Plugin
PluginUpdated
WP Cerber Security
WP Cerber Security is a WordPress security plugin from Cerber Tech Inc.
Product facts
- Version
- 9.10
- Released
- 14 October 2026
- Type
- Plugin
- Licence
- GPL
- Included in
- Every plan, or $9.09 on its own
Overview
Any WordPress site attracts automated bots, spam submissions and password guessing. WP Cerber Security addresses these with a firewall and traffic inspector that screens requests for malicious patterns, plus bot detection and brute force mitigation that guard login, registration and REST API endpoints. Two-factor authentication adds another layer to user accounts.
The plugin also covers what happens after something goes wrong. A malware scanner and integrity checker look through WordPress files, themes and plugins, and original WordPress files can be restored if they are modified. Activity logs, a live traffic viewer and email alerts keep you informed. It fits blogs, business sites and WooCommerce stores, since it protects forms such as checkout and login.
Features
- Firewall and traffic inspector: Screens all incoming requests for malicious patterns and blocks hacker attacks and automated bots before they reach your data.
- Anti-spam protection: Combines heuristic and content-based checks with a real-time IP database to stop spam, phishing and malicious submissions across the forms on your site.
- Malware scanner and integrity checks: Scans WordPress files, themes and plugins for malware and suspicious changes, removes threats automatically and sends alerts when something turns up.
- Country-based access rules: Restricts site access and form submissions by geographic location, which limits exposure to traffic from regions you do not serve.
- Brute force attack mitigation: Uses layered protection and bot detection to guard login, registration and REST API endpoints against repeated password guesses and code injection attempts.
- Real-time threat intelligence: Uses Cerber Security Cloud to block globally recognized malicious IP addresses as they appear, before they can touch your site.
- Activity log and live traffic: Records user activity and HTTP requests so you can review suspicious behavior and keep detailed security records for your site.
- WooCommerce form protection: Covers WooCommerce forms, including checkout pages, to help keep store transactions safe from fraudulent or automated attacks.
Best for
- WordPress site owners who want built-in firewall and login protection
- WooCommerce stores that need protected checkout and login forms
- Agencies and freelancers securing multiple client sites
Changelog
Version 9.10
- Security Two-factor authentication is now protected against PIN distributed brute-force attacks with per-account rate limiting. Each account can receive at most 5 new 2FA challenges per rolling hour and 10 per rolling 24 hours.
- Security When an account exceeds a 2FA challenge limit, WP Cerber blocks new sign-ins to that account for 24 hours and notifies the account owner of a possible password compromise.
- Security Hostnames obtained through reverse DNS lookups are now treated as untrusted data and escaped every time they are displayed in the admin area.
- Security Fixed a REST API user enumeration bypass. With "Block access to users' data via REST API" enabled, visitors blocked from the standard users route could still get the user list by changing the letter case or adding a trailing backslash or newline.
- Fixed A `rest_route` query parameter passed as an array, such as `?rest_route[]=x`, caused an uncaught `TypeError` (HTTP 500) in `CRB_Request::get_rest_api_path()`. WP Cerber now leaves such requests to WordPress, as on a site without WP Cerber.
- Fixed The "BLOCKED" and "PROHIBITED" user status labels and the red highlighting of usernames were missing on the WordPress "Users" admin page after a change in the WordPress Users table markup. They are displayed again.
- Fixed The GDPR personal data export now reports Activity log read errors. Previously, a database error could make the export state that no activity was logged or end the export early.
- Fixed The GDPR personal data erasure no longer confirms that data was erased when a database error prevents WP Cerber from verifying that Activity log records were removed.
- Improved WP Cerber now recognizes the core REST API users routes the same way WordPress dispatches them: regardless of letter case, with trailing slashes and backslashes removed, and with one trailing newline allowed. All requests that were blocked before remain blocked.
Earlier versions
- 9.9.5: 4 improved, 5 fixed
- 9.9.3: 9 fixed
- 9.9: 3 new, 2 improved, 2 fixed
FAQ
Is WP Cerber Security free?
The code of WP Cerber Security is licensed under the GPL, so anyone may use, change and share it. Buy GPL is a paid service: a plan or a purchase of WP Cerber Security gives you the download and its updates. The developer's own support, licence key and online services are not included.
Which version of WP Cerber Security is this?
Version 9.10, released 14 October 2026. New versions appear here when the developer publishes them.
How do I update WP Cerber Security?
Install Buy GPL Updater on your site and paste your key from My Account. It installs new versions of WP Cerber Security for you.







