Sucuri Security is a WordPress security plugin developed by the Sucuri team, known for their cloud-based WAF and website security services. The free plugin focuses on monitoring, auditing, and hardening — it scans your site for malware through the SiteCheck remote scanner, monitors file integrity, tracks security events in an audit log, checks blocklist status across 10+ engines, and offers one-click hardening actions. The premium Sucuri Firewall adds a cloud WAF with DDoS mitigation, vulnerability scanning, and brute force protection. The free version is ideal for monitoring and detection, complementing firewall-based security tools like Wordfence Premium rather than replacing them.
Competitive Features
- Remote malware scanning — SiteCheck scanner checks for known malware, malicious code, and out-of-date software without adding load to your server
- File integrity monitoring — compare current WordPress core, theme, and plugin files against a known good baseline with visual diff utility
- Security activity auditing — track logins, content changes, plugin activations, and other security events with date and event type filtering
- Blocklist monitoring — checks your site against Sucuri Labs, Google Safe Browsing, Norton, AVG, McAfee, Phish Tank, ESET, and other blocklist engines
- Two-factor authentication — add 2FA for all users with a searchable user list and per-user management (free)
- Security hardening — one-click hardening actions including XML-RPC disable, PHP file blocking in uploads, version removal, and secret key rotation
- Post-hack actions — guided steps for resetting passwords, updating secret keys, and reinstalling plugins after a security incident
- CORS and CSP headers — configure Content Security Policy and other security headers from the plugin dashboard
Key Features
- Disable XML-RPC — one-click option to close a common brute-force and pingback-based DDoS attack vector
- Cache-Control headers — configure browser caching policies per page type
- 404 monitoring — detect scanning bots through failed path requests
- Failed login tracking — view failed login attempts with IP addresses and timestamps
- Last logins widget — see who logged in and when, with last IP address
- Dark/light theme toggle — switch between dark and light mode in the plugin UI
- WordPress vulnerability scanner — check core, plugin, and theme vulnerabilities against the Sucuri database (requires WAF key)
- PHP vulnerability scanning — detect potential security issues in the PHP environment (requires WAF key)
Comparison with Competitors
Sucuri Security vs Wordfence Premium
| Feature | Sucuri Security | Wordfence Premium |
|---|---|---|
| Web Application Firewall | Cloud WAF (paid) | Built-in WAF |
| Remote malware scanning | SiteCheck | Built-in scanner |
| File integrity monitoring | Visual diff | Yes |
| Blocklist monitoring | 10+ engines | Yes |
| Two-factor authentication | Free | Free |
| Vulnerability scanning | Core + Plugin + Theme | Included |
| DDoS protection | Cloud (paid) | Not included |
| Performance impact | Very lightweight | Moderate |
Sucuri Security vs Solid Security
| Feature | Sucuri Security | Solid Security |
|---|---|---|
| Malware scanning | Remote SiteCheck | Site scan |
| Two-factor authentication | Free | TOTP + Magic Links |
| File integrity | Visual diff | Report |
| Blocklist monitoring | 10+ engines | Not included |
| Cloud WAF | Available (paid) | Not available |
| Post-hack actions | Guided steps | Checklist |
| Database backups | Not included | Built-in |
Recommended Stack — pair Sucuri Security with UpdraftPlus Premium to combine malware monitoring and security auditing with automated off-site backups for complete site protection.
Official Changelog
Version 2.8
Release Date: September 9, 2026
- Added one-time backup codes for Two-Factor Authentication. Ten codes are created when 2FA is turned on, and each can be used once if you lose your authenticator app.
- Added a search box and severity, plugin, and theme filters to the Audit Logs page, so you can find a specific event without paging through the whole history.
- Added a one-click CSV download of the complete audit trail, ready for a compliance review, an incident timeline, or an archive before older records age out.
- Fixed an issue that left the audit trail completely empty on sites that do not run in English.
- Fixed audit entries being cut short or lost when saving the WordPress Writing settings.
- Fixed plugin and theme names that contain an ampersand being shown with an HTML escape code in place of the character itself.
Version 2.7.4
Release Date: July 7, 2026
- Improved the Two-Factor Authentication page to load the users list in pages, so it stays fast and reliable on sites with hundreds or thousands of users.
- Added a search box to the Two-Factor Authentication page to quickly find users by username, email, or display name.
- Strengthened input validation, access checks, and output escaping.
- Added a one-click “Disable XML-RPC” option to the Hardening page to close a common brute-force and pingback-based DDoS attack vector.
- Fixed a fatal error on PHP 8 when the API returns the “messages” field as a string instead of an array.
Version 2.7.3
Release Date: June 3, 2026
- Refactored the AJAX handler to an explicit dispatch map for improved security and efficiency.
- Improved the 2FA section with more UI clarity.
- Made light-mode default when no preference is defined. Corrected inverted dark/light mode icons.
- Fixed an i18n regression in 2FA status and setup templates.
- Fixed duplicate CSS property declarations.
Frequently Asked Questions
Is Sucuri Security free?
Yes, the core Sucuri Security plugin with malware scanning, file integrity monitoring, auditing, and 2FA is completely free. The Sucuri Firewall with WAF and vulnerability scanning is a paid service.
Does Sucuri Security include a firewall?
The free plugin does not include a firewall. The Sucuri Firewall is a cloud-based WAF service that can be purchased separately and managed from the plugin dashboard.
How does Sucuri Security scan for malware?
The plugin uses the Sucuri SiteCheck remote scanner, which accesses your site like a regular visitor to detect known malware, malicious code, and blacklisting status without installing files on your server.
Can I use Sucuri Security with Wordfence?
Yes, Sucuri Security and Wordfence can work together. Use Sucuri for remote scanning, blocklist monitoring, and 2FA, while Wordfence handles the firewall and real-time protection.
Does Sucuri Security slow down my site?
No, the plugin is designed to be lightweight. Most scans run remotely on Sucuri’s servers, and the audit logs are stored externally, so there is minimal performance impact on your server.
Leave a Reply