Forever free
Free
A strong starting point for every WordPress site.
- Basic firewall rules
- 50+ security tests
- Vulnerability scanner
- Core file scanner
- Basic events logger
- AI Security Advisor (WordPress 7)
- Install wizard
All-in-one WordPress security
WP Security Ninja
Everything you need to protect your WordPress site
Block bad traffic, harden logins, find malware and vulnerabilities, and get clear alerts. Unlock full protection with Pro.
-
Built for
Site owners, freelancers, and agencies
-
Free
Tests, vulnerability scan, core scan, basic firewall
-
Pro
Cloud Firewall, malware, 2FA, agency tools
- Cloud Firewall
- Malware scanner
- 2FA
- Vulnerability scanner
- Events and webhooks
- Install wizard
Protected in minutes with the Install Wizard
No security expertise required. The wizard walks you through the essentials (firewall, events, vulnerability checks, and more) so you leave setup with real protection turned on.
- ✓ Guided steps after install, free and Pro
- ✓ Turn on the right protections without guessing
- ✓ Pro steps unlock login hardening, fixes, and WooCommerce
Start free. Unlock full protection with Pro.
Free gives you real visibility and hardening. Pro is the complete protection layer most site owners need.
Recommended
Pro
Everything in Free, plus the tools that actively protect and clean your site.
- Cloud Firewall and country blocking
- Malware scanner and cleanup
- Login protection, rename login, and 2FA
- 404 Guard and WooCommerce protection
- Full events logger, webhooks, and scheduled scans
- Visitor log, white label on 25+ site licenses, and agency workflows
- Priority support
Four jobs. One plugin.
Firewall, scanner, login hardening, and alerts in one plugin. Open any feature page for the details.
Protect traffic and logins
Stop attacks before they reach WordPress and lock down how people sign in.
Detect malware and risks
Find suspicious files, known vulnerabilities, and tampered core files early.
Monitor and alert
See what happened, schedule scans, and push alerts to Slack, Discord, or Zapier.
Harden and stay ahead
Run 50+ security tests, get AI guidance, and keep improving over time.
What you can do with Security Ninja
The full map. Free is a real baseline. Pro adds the tools that actively protect and clean the site.
Protect
Keep attackers, bots, and brute-force attempts away from your site.
Cloud Firewall
ProStop known-bad IPs and malicious requests before WordPress loads. Country rules, custom lists, and service whitelists sit here.
Learn moreLogin protection
ProLimit failed logins and cut off credential stuffing without slowing real users.
Learn more2FA
ProRequire an authenticator app or email code for the roles that matter. Opt-in or required, with a grace period to enroll.
Learn moreBasic firewall
FreeRequest rules block common exploit patterns on every free install, before you add the cloud list.
Learn moreRename login URL
ProHide the default wp-login.php path so bots stop knocking on the obvious door.
Learn more404 Guard
ProAutomatically block IPs that hammer missing URLs looking for holes.
Learn moreSlow coupon abuse, checkout spam, and storefront login noise.
Learn moreDetect
Catch infections, vulnerable software, and unexpected file changes.
Malware scanner
ProScan for suspicious code, review each finding, then clean it or whitelist it when you know it is safe.
Learn moreSee when an installed plugin, theme, or WordPress core has a known security issue.
Learn moreCore scanner
FreeCompare WordPress core files to the official originals and open a diff when something was changed.
Learn moreSecurity tests
FreeRun 50+ hardening checks. Each result says what failed and what to change.
Learn moreMonitor and alert
Stay informed without refreshing the dashboard all day.
Events logger
Free + ProBasic log on Free. Full log and export on Pro: logins, firewall blocks, and other site activity in one place.
Learn moreWebhooks
ProSend selected events to Slack, Discord, Zapier, or your own endpoint so the team sees them outside wp-admin.
Learn moreScheduled scans
ProRun checks on a schedule and get an email when something changes.
Learn moreAI Security Advisor
FreeTurn scan results into plain-language next steps. Needs WordPress 7 and your own AI connectors.
Learn moreVisitor log
ProSee who hit the site, what was blocked, and when. Useful when a real user says they cannot get in.
Learn moreSetup and scale
Get protected fast, then copy that setup to the next client site.
Install wizard
Free + ProGuided steps after install. Free gets the core path. Pro adds login hardening, selected fixes, and WooCommerce when the site needs them.
Learn moreCopy a proven security setup from one site to the next instead of clicking through the same screens again.
Learn moreWhite label is included on 25+ site licenses. MainWP lets you review security status across child sites.
Learn moreA recovery path if login hardening or the firewall locks you out. Save it before you turn those on.
Learn moreOne-click fixes
ProApply selected hardening recommendations from the tests, when you want a faster path than doing each change by hand.
Learn moreStop bad traffic before WordPress loads
Pro Cloud Firewall combines request filtering with a living blocklist of known bad IPs, country rules, and redirects, so most attacks never become a WordPress problem.
- ✓ Living list of known bad IPs, updated regularly
- ✓ Country blocking and custom IP lists
- ✓ Service-aware whitelists for tools you already use
Harden logins with limits, rename, and 2FA
Brute-force bots love the default login page. Pro adds failed-login limits, a custom login URL, and two-factor authentication with authenticator apps or email codes.
- ✓ Role-required or opt-in 2FA
- ✓ Grace period so teams can enroll calmly
- ✓ Works alongside rename-login and lockout messages
Get alerts where your team already works
Full events logging plus webhooks means failed logins, firewall blocks, and updates can land in Slack, Discord, or Zapier, not only inside wp-admin.
- ✓ Filter and export security events
- ✓ Webhook payloads for automation
- ✓ Scheduled scan reports by email
Watch the walkthrough
See how Security Ninja helps you protect a WordPress site from day one.
WP Security Ninja walkthrough
Running an agency or many client sites?
Bulk licenses, white label on 25+ site licenses, MainWP, multisite, and webhook workflows are built for teams that protect WordPress at scale.
White label
Show your brand on client sites, not ours. Included on 25+ site licenses.
MainWP ready
Scan and review security status across child sites.
Ops alerts
Push events to Slack or Discord for your team.
Customer reviews
4.9 / 5 from 261 reviews
A Complete Security Powerhouse with White Label Flexibility and Outstanding Support
“I’ve been using WP Security Ninja with the 3-tier white label option, and I couldn’t be more impressed.”
Very helpful
“Security Ninja is part of my arsenal that I offer to my clients. It helps make sure their websites are security and scans them for malware.”
No WordPress plugin should be your entire security stack, but this one is a solid choice to be a key part of it.
“I've been a web host and sysadmin for 15 years. I'm skeptical when it comes to security tools, and many of them out there are either bogged down bloatware, don't do enough, or try…”
Fast security audit with one-click fixes, but use judgment
“I installed WP Security Ninja on my own WordPress website, ran a scan, and fixed several real issues in under an hour.”
Frequently asked questions
Is Security Ninja hard to set up? +
No. The Install Wizard guides you through essential protections after install. Free users get the core steps. Pro unlocks login hardening, selected fixes, and WooCommerce options when relevant.
What do I get for free vs Pro? +
Free includes the basic firewall, security tests, vulnerability scanner, core scanner, basic event logging, AI Security Advisor on WordPress 7, and the wizard. Pro adds Cloud Firewall, malware scanning, login protection and 2FA, webhooks, scheduled scans, 404 Guard, WooCommerce protection, visitor log, and agency tools. White label is included on 25+ site licenses.
Does Pro include two-factor authentication? +
Yes. You can require 2FA for selected roles or allow opt-in, with authenticator apps and email codes, plus a grace period for enrollment.
Can I get alerts in Slack or Discord? +
Yes on Pro. Webhooks send selected security events to Slack, Discord, Zapier, or a custom endpoint.
Where can I compare Security Ninja to other plugins? +
We keep an honest comparison on a dedicated page so Features stays focused on what you can do. See the Compare page for the overview.
Ready for serious WordPress protection?
Get Pro for Cloud Firewall, malware scanning, 2FA, webhooks, and scheduled scans, or start free and upgrade when you need more.
Get Pro now