Do you need a security plugin for WordPress?

WordPress core is well maintained, but most sites are hacked through plugins, themes and passwords, not core. A security plugin adds the layers WordPress doesn’t ship with: a firewall that understands WordPress, login protection, malware scanning and alerts. Managed hosts sometimes provide some of these at the server, so check what yours already does before adding overlapping tools. You need something covering each layer; it doesn’t have to be one product.

How to choose a WordPress security plugin: the 12 checks

1. Does it cover all three layers?

Prevention (a firewall), access control (login protection and 2FA) and detection (scanning and alerts) fail in different ways. A plugin strong in one and missing another leaves a gap. Make a simple table and tick each layer.

2. Where does the firewall run?

A plugin firewall runs inside WordPress and knows your users; a cloud firewall runs before traffic reaches your server. Both are valid, with different trade-offs, explained in WordPress firewall vs. host firewall. Ask how many rules are built in and what they cover. Silent Threads’s firewall runs in WordPress with 356 built-in rules.

3. How do new rules and signatures arrive, and how fast?

Attacks against a newly disclosed plugin vulnerability begin within days. Ask whether new firewall rules and malware signatures arrive without a full plugin update, and whether free users wait longer. Delays are a fair way to fund a product, but you should know the number: ours is 30 days for Basic and immediate for Pro and Agency.

4. Are those feeds and updates verifiable?

A security plugin downloads code and rules with high privileges, which makes it an attractive target. Ask whether updates and feeds are signed and whether the plugin checks the signatures. Silent Threads signs updates, licenses and feeds with Ed25519 and refuses anything that doesn’t verify. See how we sign updates.

5. Does it check its own integrity?

Malware sometimes disables or edits security plugins first. A plugin that verifies its own files against a signed manifest, and stops loudly if they change, is harder to switch off quietly.

6. What does it send off your site?

Read the privacy policy. Some plugins send traffic logs or full request details to a cloud service. Know what leaves your server, and whether data sharing is opt-in. Silent Threads sends license and update checks, signed feed requests and attacker IPs for country lookups (not stored). Sharing blocked IPs with the network is opt-in and off by default, and posts, files and passwords never leave the site.

7. How does it avoid false positives?

An overzealous firewall breaks contact forms, checkouts and page builders. Ask how new rules are tested: is there a report-only or learning mode? Can you test a custom rule safely? New live rules in Silent Threads start in report-only mode; Pro adds a WAF Rule Sandbox for testing custom rules against real traffic.

8. How does it prevent lockouts?

Blocking your own administrators is the most common complaint about security tools. Look for explicit protections: trusted IPs, never blocking logged-in admins, and a documented way to recover access.

9. What does the scanner actually scan?

Files only, or the database too? Does it compare core files with official checksums? Does it look at front-end JavaScript on shop pages? See what scanners can and can’t catch.

10. What will it cost your site in speed?

Every plugin firewall uses some server resources. Ask whether rules are evaluated locally or by calling a remote service per request, and measure time to first byte on a few uncached pages before and after installing it.

11. What support do you get, and how?

When something is wrong, support is the product. Check the channels (tickets, chat), which plans get them, and whether replies reach you inside WordPress. Silent Threads includes tickets on Pro and live chat on Agency, with replies shown as in-plugin notifications.

12. What’s really in the base plan, and per how many sites?

Compare the features on the plan you’d actually buy, not the top tier. Check the site limit per license if you run several sites. On Silent Threads, every plan, Basic included, has the firewall, brute-force protection, rate limiting, 2FA, a password policy, one-click hardening (16 checks) and instant new-admin alerts; see pricing for the full comparison.

Free vs. paid

A good free plugin beats no plugin. Paid plans usually buy speed (faster rules and signatures), depth (deeper scans, more firewall control) and support. If your site takes payments or holds customer data, the faster rule updates alone are usually worth it.

Red flags

  • Promises of total protection, or that your site can never be hacked. No product can promise that.
  • No published changelog, or long gaps between releases.
  • No clear statement of what data leaves your site.
  • Installing two full security suites side by side: they duplicate work and conflict.

How to test before you commit

Install on a staging copy first. Check that your forms, checkout and editors still work, measure speed, trigger a few failed logins to see the lockout behaviour, and read the first scan report. If the report is noisy or unclear, that’s how it will be every week.

How we checked this guide

This is a buying checklist, not a product comparison: it names no other products and makes no claims about them. Where we describe Silent Threads, it’s only to show how we answer each question, with the plan that includes the feature.