iThemes Solid Security Pro

Weak passwords, outdated plugins and repeated login attempts are among the most common ways a WordPress site gets compromised. iThemes Solid Security Pro addresses these with login requirements you can enforce, including strong passwords, two-factor authentication and passkeys. It also bans IP addresses that try to force their way in, using both local and network-based banning.

Beyond logins, the plugin looks after the software on your site. It works with Patchstack to detect vulnerabilities in plugins and themes, schedules automatic scans and can apply virtual patches when an update is not yet available. A security dashboard and alerts show what is happening, and activity logs record user actions. It suits personal blogs, online stores and business sites alike.

Features

• Custom login requirements: Set strong password rules and require two-factor authentication or passkeys, so weak credentials and unauthorized access are harder to get through on your site.
• Passkeys and biometric sign-in: Users can sign in with biometric options such as Face ID, Touch ID and Windows Hello, in major browsers including Chrome and Safari.
• Brute force protection: Local and network-based IP banning blocks malicious login attempts, and the settings can be adjusted to fit your site. The network shares threat data from over 1 million sites.
• Patchstack vulnerability detection: Identifies vulnerabilities in plugins and themes through the Patchstack integration, helping you keep software current without checking each item by hand.
• Scheduled scans and virtual patches: Run automatic scans for vulnerable software and apply virtual patches when no update has been released yet for the affected plugin or theme.
• Trusted Devices: Approve familiar devices for secure logins and get notifications when someone signs in from a device the plugin does not recognize, which helps guard against session hijacking.
• Temporary privilege escalation: Give an outside developer or technician temporary admin access without creating a new user account, with control over how long it lasts and what it permits.
• Activity logs and WP-CLI: Keep detailed logs of user actions, watch activity on a customizable real-time dashboard, and manage security from the command line with WP-CLI support.

Best for

• Online stores protecting customer logins and data
• Agencies managing security across client WordPress sites
• Site owners who want two-factor authentication and passkeys