Looking for a reliable WordPress security plugin and are deliberating between Sucuri vs WordFence? You're already well on the way to getting the best security for your WordPress! These two products are two of the best options out there.
In this article, we're going to compare the two most popular website security plugins for WordPress – Sucuri Security and Wordfence Security., deep-diving into their various security aspects so that we can find where one is better than the other and which of the two comes out on top.
There are too many WordPress hacking attempts going on, so your choice to use a dedicated WordPress security plugin to keep your website secured is a wise one.
Sucuri vs Wordfence
The key differences are Sucuri does website monitoring, protection, and malware removal, while Wordfence focuses on website security. Sucuri blocks traffic in the cloud but cannot perform local scans. Wordfence uses a local firewall, it will also scan ALL files.
If you're short on time, click here to go directly to our comparison.
So far so good.
But the problem arises which of these WordPress security plugins to choose between these two? Being two of the top products they have so many features and options that you can get confused about which one to choose.
If that is your situation right now, you have come to the right place. We've used both of these products, so we can share our experience with you. Armed with this knowledge, you can now make the decision that is right for your business.
We will compare how the Sucuri and Wordfence WordPress plugins work, what features they offer, their price, and everything else you need to know. You can then decide with all of the information in hand, which one is the winner.
And we'll help you decide which one is really worth your money.
Let’s get started with Sucuri.
We've just updated this article in January 2021 to make sure it is relevant, with new details added and old parts removed or updated, so this post is as relevant as it can get. We also feature such detailed plugin reviews often, so check out our full list of articles in the WordPress plugins section.
Sucuri is a hosted service, which filters traffic before it comes to your website. It has a broader set of features than Wordfence and has the best cost-benefit in the market. Scanning is also done remotely, therefore it is not as deep as that of a local plugin.
Wordfence is a locally installed WordPress plugin. It analyses all traffic to your website, determines which traffic is malicious, and discards it. Malicious traffic will still hit your website before it gets filtered and discarded. This is a drawback of the product, a heavy malicious attack could still overwhelm your site.
Sucuri has a fixed annual fee for website cleanup and protection, with unlimited malware removal requests. WordFence charges a fee every time manual cleanups are requested, or if there are complexities when it comes to malware removal.
|Customization and Ease of Use||4.5/5||4.5/5|
Value for money
|Price||From $9.99/month||$99/year (excluding multi-year or bulk discounts)|
|Latest threats update||Yes||Premium customers only (free customers get them 30 days later)|
|System Security Tweaks||No||Yes|
|Core Code Changes||No||Yes|
|Cloud-based / vs Website||Both||Website only|
|Cool Feature||CDN for added performance||Cell-phone Sign-In|
|What we liked||DNS Cloud-based protection takes the brunt of attacks||Brute-force attack blocking|
|Zero-day exploits protection||Check if site IP is generating SPAM|
|Core integrity checks|
|What we didn't like||Some features are a bit pricey||On website only (attacks could overwhelm site)|
|No undo, redo, or history option||Latest threat updates to premium customers only|
|Website||Visit Sucuri||Visit Wordfence|
Now that we've seen a quick summary, let's dig deeper.
We'll get started with Sucuri first.
How Sucuri Works
Our overall rating: (4.5/5) Excellent - highly recommended.
When it comes to WordPress security, Sucuri is our favourite tool. It is one of the most trusted names out there. This company really needs no introduction when it comes to security. They offer a robust plugin to keep your WordPress site and server secure.
Have a look at this short video of the plugin in use:
One of the measures of success of this company is its phenomenal growth. The company was founded in 2010 by Daniel Cid, also the founder of the OSSEC project.
After only 7 years in the market, GoDaddy fully-acquired Sucuri in May of 2017, because they felt it made sense to offer this service as part of their own portfolio. When a tech giant like GoDaddy acquires your company, it definitely means that you're doing something right.
Sucuri have built a strong, trusted reputation by releasing frequent industry report on various internet security aspects such as:
- Hacked website trend reports (yearly)
- Web professional security surveys
- Cryptocurrency malware mining trends and threat prediction
- Technical whitepapers
- ...and many more
The plugin on WordPress.org repository enjoys a 4.4 star out of 5 rating and more than 700,000 active installs!
You'll also find that the company enjoys a 4 out of 5-star rating on the G2 Crowd review site.
But let's start looking at the actual product.
It comes in two flavours:
- WordPress Security plugin, which needs to be installed as a regular plugin, or
- Website Security Platform, a service which we will discuss in more detail later.
Once you have installed the plugin, you will need to generate a free API key. It is possible to generate the key from your website backend directly:
Sucuri Security’s dashboard has a primary check that looks at the integrity of your WordPress core files (and warns you if any of them have been tampered with). This is because if a WordPress file has been compromised, it will have a different size and structure than the original file.
Any such changes might mean that the site has been hacked:
You will also find the latest security audit logs conducted by the plugin.
If you want to activate protection on your site now, click the button below to visit the Sucuri website (opens in new window)
NB: Sucuri is currently on sale until the end of January 2021
Sucuri Website Scanner
The plugin comes with a built-in website scanner.
This can identify, any common malware which might have infiltrated your site, website errors, outdated themes, outdated plugins or tools, and whether your WordPress site has been identified and listed as hacked and distributing malware. It also reports whether your server is exhibiting any other vulnerabilities.
Speaking of outdated themes, do make sure you stay away from themes downloaded from dodgy websites (Warez or nulled theme sites).
They are typically rife with malware, and what seems to be free comes at the costly price of hidden malicious files. It's best to go for established players in the industry. For great WordPress theme suggestions, you may want to look at our Divi theme review found here, our Avada theme review, or our comparison of both of them.
For those who are not sure whether they prefer any of these too, we've also got other options to consider here.
After you run the initial scan, the results will be available under Sucuri Security > Malware Scan and will be updated every 20 minutes. The results are divided into several categories like remote Scanner Results, Website Details, iFrames/Links/Scripts, Code injection, Blacklist Status, and Modified Files.
The Sucuri Security plugin also comes with an integrated web application firewall (WAF) to prevent malicious intrusions. In general, the way a firewall works is to identify specific patterns of traffic that are known to be malicious.
These are blocked from accessing your website in any way.
Note that you have to be a CloudProxy customer to be able to use the firewall.
WordPress security hardening is one of the most useful features of the Sucuri plugin. This feature allows you to check the current status of various safety aspects and harden any weak points.
The available security hardening options include
- website firewall protection,
- ensuring that you are using the latest versions of WordPress and PHP,
- removing of a publicly visible WordPress version,
- protecting of the uploads directory,
- restricting access to the wp-content and wp-includes directories,
- check whether your site is using SSL or secure certificates
- updating and using security keys,
- checking information leakage through the readme file,
- changing from the default database table prefix,
- changing of the default admin account and password,
- check whether the WordPress site has too many plugins installed
- and others.
Each of these website security aspects is tested for any potential security lapses. You will be prompted to fix any potential vulnerabilities your website might exhibit.
Here's a quick video of setting up WordPress hardening using the Sucuri plugin
Recovering from Hacking Attempts
Sucuri Security also comes with the whole suite of Post-Hack options to clean an infected website.
This can prove to be very useful to recover a hacked website during the early stages of a hacking incident your WordPress site might have suffered.
1. Update Security Keys
WordPress uses a combination of security keys to encrypt the data saved in browser cookies. Since these are a potential security issue that can result in hacking attempts, Sucuri provides an easy way to replace all these security keys. This will invalidate all the existing sessions and force all users to log in again.
2. Reset User Password
Alternatively, you can choose to reset the password of any user, again a very important step if you think some users have weak passwords that might have been compromised.
3. Reset Installed Plugins
There is also a separate section to reset the existing plugins and perform any available updates.
Once again, WordPress plugins are a potential source of hacking attacks. By resetting the plugin and installing the latest updates, you eliminate the potential source of hacks.
4. Last Logins
Brute-forcing is another method that is used by hackers to get into WordPress sites.
The idea is that an automated program will keep trying login details and different passwords until the password is guessed. Since a lot of users use weak and easy to guess passwords, this is a potential source of hacks.
The Last Logins section will display the latest login activities on your website. You can check out the username, IP address, hostname, date/time for each of these activities. There are separate tabs for all users, admins, logged in users, failed logins, and blocked users.
The Last Logins section will display the latest login activities on your website.
You can check out the username, IP address, hostname, date/time for each of these activities. There are separate tabs for all users, admins, logged in users, failed logins, and blocked users.
By checking and verifying that the Last Login seems to be from legitimate users, you can ensure that your WordPress site is not being accessed maliciously by another user.
5. Available Plugins and Theme Updates
This section lists all plugins and themes which are not at their latest version. As you might be aware, most software updates include fixes to any vulnerabilities or bugs which might have existed in previous versions. Therefore, it is imperative that all 3rd-party products are kept fully updated to the latest versions.
All the plugin configuration options are located in the Settings section.
In the General area, you will find the plugin API key, along with options to enable failed login password collector, user comment monitor, change date & time, and a button to reset the settings.
The Scanner area provides detailed information about the time of the last scan, the scanning frequency, and the status of the core integrity checks. You will also find options to perform a malware scan and clear the scanner cache.
In the Alerts section, you will find the option to send notification emails in case problems appear on your site. You can customize the recipient of the alert emails, define the subject of the alert email, the maximum number of alerts per hour, and which events should trigger an alert email.
Sucuri Security allows you to customize the scan and alerts for specific situations. For instance, you can ignore specific files and/or directories from the scan, but make sure you know what you're doing if you skip certain files or directories.
Similarly, it is possible to ignore the alerts from specific post types, especially the ones created by third-party plugins.
Now that you've seen all of the capabilities of Sucuri, why not have a direct look at Sucuri? Click below to visit the Sucuri website to download the plugin.
Following our complete Sucuri review, our first security plugin in our comparison, we now see how Wordfence vs Sucuri would fare.
What is Wordfence?
Wordfence is another web security company that provides a plugin that mitigates against malicious attacks and protects your website from potential vulnerabilities. It has a 4.8 out of 5-star rating on the WordPress.org directory.
The Wordfence dashboard provides a detailed overview of the current security status of your website.
One must note that Wordfence is NOT a cloud service.
Essentially, it is your website's server that needs to perform the work to analyse the malicious traffic and discard it (if necessary). This is contrary to a service such as Sucuri, where the malicious traffic gets filtered and discarded BEFORE it gets to your website if you have enabled the Firewall or Web Application Firewall (WAF).
With such a localized plugin, if you are experiencing a DDoS attack (distributed denial of service), your WordPress site could still get overwhelmed by the sheer volume of traffic.
Essentially, during such an attack, hundreds of computers will start sending fake traffic to your website, such that it gets overwhelmed. No locally installed plugin would be able to handle such a flood of traffic.
Check out the following diagram of how a DDoS attack works.
Do keep this in mind when opting for such a service.
To counter such a threat, one would have to opt for the Website Firewall Cloud service (such as the one offered by Sucuri).
On the Wordfence dashboard, you will find full information about the last scan, any current notifications, along with the currently enabled/disabled features of Wordfence. Once you start seeing the attack statistics, you will clearly understand the importance and need of a WP security plugin.
The sheer number of daily attacks your website suffers is overwhelming. No wonder so many websites get hacked.
Can you imagine the threat your website would suffer in all of those attacks were not being protected by some good WP security? What a serious risk for all of the content stored on your website if these hackers got their dirty hands on your website.
There are separate sections in the Wordfence dashboard for displaying the total blocked attacks, blocked IP addresses, the number of failed and successful login attempts, etc.
Wordfence Website Scanner
The free WordPress version of Wordfence comes with basic scanning features, but real-time firewall rules and blacklists are delayed by 30 days. These are only available if you opt for the Premium version.
This means that there are 30 days from when new rules are created when you'll be hoping that your WordPress site does not get attacked by the latest zero-day vulnerabilities. Zero-day vulnerabilities for which there is no current patch/fix, but can be blocked using a web application firewall (WAF).
We believe this is quite a security risk and you should ALWAYS opt for the premium version, or ideally, a Web Application Firewall (WAF). This is because a web application firewall can detect malicious traffic "patterns" and create firewall rules to block and mitigate the threat, even if a patch does not exist.
Apart from this drawback, there are plenty of protections offered with the free version of the Wordfence plugin.
You can choose to
- scan for HeartBleed vulnerability,
- scan the public configuration of your WordPress site,
- check for backups,
- check for the presence of log files,
- the strength and complexity of user and admin passwords,
- current disk usage,
- any unauthorized DNS changes,
- and limit the number of issues included in the scan result email.
It is also possible to check the core WordPress, themes, and plugins files against the repository versions.
There is a built-in firewall to prevent any abnormal activity on your website - such as probing for XMLRPC and any malicious traffic attempts to login via the API or otherwise. It is possible to run the application firewall/WAF in learning mode to familiarize the system with the regular user activities and create custom firewall rules, thus preventing locking out a legitimate user.
You can also choose to enable the Wordfence firewall on schedule.
Preventing WordPress Attacks with Wordfence
The Wordfence plugin comes with several options to help you prevent brute force attacks. This is also a form of security hardening.
You can choose to:
- enforce strong passwords, to deter dictionary word brute force attacks
- limit the number of login failures and forgot password attempts before locking a user to block automated brute force scripts,
- set the duration for tracking the login attempts,
- prevent registering the ‘admin’ username,
- block people trying to log in with specific usernames, etc.
It is also possible to block fake Google crawlers and allow unlimited access to verified crawlers.
This pretty much makes it impossible for brute force attacks to be successful. If you're running websites for several different websites, maybe through reseller hosting, you might want to enforce this to conserve resources.
The free version of the Wordfence plugin allows you to block IP addresses, while the premium version allows you to block full countries and geographies besides just IPs. It is possible to block a particular IP address, a range of IP addresses, hostname, user agent, referrer, etc.
There is a live traffic feature that shows a real-time update about the current visitors to your WordPress website. As there are separate colors for different types of traffic, you can quickly identify which type of visitor it is.
The plugin also allows you to sort the traffic by using various filters like human, crawler, registered user, blocked, locked, etc.
Wordfence Settings Options
Additional security hardening options come through the Wordfence options:
You can configure the plugin settings from the Wordfence > Options page.
The basic options section allows you to enable advanced blocking, login security, a live traffic view, and an advanced comment spam filter for your website. It is also possible to enable automatic scans and auto-update of the plugin.
There is a separate field to define the email address which will receive any alert messages which make sure you don't miss any critical problems with your site.
You can define which emails you want to receive from the ‘Alerts’ section. Available options include receive emails for the plugin updates, plugin deactivated, warnings, critical problems, new IP address blocked, new locked user, etc.
It is, of course, possible to define the maximum number of alerts to receive per hour. You can enable an email summary to get a summarized version of the plugin activities for the day, week, or month.
Other notable admin options include whitelisting IP addresses that bypass all the rules, whitelisting 404 URL’s, hide the WordPress version, filter comments, etc. There are separate options to import or export plugin settings to or from other websites.
Why not give Wordfence security a try now? You've got all to gain, nothing to lose!
Which Security Plugin should You Choose?
Choosing the best security plugin between Sucuri vs Wordfence relies heavily on your level of expertise and requirements.
On top of that, since we are comparing Wordfence Security and Sucuri Security, the two most popular security plugins for WordPress, both of them will provide you with an excellent level of security.
You won't be let down by either of these two plugins in reality - it's mostly a matter of which plugin seems to appeal most to you. Both of these companies are also large, reputable companies, who offer great support in case something goes belly up, so you can rest assured of that too.
In terms of Ease of Use, you might feel a bit overwhelmed initially by the sheer number of options available, especially if you are not a security expert. We would highly recommend that you ask the agents to help you set the plugin up.
Otherwise, both plugins will get familiar. Eventually, once you set the Sucuri, Wordfence plugin, ease of use won't be an issue, because you won't need to perform any changes after the initial setup.
You might also want to have a bit of a look at the pricing of each of these plugins below if the price is a factor. We believe price should not be a factor when acting on the security of your website because the implications of a hacked site are much larger than the cost of WordPress security.
We do believe that both Sucuri and Wordfence provide excellent value. After all, is there a price you would put on the loss of reputation and business which comes with suffering a hacking attack?
But let's give you a bit of a compare and contrast of WordFence vs Sucuri, in terms of what could be defined as what we liked and what we didn't like about these two WP security plugins.
Sucuri comes with a better user interface with simpler options to strengthen the overall security. You can harden the security by enabling various features. Integrity checker for the core files is a notable essential feature.
In most cases, hackers and potential abusers tend to make changes to a core file and create a backdoor.
Sucuri helps you protect your website from these incidents by checking the files against a secure remote installation. The post-hack options are another nice touch. These can help you save the website whenever you detect any suspicious activity on your website.
On the other hand, the Wordfence plugin comes with its own suite of options. The dashboard offers more information and provides an overview of the whole website at a glance.
It’s a bummer that the scanner doesn’t cover the latest security threats. The brute force preventing feature will keep the intruders away, while the live traffic will show a handy list of the current visitors.
The web application firewall is a great touch to enhance your website, but you have to be careful with it. Inexperienced users might lock themselves and lose access to the website.
As we've discussed so far, you know that both of these services offer a free plugin, but as we have said, the free plugin has a number of limitations. But both services also offer a number of premium options.
Sucuri has two main offerings for regular websites.
This is the first tier protection, which includes the web application firewall, performance optimization via the built-in CDN, Layer 7 DDOS Protection, High Availability, customer support, etc.
The price starts at $9.99/month with higher-tier plans coming in at $19.98/month and $69.93/month. We would recommend that you click on the image below to see the difference between these tiers.
Website Security Platform
This is the top tier platform, apart from Enterprise and Custom solutions for big businesses. It starts at $199.99/year with other plans at $299.99/year and $499.99/year with the major differences between them being the response times to support incidents.
We would recommend you visit the pricing page to compare and understand the difference between such plans.
You can also speak to a support agent to ensure that any security concerns or questions you have are answered before you decide to purchase.
We do believe that the basic $199.99 plan should be installed on every website. You really can't put a price on peace of mind, and we do believe Sucuri is the best option of the two products compared here.
All plans have a 30-day money-back guarantee.
Wordfence offers a free plugin that you can download. Wordfence Premium starts from $99/year for the first site, then gets cheaper as the number of sites you install it on increases.
Still not convinced? Have a look at what Syed Balkhi, a huge WordPress influencer and the brains behind WPBeginner.com (one of the largest WP related sites) says about switching to Sucuri. WPBeginner currently serves more than 300,000 page views daily (on average) and a monthly total exceeding 9 million page views!
"Our server load has come down on WPBeginner - insanely! Security is a big thing and is the primary reason we use Sucuri, but the added benefit is the speed aspect - because everything goes through the WAF and it’s that much faster."
"For me, the biggest advantage of using Sucuri is that I don’t have to get a server admin anymore. I don’t need a 5th admin, because before, the 5th admin’s job was to monitor the server and recognize and mitigate any attacks. I had a 5th admin, part-time and I was paying $2,500/month to keep him on retainer."
Here's another Sucuri testimonial from the owner of hostingpill.com:
"Even with the best security experts, there is a limit to the monitoring they do. With Sucuri, I have peace of mind that the website is being monitored 24/7 and we will be alerted if something goes wrong.
Page load time is a huge factor of online experience. If you decide to use the Sucuri CDN service, you can expect increased customer satisfaction rates, more page views, increased conversion rate and decreased bounce rate."
Our review of these two plugins would not be complete if we did not provide a Wordfence testimonial.
Nick writes on ElegantThemes in their own Wordfence review.
"Wordfence is by far the most popular security plugin and deservedly so. Even the free WordPress version offers loads of features to keep WordPress sites safe and off spam lists. From an extensive security audit over a full-featured firewall to heaps of additional options, the plugin will do its best to keep hackers and other shady individuals at bay."
Since we tend to offer even other alternatives to our visitors, just in case you're still not 100% convinced, another of the WordPress security plugins we use and love is iThemes security.
Sucuri vs Sitelock
If you are considering other options, one of the other providers to make your website resilient is Sitelock. This is another cloud-based service that protects your domains without taking the load on the actual site itself. If you'd like to know more, visit our Sucuri vs Sitelock article to see all of the details of this comparison.
Frequently Asked Questions
Here are some of the most frequently asked questions about these two plugins we have compared.
What is Wordfence Security?
Wordfence Security is a firewall and malware scanner for WordPress. It can protect your website from hackers in two ways. The firewall stops malicious traffic from hitting your website. The malware scanner searches through your website's files to ensure that they are clean from any hacked files.
Is Wordfence free?
Yes, there is a free plugin that you can download for Wordfence. While the free version is a good start when it comes to securing your site, we would always suggest going for the premium version, for something as critical as protecting your website.
How much does Wordfence cost?
The premium version of this plugin starts at $99, but there are volume discounts on additional licenses.
Do I need a WordPress security plugin?
Yes, it is highly recommended that you get one. With vulnerabilities being discovered in both the core and several popular plugins and themes every month, it is hard to stay on the ball when it comes to keeping up to date. A WordPress security plugin will help you with the heavy lifting and ensure your site does not get hit by hack attacks which can be easily prevented.
What is the best WordPress security plugin?
While this is a subjective question, from our review as we have seen above, we believe Sucuri is the best option when it comes to security plugins.
How do know if my website has been hacked?
Hacked sites will frequently experience a dramatic spike in traffic because your site becomes the "infection vector" for visitors which are sent specifically to your site to get malware installed on their machines. BYour might also discover strange links on your site, content which you have not written, or get messages from your WordPress hosting site and possibly even the Google Search console. If you start seeing strange things on your site, or significant performance degradation, or other issues that you can't put your finger on, it's a good idea to speak to a security expert.
Why is website security important?
If your site is not well protected, there are several serious issues that can significantly affect your website, business, and particularly your visitors. An unprotected website is a security risk and can become an infection vector or host which is used to spread malware, become a source of attacks on other websites, and even attacks against national targets, infrastructure, or attacks on other networks through the use of DDoS attacks, or Distributed Denial of Service Attack.
Conclusion: Sucuri vs Wordfence, which should you choose?
Now that we have compared all the features and options of these two WordPress security plugins, we are going to make our own choice.
If we had to buy a security plugin for WordPress, we would opt for and recommend Sucuri Security as our choice, in fact, this is the plugin we as a team would recommend and install on most of our sites and we have never suffered a hacking incident.
Along with being a renowned web security brand, the support offered, add to this, the simple user interface which makes it a lot easier to use the plugin and well what can we say, we can't find much (or anything) wrong with this service! We know our website and content will be protected. Our privacy won't risk being compromised at all.
So, what do you think about these two WordPress security plugins? And do you agree with our choice of Sucuri Security as the preferred choice among these two? Or do you have another opinion when it comes to Sucuri vs Wordfence. Let us know in the comments.
Editor's note: As has been rightly pointed out in the comments below, the Sucuri link is an affiliate link while the Wordfence link isn't. There is a very simple reason for this, Sucuri has an affiliate program while Wordfence doesn't. As you can rightly see, we did not give any preference to Wordfence vs Sucuri in terms of CTA's exposure, or depth of research. We simply feel that Sucuri is the better security service between the two. The affiliate link does not cloud our judgment at all. We have always been honest about linking to affiliates (that is how CollectiveRay partially pays its expensive bills - we don't break even, this is a labour of love/passion) and we won't compromise our integrity by linking out or recommending services which we think aren't top-notch, just for the payout. There's simply too much at stake, for you AND for us!
Please leave a useful comment with your thoughts, then share this on your Facebook group(s) who would find this useful and let's reap the benefits together. Thank you for sharing and being nice!
Disclosure: This page may contain links to external sites for products which we love and wholeheartedly recommend. If you buy products we suggest, we may earn a referral fee. Such fees do not influence our recommendations and we do not accept payments for positive reviews.