Security plugins promise to protect WordPress from hackers, but they differ a lot in what they protect against and where they do it. On a VPS, some protections are better handled by the server (firewall, rate limiting, Fail2ban), while plugins are best at WordPress-specific tasks: vulnerability alerts, file integrity checks and login security. Here’s how to combine them sensibly.

What WordPress attacks look like

  1. Vulnerable plugins and themes: by far the most common way sites get hacked.
  2. Brute-force logins, and credential stuffing with leaked passwords.
  3. Malicious uploads and injected code after a compromise.
  4. Bad bots: scraping, spam, and probing for known vulnerabilities.

The most effective defence against #1 is keeping everything updated and removing unused plugins. No plugin replaces that.

The main plugins

Plugin Firewall (WAF) Malware scan Login security Vulnerability alerts Notes
Wordfence Endpoint WAF (PHP level) Yes 2FA, rate limiting, CAPTCHA Yes Popular; free rules are delayed vs Premium; can be heavy
Solid Security (ex-iThemes) Basic Basic (paid more) 2FA, passkeys, lockouts Yes Hardening toggles
Sucuri Security Cloud WAF (paid) Remote scanner Basic — Free plugin = audit log + hardening; firewall is a paid proxy service
Patchstack Virtual patching (paid) No No Excellent Lightweight; focused on plugin vulnerabilities
All-In-One Security (AIOS) Basic .htaccess rules File change detection Login lockdown, 2FA — Free, many hardening options
WP Activity Log — — — — Audit trail of user actions

Existing deep dive: Sucuri vs Wordfence.

Use one main security plugin. Two firewalls or two scanners slow the site, and conflict.

What the VPS does better

Plugins run inside PHP: every malicious request still loads WordPress before the plugin can block it. On a VPS, block earlier:

Protection Server-level tool
Brute-force logins Nginx limit_req + Fail2ban. See limit login attempts
XML-RPC abuse Block xmlrpc.php in Nginx. See disable XML-RPC
PHP execution in uploads Nginx deny rule. See the ideal Nginx config for WordPress
Network firewall UFW/nftables. See UFW
Bad bots and scanners Fail2ban on 404 bursts; CDN or WAF in front
File tampering Correct ownership and permissions. See WordPress file permissions
Isolation between sites One PHP-FPM pool and user per site
Recovery Off-site backups. See WordPress backup without a plugin

An edge WAF (Cloudflare, or Sucuri’s firewall service) filters traffic before it reaches your server at all. See WordPress CDN setup.

A sensible setup

  1. Server: firewall, Fail2ban, Nginx rules (block xmlrpc, no PHP in uploads, rate-limited login), automatic OS security updates.
  2. WordPress: strong passwords and 2FA for admins, DISALLOW_FILE_EDIT, a minimal plugin list, regular updates. See WordPress two-factor authentication and wp-config.php tweaks.
  3. One plugin for vulnerability alerts and file integrity (for example Wordfence free, or Patchstack).
  4. Backups tested regularly.
  5. Monitoring: uptime checks, plus an audit log for multi-author sites.

Performance impact

Scanning plugins can use a lot of CPU and memory during scans, and endpoint firewalls add processing to every PHP request. On small VPS plans:

  • schedule scans at quiet hours, and limit scan scope;
  • prefer server-level blocking for high-volume attacks;
  • watch CPU and PHP workers during scans. See htop.

Quick check: is your site already compromised?

wp core verify-checksums
wp plugin verify-checksums --all
find wp-content/uploads -name '*.php'
wp user list --role=administrator

Unexpected PHP files in uploads, modified core files, or unknown admins mean it’s time for a cleanup. See WordPress malware removal.

Quick reference

Need Best tool
Vulnerability alerts Patchstack / Wordfence
Login protection Nginx rate limit + Fail2ban + 2FA
Malware detection Wordfence scan, WP-CLI checksums
Edge filtering Cloudflare / Sucuri firewall
Recovery Off-site backups

Related: WordPress hardening and WordPress VPS hosting.

  • WordPress
  • Security
  • Plugins