SecuPress Pro

Scan results and guided hardening

SecuPress Pro brings WordPress security checks and controls together in one add-on. Its scanner checks 35 security points in about five minutes, then includes a grade and report showing which areas may need attention. Many suggested fixes can be selected with a checkbox; when a change needs your decision, SecuPress asks before proceeding. Export the analysis as a PDF to share with clients or colleagues.

Automated checks and threat controls

Automated tasks can run security scans, backups, and malware scans on a schedule. Backups cover the database and documents, which can be downloaded. The malware scanner checks for bad files in FTP and the uploads folder, as well as potential phishing attempts involving index.php loads.

Plugin and theme checks look for vulnerable components and files tampered with to include malicious code. When a vulnerable extension or theme is detected, SecuPress can send an email alert and display a WordPress warning. Security alarms hosted on SecuPress servers provide daily data about recently vulnerable add-ons and themes.

Firewall functions block malicious requests, bad user agents, disallowed request methods, suspicious URL contents, and SQL injection scanners. SecuPress can also block bad bots, suspicious IPs, and visits from a country using geolocation.

Login and account protection

• Limit failed login attempts and protect against password spraying.
• Ban login attempts that use usernames that do not exist.
• Set a non-login time slot and manage user sessions.
• Add two-factor authentication and set password lifetimes.
• Require strong passwords and forbid vague usernames such as www or admin.
• Move the WordPress login page with the included Move Login feature.

Installation and website management

Install and activate SecuPress through the WordPress Plugins screen, then configure it in SecuPress > Settings. Start with the scanner, review its grade and recommendations, and apply the hardening changes that fit the website. You can then configure login controls, firewall functions, alerts, malware scans, and automated tasks.

SecuPress can be activated for all subsites from the main multisite network site. It is compatible with WordPress caching and multilingual plugins and is listed as compatible with hosts including o2switch, OVH, SiteGround, Bluehost, PlanetHoster, WP Engine, and GoDaddy. SecuPress is not compatible with another security plugin; security rules from multiple plugins may conflict or overwrite one another.