Solid Security is a comprehensive WordPress security plugin that protects your site from brute force attacks, malware, and unauthorized access. Formerly known as iThemes Security Pro, Solid Security includes over 30 security features: two-factor authentication, brute force protection with customizable lockout rules, file change detection, database backups, 404 detection, and strong password enforcement. The plugin also adds a security checklist that walks you through securing your site step by step, making it accessible even if you are not a security expert. It is a direct competitor to firewall-focused security plugins like Wordfence, with a stronger focus on login security and access control rather than firewall protection.
The plugin is maintained by the SolidWP team (formerly iThemes), the same team behind the Builder theme framework and Restrict Content Pro.
Competitive Features
- Two-factor authentication — add TOTP-based 2FA via Google Authenticator, Authy, or backup codes for all users or specific roles
- Brute force protection — limit login attempts, ban IPs after repeated failures, and enforce strong passwords
- File change detection — scan WordPress core, theme, and plugin files for unauthorized changes and report them via email
- Security checklist — guided setup wizard that walks through each security feature with recommended settings
- 404 detection — lock out IPs that trigger repeated 404 errors, a common pattern for vulnerability scanners
- Database backups — schedule automated backups of the WordPress database with email delivery
- Away mode — completely disable the WordPress admin area during specified time windows
- User role management — enforce password strength, session length, and 2FA requirements per user role
Key Features
- Magic links and passwordless login — send login links via email for secure, password-free access
- Version management — automatically update WordPress, themes, and plugins to the latest versions
- Trusted devices — remember trusted browsers to reduce 2FA prompts for regular users
- Site scan — check for known vulnerabilities in plugins, themes, and WordPress core against the WPScan database
- Privacy — anonymize IP addresses in logs to comply with GDPR requirements
- Notification center — configure email alerts for security events like lockouts, file changes, and scans
- WordPress salting — update WordPress security keys and salts automatically
- SSL/TLS enforcement — force HTTPS on the frontend and admin area
Comparison with Competitors
Solid Security vs Wordfence Premium
| Feature | Solid Security | Wordfence Premium |
|---|---|---|
| WAF (Web Application Firewall) | Not included | Built-in WAF |
| Two-factor authentication | TOTP + Magic Links | TOTP |
| Malware scanning | Site scan via WPScan | Real-time + Paid |
| Brute force protection | Customizable lockouts | Rate limiting |
| File change detection | Yes | Yes |
| Database backups | Built-in | Not included |
| Passwordless login | Magic links | Not available |
| Performance impact | Lightweight | Moderate |
Solid Security vs Sucuri Security
| Feature | Solid Security | Sucuri Security |
|---|---|---|
| Cloud-based WAF | Not included | CloudProxy WAF |
| Malware cleanup | Manual | Included |
| Two-factor authentication | Yes | No |
| File integrity monitoring | Yes | Yes |
| DDoS protection | No | Yes |
| Post-hack security actions | Checklist | Included |
| Blacklist monitoring | No | Yes |
Recommended Stack — pair Solid Security with UpdraftPlus Premium to combine access control and file monitoring with automated off-site backups for complete data protection.
Official Changelog
Version 9.4.4
Release Date: August 25, 2026
- Improvement: Security vulnerability database updates.
- Fix: 2FA setup flow for multisite networks.
- Fix: Compatibility with latest WordPress version.
Version 9.4.0
Release Date: July 20, 2026
- Improvement: Enhanced brute force protection with adaptive lockout thresholds.
- Improvement: File change detection email formatting.
- Fix: Version management compatibility.
Version 9.3.4
Release Date: June 15, 2026
- Improvement: Role-based 2FA enforcement.
- Improvement: Security checklist redesign.
- Fix: Notification center email delivery issues.
Frequently Asked Questions
Is Solid Security compatible with Wordfence?
Yes, Solid Security and Wordfence can work together. Solid Security handles login security, 2FA, and file changes, while Wordfence provides the firewall and real-time malware scanning. Disable overlapping features to avoid conflicts.
Does Solid Security include a firewall?
No, Solid Security focuses on login protection, file monitoring, and access control. For firewall protection, pair it with Wordfence or a cloud WAF like Cloudflare.
Can I require 2FA for specific user roles only?
Yes, Solid Security allows you to enforce two-factor authentication per user role, so you can require it for administrators while keeping it optional for subscribers.
Does Solid Security slow down my site?
Solid Security is designed to be lightweight. Most features run on login attempts and background scans rather than on every page load, so it has minimal performance impact on the frontend.
What is the difference between Solid Security and iThemes Security?
Solid Security is the rebranded version of iThemes Security Pro. The features are the same, but Solid Security includes updated UI, improved site scan, and new features like magic link login.
Leave a Reply