correctly.

10. Updates: The Real Root Cause of Most Hacks

Here is the uncomfortable truth after all the plugin talk: the great majority of WordPress compromises come through an outdated plugin, theme, or core version with a publicly known vulnerability. A security plugin narrows the odds, but nothing beats simply keeping everything current.

1. Update WordPress core promptly when a release ships, especially security releases.
2. Update plugins and themes on a regular cadence, and enable auto-updates for the ones you trust to update cleanly.
3. Update the security plugin itself. It only knows about the threats in its current rules and signatures.
4. Delete what you do not use. An abandoned plugin sitting deactivated is still a file on disk with a possible exploit. Remove it.
5. Do the full hardening pass. Article 309 is the pillar guide on hardening WordPress: file permissions, disabling the file editor, locking down wp-config.php, and more. A security plugin complements that work; it does not replace it.

Quick Recap: WordPress Security in Six Steps

If you only do six things from this guide, do these:

1. Install one security plugin (Wordfence or Solid Security) and never run two firewall plugins at once.
2. Enable two-factor authentication on every admin account and enforce strong passwords. This stops the most common attack.
3. Limit login attempts and optionally rename or restrict the login URL to cut down automated noise.
4. Schedule scans overnight and turn off live traffic logging so the plugin does not drag your site down on shared hosting.
5. Watch file-change alerts for modifications with no update to explain them, and act on off-hours changes fast.
6. Keep core, themes, and plugins updated and follow article 309 for full hardening. Updates prevent more hacks than any plugin setting.

Last updated July 2026 · Browse all WordPress articles