Plugin Author: Sucuri Inc.
WordPress profile: Sucuri Inc.
Last updated: September 8, 2022 (4 weeks ago)
Tested up to (WP version): WP 6.0.2
Rating: 5 (out of 5)
Sucuri Inc. is a globally recognized authority in all matters related to website security, with specialization in WordPress Security.
The Sucuri Security WordPress plugin is free to all WordPress users. It is a security suite meant to complement your existing security posture. Currently the ownership of this plugin was transferred to GoDaddy.
It offers its users a set of security features for their website, each designed to have a positive effect on their security posture:
- Security Activity Auditing
- File Integrity Monitoring
- Remote Malware Scanning
- Blocklist Monitoring
- Effective Security Hardening
- Post-Hack Security Actions
- Security Notifications
- Website Firewall (premium)
Contributors & Maintenance Notice
Daniel is no longer maintaining the Sucuri plugin at GoDaddy. We have transferred it to a dedicated team to maintain and improve it.
More information on the Sucuri Security WordPress plugin can be found in our Knowledge Base.
This is perhaps the most underutilized security function. It’s the act of monitoring all security related events within your WordPress install. The challenge is, what makes up a security event. In the eyes of Sucuri, any change that occurs within the application could be categorized as a security event, and as such we try to record it.
This is important because it gives you, the website owner, the ability to keep a good eye on the various changes occurring within your environment. Who is logging in? What changes are being made?
This feature is logging all activity to the Sucuri cloud, for safe keeping. This ensures that an attacker is not able to wipe your forensic data and prevent further security analysis after a compromise. If an attacker is able to bypass your security controls, your security logs will be kept safe within the Sucuri Security Operations Center (SOC).
This feature is particularly important to website / system administrators and security experts looking to understand what is going on with their website and when it’s happening.
Security File Integrity Monitoring has been fundamental to the world of security. It’s the act of comparing a known good with the current state. If the current state differs from the known good, you know you have a problem. This is the basis of a lot of host intrusion detection systems. It’s what we have built into the plugin.
It will create a known good the minute the plugin is installed. This will be of all the directories at the root of the install, this includes plugins, themes and core files.
This feature is powered by our scanning engine, found on our free security scanner – SiteCheck. It’s important to take some time to understand how this scanner works. There are limitations with the way this scanner works, you can find more information in the FAQ section.
Another very interesting feature of the Security Malware Scanner is that it checks various blocklist engines, including the following:
- Sucuri Labs
- Google Safe Browsing
- Phish Tank
- McAfee Site Advisor
These are some of the largest blocklisting entities, each having the ability to directly impact your brand’s online reputation. By synchronizing with their environments we’re able to tell you, upon scan, whether any of them are negatively flagging your website with a security related issue. If they do, then via our website security product, we’re able to help you get off of the security blocklist.
It’s easy to get lost in the world of security hardening. At Sucuri we clean hundreds of websites a day, many with the various security hardening configurations you find in various WordPress Security presentations. In this section, we add those that we feel to be most effective, and that complement the entire Sucuri suite of products.
Regardless of how good your security posture is, sometimes it’s impossible to prevent the inevitable. When this happens, we’ve included a section to help you walk through the three key things you should do after a compromise.
Having all these security features would be useless unless you were notified of the issues. This is why we have made available security alerts. We have also expanded the various security related events, to provide website owners more flexibility in regards to what they want to know about. As a website owner, you have the option to make these security alerts as quiet or noisy as you would like.
This is by far the coolest security feature Sucuri has to offer everyday website owners. It’s an enterprise grade Website Firewall designed to give you the best security protection any website can hope for. It protects your website from a variety of website attacks, including:
- Denial of Service (DOS / DDOS) Attacks
- Exploitation of Software Vulnerabilities
- Zero Day Disclosure Patches
- Brute Force Attacks against your Access Control Mechanisms
This is coupled with a number of features like:
- Performance Optimization
- Advanced Access Control Features
- Failover and Redundancy
This is not included as a free option of the plugin, but is integrated so that if purchased you are able to activate. If you prefer to leverage the Sucuri Firewall product by itself, you have the option to operate the Website Firewall WordPress Security plugin in standalone mode.
The Sucuri WordPress Security plugin is built by the team that is known for their proactive approach to security. It is built using intelligence gathered from thousands upon thousands of remediation cases, millions of unique domain scans and 10’s of millions of website security attack blocks.
A few other security plugins provide activity monitoring features, but few do them well. The activity monitoring in this plugin is second to none, tying the activity into the Sucuri Security Operations Center (SOC) ensuring its safe keeping.
This security plugin also takes a different approach to security plugins, stripping it of what we categorize as unnecessary features for a basic website end-user. We’ve narrowed the key features we felt were most pertinent to any website owner and integrated them into this plugin.
No, this is a free plugin that we offer at no charge. It does not mean you get a free account.
The premium plugin was deprecated back in 2014. All the major features were merged into the free plugin. If you are still using the (old) premium plugin please consider deleting it and installing the (new) free plugin from the WordPress plugin market. Notice that you will need to generate a new API key as the new API service does not supports the old one.
Yes. This plugin compliments your existing security toolsets. It is not designed to replace the Sucuri Website Security or Firewall products.
The plugin does not, but there might be issues with our scanners. If you get an “Unable to Properly Scan Your Site” error, it’s likely because the WordFence plugin is blocking our scanner as an invalid crawler. You would have to white list our IP address on the WordFence dashboard.
Because the security malware scanner is remote, it is unable to see things that are on the server but that are not displaying on the browser. If you are interested in this, we encourage you to subscribe to our website security product. This issues includes things like Phishing pages, Backdoors, Mailer Scripts, etc.
This happens, reference the remote scanner limitations above. This should not be confused with our website security product. If you have malware, and you are a client, submit a ticket so that we can help you get clean.
If you are not a client, and you want to share what you have found please send it to email@example.com.
The plugin is not performing application level malware / security scanning so this is not uncommon.
No, it is not. To enable you must subscribe to the Website Firewall service.
We improve the performance of the code with every release. However, due to differences between hosting providers there are cases where the plugin may affect the responsiveness of the website upon installation. Things like HTTP requests, SSL certificate verifications and DNS lookups are among the few things that, depending on how your web server is configured, will slow down your website.
No, they do not.
Not that we are aware of.
No, it is not required. The Website Firewall runs in the cloud without the need of anything installed. This plugin only helps see and manage the service from the WordPress dashboard.
WordPress Integrity Tool - Detects added, modified, and removed files.
Integrity Diff Utility - Shows differences in the core WordPress files.
Audit Logs and Malware Scanner - Reports suspicious events and malicious code.
Sucuri Firewall - Settings visibility, audit logs, IP blocklisting, and cache.
Website Hardening - Offers multiple options to increase the security of the website.
Failed Logins - Shows failed login attempts, successful logins and online users.
Post Hack Tools - Offers multiple tools to react after the suspiciousness of a hack.
Settings - Offers multiple settings to configure the functionality of the plugin.
Latest Change log entry:
- Fixed “Early referer checks on admin hooks”
firewall, malware, scan, security, spam
+ Jason's Comments
Sucuri Security has many features, which I’m still exploring. This plugin can scan for malware. The free version will only scan the front end of your website, if you want it to scan the back end of your site, you will need to pay for an account. I’ve recently used it to harden (make more secure) WordPress folders, check for vulnerabilities and re-download all plugins which originate from the WordPress plugin library.
Read up on other WordPress security related plugins and strategies.Website Optimization and Maintenance
There are a few ways to optimize and speed up your website for viewers and search engines: database clean up, image optimization, page / script compression, CPU / server load optimization, server file caching and utilize browser caching.