Defender is a security plugin from the WPMU Dev suite that combines malware scanning, firewall protection, login security, and activity auditing in a single, well-designed interface. It offers a security checklist that guides you through hardening your WordPress installation step by step, plus automated security scans that monitor for file changes, suspicious code, and known vulnerabilities. The plugin’s dashboard shows your site’s security health at a glance, with color-coded status indicators for each security area. What makes Defender stand out from plugins like Cerber Security Pro is its polish and integration with the broader WPMU Dev ecosystem — if you use other WPMU Dev plugins, Defender shares settings and data seamlessly.
Defender includes two-factor authentication with support for Google Authenticator, backup codes, and email-based codes. Its activity log tracks every user action, from post edits to plugin installations, with the ability to restore items changed during a specific time period.
Competitive Features
- Malware scanner — scans WordPress core, plugins, and themes for known vulnerabilities and suspicious code
- Firewall protection — blocks malicious requests including SQL injections, XSS attacks, and path traversals
- Two-factor authentication — TOTP-based 2FA via Google Authenticator, email codes, and backup codes
- Activity logging — detailed log of all user activity with restore capabilities for tracked changes
- Security hardening — guided checklist for disabling file editing, hiding WordPress version, and securing wp-config
- IP blocking — automated blocking of malicious IPs with manual whitelist and blacklist management
- Audit reports — scheduled email reports summarizing security events and scan results
Key Features
- File integrity monitoring — compares current WordPress files against checksums from official repositories
- Scheduled scans — automatic daily, weekly, or monthly scans with email notifications for issues found
- Login protection — limit login attempts, enforce strong passwords, and lock out brute-force attackers
- Google reCAPTCHA — reCAPTCHA v3 integration on login, registration, and password reset forms
- Asset scanning — checks plugins and themes against the WPMU Dev vulnerability database
- Security recommendations — prioritized action items based on scan results and security best practices
- 404 detection – monitors and blocks IPs that generate excessive 404 errors indicating scanning behavior
Comparison with Competitors
Defender vs Wordfence Premium
| Aspect | Defender | Wordfence Premium |
|---|---|---|
| Malware scanner | Yes (file + plugin DB) | Yes (file + threat feed) |
| Firewall | Yes (basic) | Yes (WAF + rules) |
| Two-factor auth | Yes (TOTP + email) | Yes |
| Activity logging | Yes (detailed) | Yes (limited) |
| Live traffic | No | Yes |
| Country blocking | No | Yes |
Bottom line: Wordfence Premium has a more advanced firewall with live traffic monitoring and country blocking. Defender offers better integration with the WPMU Dev ecosystem and includes two-factor authentication and activity logging in its free version.
Defender vs Sucuri Security
| Aspect | Defender | Sucuri Security |
|---|---|---|
| Malware scanning | File + vulnerability DB | File + remote scanner |
| Firewall | Server-level | Cloud-based (Sucuri WAF) |
| Activity logging | Yes | Yes |
| Post-hack security actions | Basic | Yes (hardening actions) |
| Performance impact | Low | Minimal (cloud) |
Bottom line: Sucuri Security’s cloud-based WAF blocks threats before they reach your server, which is more effective than server-level firewalls. Defender’s strength is its complete security toolkit available for free as part of the WPMU Dev suite.
Recommended Stack: Defender handles malware scanning and security hardening. For automated backups alongside security, pair it with UpdraftPlus Premium to ensure you can restore your site quickly if the scanner finds a critical infection.
Official Changelog
Version 6.2.4
Release Date: September 1, 2026
- Fix: Username does not appear in some Audit Log events.
- Fix: Audit module stores un-interpolated {{user_login}} in some logs.
- Fix: Minor improvements in vulnerability detection.
Version 6.2.3
Release Date: August 31, 2026
- Enhancement: Improved Audit Log UI across Dashboard and Audit Log pages.
- Enhancement: Added a “Save your API keys to load” preview state for Bot Protection CAPTCHA settings.
- Enhancement: Updated the event type label in the detailed Audit Log view from ‘Content’ to ‘Context’.
- Fix: Resolved an issue where audit log events from multi-event requests were not synchronizing to the Hub.
- Fix: Fixed a UI layout issue when editing Nginx configuration under Hardening > Prevent Information Disclosure.
- Fix: Addressed a deprecation notice for Webauthn::verify_response().
- Fix: Fixed a visual bug where the “Learn how we detect your IP” link overlapped the background border at 1280px screen widths.
- Fix: Minor code improvements.
Version 6.2.2
Release Date: August 24, 2026
- Fix: Streamlined schema method by removing bootstrap trait.
Frequently Asked Questions
Does Defender replace Wordfence?
Defender covers many of the same features as Wordfence including malwre scanning, firewall, and login protection. However, Wordfence has a more advanced Web Application Firewall with live traffic monitoring. Defender is an excellent free alternative that integrates well with other WPMU Dev plugins.
How does the activity log work?
Defender logs every user action — post creation, edits, deletions, plugin installations, setting changes, and login attempts. You can filter by user, date range, and action type. The log stores data for up to 6 months depending on you configuration.
Is two-factor authentication free?
Yes. Defender includes TOTP-based two-factor authentication using Google Authenticator or any standard auth app, plus email-based codes and backup codes for account recovery. This feature is completely free with no premium upgrades required.
What’s the difference between free and Pro?
Defender’s core features — malware scanning, firewall, 2FA, activity logging — are all included in the free version sold on WPMU Dev. The Pro version (part of the WPMU Dev membership) adds white-label reporting, advanced scheduling, and prioritized support.
How does the malware scanner work?
Defender checks your WordPress files against known checksums from official WordPressorg repositories, compares plugin and theme files against the WPMU Dev vulnerability database, and scans for suspicious code pattern like eval() with encoded strings or base64_decode() with large payloads.
Leave a Reply