Cerber Security Pro is a comprehensive WordPress security plugin that combines a web application firewall, malware scanner, login protection, and activity auditing into a single solution. It operates at the WordPress hook level to filter requests before they reach the application, blocking malicious traffic including SQL injection attempts, XSS attacks, and bot-driven scans. The Pro version adds real-time IP reputation filtering, automated country blocking, and advanced malware detection that scans both the file system and the database for suspicious code. Cerber distinguishes itself from broader security suites like Wordfence Premium with a more extensive set of access control rules, including the ability to restrict access to specific WordPress admin areas by user role.
The plugin maintains its own IP blacklist that updates from Cerber’s global threat network, and includes a built-in traffic inspector that logs all requests to wp-login.php, XML-RPC, and the REST API, giving you visibility into who is trying to access your site.
Competitive Features
- Web application firewall — blocks SQL injections, XSS, CSRF, path traversals, and malicious file uploads before they reach WordPress
- IP reputation check — queries Cerber’s global threat database to automatically block known malicious IPs and botnets
- Malware scanner — scans WordPress files and database for known malware signatures, backdoors, and suspicious code patterns
- Login protection — brute-force lockdown, CAPTCHA, two-factor authentication, and geolocation-based access control
- Activity auditing — logs all user activity, admin changes, plugin installations, and failed login attempts with user attribution
- Country blocking — restrict access to the admin area by country using IP geolocation databases
- Traffic inspector — detailed log of all requests to login, REST API, and XML-RPC endpoints with IP and user agent data
Key Features
- Custom firewall rules — create whitelist and blacklist rules for specific IPs, user agents, URL patterns, and HTTP headers
- CAPTCHA enforcement — Google reCAPTCHA v3 and v2 support on login, registration, lost password, and comment forms
- Two-factor authentication — TOTP-based 2FA via Google Authenticator, Authy, or any standard authenticator app
- Admin area lockdown — restrict admin panel access to specific IP ranges, user roles, or time windows
- Database scanner — scan wp_posts, wp_options, and wp_comments for injected malicious content and hidden admin accounts
- File integrity monitor — compare current WordPress core, plugin, and theme files against checksums from official repositories
- Email alerts — instant notifications for critical security events including successful 2FA bypass attempts and brute-force attacks
Comparison with Competitors
Cerber Security Pro vs Wordfence Premium
| Aspect | Cerber Security Pro | Wordfence Premium |
|---|---|---|
| WAF | Yes (hook-level) | Yes (PHP + WAF) |
| Malware scanner | File + DB | File + DB |
| IP reputation network | Cerber global DB | Wordfence Threat Feed |
| Traffic inspector | Yes (admin panel) | Yes (live traffic) |
| Two-factor auth | Yes (TOTP) | Yes |
| Admin lockdown | Yes (per role) | No |
| Country blocking | Yes (pro) | Yes (free) |
Bottom line: Wordfence Premium has a larger threat database and live traffic monitoring. Cerber Security Pro offers more granular access control with admin lockdown per user role and a lower price point.
Cerber Security Pro vs Solid Security
| Aspect | Cerber Security Pro | Solid Security |
|---|---|---|
| Malware scanner | Yes (file + DB) | Yes (via add-on) |
| Firewall | Yes (custom rules) | Yes |
| Activity logging | Yes (detailed) | Yes |
| Two-factor auth | Yes (TOTP) | Yes |
| Password enforcement | No | Yes |
| Version management | No | Yes |
Bottom line: Solid Security has stronger version management features and password enforcement. Cerber Security Pro has a better built-in malware scanner that doesn’t require add-ons, and its admin lockdown rules are more flexible.
Cerber Security Pro vs iThemes Security Pro
| Aspect | Cerber Security Pro | iThemes Security Pro |
|---|---|---|
| Firewall | Yes (hook-level) | Yes |
| Malware scanner | File + DB | Via add-on |
| Scheduled scanning | Yes | Yes |
| Admin lockdown | Yes (per role, per area) | No |
| Away mode | No | Yes |
| Google reCAPTCHA | Yes | Yes |
Bottom line: iThemes Security Pro offers away mode and scheduled site locking that Cerber doesn’t have. Cerber Security Pro excels at admin access control — you can restrict specific admin pages to specific user roles, something no other security plugin does natively.
Recommended Stack: Cerber Security Pro handles firewall, scanner, and access control. For complete disaster recovery, pair with UpdraftPlus Premium for scheduled backups that let you restore quickly if the scanner finds something critical.
Official Changelog (3 Last Versions)
Cerber Security Pro is a premium plugin not listed on WordPress.org.
Version 9.8.0
Release Date: August 11, 2026
- New IP reputation check with Cerber global threat network integration
- Enhanced database scanner with detection of hidden admin accounts
- Fixed firewall rule conflict with WooCommerce REST API endpoints
Version 9.7.5
Release Date: July 7, 2026
- Added two-factor authentication backup codes for account recovery
- Improved traffic inspector with searchable log entries
- Fixed CAPTCHA display conflict with caching plugins
Version 9.7.0
Release Date: June 14, 2026
- New admin area lockdown module with per-role page restrictions
- Added scheduled malware scanning with email report delivery
- Performance optimization for IP reputation lookups on high-traffic sites
Frequently Asked Questions
Is Cerber Security compatible with caching plugins?
Yes. Cerber operates at the WordPress hook level, not the server level, so its security checks run after cached pages have been delivered. Login protection, CAPTCHA, and firewall rules work independently of caching. The traffic inspector also captures requests on cached pages.
Does Cerber Security scan the database?
Yes. The database scanner checks wp_posts, wp_options, wp_comments, and wp_usermeta for injected malicious content, hidden links, suspicious base64_encoded data, and unauthorized admin accounts. It also verifies user role assignments against your configuration.
Can I restrict admin access by user role?
Yes. Cerber’s admin lockdown module lets you control which admin pages each user role can access. For example, you can give editors access to posts and media but block them from plugins and settings pages. This is one of Cerber’s unique features not found in most security plugins.
How does the Cerber IP reputation check work?
When a visitor makes a request to your site, Cerber checks their IP against its global threat database maintained from thousands of protected sites. Known malicious IPs, botnet nodes, and spam sources are blocked immediately, reducing the load on your server from automated attacks.
What is the difference between free and Pro?
The free version includes the firewall, basic login protection, and activity logging. The Pro version adds the malware scanner, IP reputation checking, two-factor authentication, country blocking, admin lockdown, database scanner, and email alerts.
Leave a Reply