Recently, I completed a comprehensive test of several plugins to identify the best security and malware protection plugin. It is unnecessary to pay for quality security, and even if you opt to pay, it should not include unnecessary features and substandard performance and detection. I was particularly impressed by SecuPress, as they presented an option to “auto fix” the issue for a certain amount or provide a manual approach with detailed instructions, which was pretty impressive!
The Most Important Things:
- Take automated weekly / monthly backups to easily roll back any security attack
- Change folder permissions to 755 and file permissions to 644[1] to prevent .htaccess and .php malware
- Lock down your login page, disable common usernames (like admin), protect system folders and change your table_prefix[2]
- Block external, and also whitelist connections using
wp-config.php[3] to stop or prevent communication
// define('WP_HTTP_BLOCK_EXTERNAL', true);
// define('WP_ACCESSIBLE_HOSTS', '*.wordpress.org, *.github.com');- Many plugins offer limited functionality because they want you to pay $$$ each and every month or year and typically prevent access to the most valuable features (ie. Malware Cleanup, Firewall Control, Scheduled Actions, etc.)
- Disable admin panel Theme Editor + Plugin Editor using
wp-config.phptweak[3]
define('DISALLOW_FILE_EDIT', TRUE);- Delete themes, plugins and files your WordPress installation does not need.
The majority of plugins that I evaluated were unsuccessful because they either necessitated a monthly or yearly subscription or were excessively large, such as Wordfence, which is 14MB in size. If you wish to trust my assessment, you will have to take my word for it, but I conducted a thorough examination of all the plugins, and some of the things I observed were quite remarkable. Some plugins are created to direct you towards a payment page, while others rely on appealing branding despite lacking essential features.
Favorite Plugins Tested (no money required):
- BBQ
- Tied = SecuPress & All In One WP Security
- WP Cerber Security
- Tied = Shield Security & Wordfence
- BulletProof Security
Titan Anti-spam & SecuritySecurity NinjaDefenderiThemes
* strikethrough = too many “premium paid” features
* plugin is junk if it’s not on the list
Misc.
- Giant list of wp-config.php tweaks
- I really enjoyed using Snitch to monitor outgoing connections but it generates A LOT of connection log entries… the insight it provided was amazing though because before now, I never knew just how many API calls plugins make… it’s insane and must be controlled (that’s why I recommend defining
WP_HTTP_BLOCK_EXTERNAL). - The number of logs / notifications that individuals advertise is absurd, as they may include monitoring alerts for insignificant matters.
Interesting Plugins (not necessarily good)
- All In One WP Security
- BBQ
- BulletProof Security
- SiteGround Security
- iThemes Security
- NinjaScanner
- SecuPress Free — WordPress Security
- Security Ninja
- Shield Security
- Titan Anti-spam & Security
- Wordfence Security
- WP Cerber Security, Anti-spam & Malware Scan
Frequently asked questions
Do I need to pay for a WordPress security plugin?
No. Quality security doesn't require paying, and every plugin on the favorites list was tested with no money required. Many paid plugins lock the most valuable features, like malware cleanup and firewall control, behind a monthly or yearly bill. The free options covered the essentials just fine.
Which free WordPress security plugin did well in testing?
BBQ sits at the top of the favorites list, with SecuPress and All In One WP Security tied right behind it. SecuPress stood out for offering either a paid auto fix or a manual fix with detailed instructions. WP Cerber Security rounds out the top few.
Is Wordfence a good WordPress security plugin?
It made the favorites list, tied with Shield Security, but it's heavy. At 14MB, Wordfence was flagged as excessively large. A security plugin shouldn't weigh down the site it's supposed to protect. Lighter options like BBQ and SecuPress ranked higher on the list.
What file permissions should a WordPress site use?
755 for folders and 644 for files. Those settings help keep .htaccess and .php malware from taking hold. Pair them with automated weekly or monthly backups, so if something does get through, you can roll back instead of starting over from scratch.
How do I stop WordPress plugins from making outside connections?
Define WP_HTTP_BLOCK_EXTERNAL in wp-config.php, then whitelist the hosts you trust with WP_ACCESSIBLE_HOSTS. Plugins make far more API calls than most people realize. Monitoring with Snitch shows just how many, though it fills the log fast. Blocking by default keeps things quiet.
Sources
- Changing File Permissions — WordPress Developer Resources. Accessed October 30, 2026. ↩
- Hardening WordPress — WordPress Developer Resources. Accessed October 30, 2026. ↩
- Editing wp-config.php — WordPress Developer Resources. Accessed October 30, 2026. ↩
