The Ultimate Security for WordPress.
Protect your website, your reputation and your customers’ data from hackers, malware and vulnerabilities in just a few clicks.
Site Protected
No threats detected
Built for real-world WordPress
Everything you need, in a single plugin.
You don’t need to be a security expert. Scudo Security sets up in minutes and works quietly in the background to protect your site.
Web Application Firewall
Blocks SQL-injection, XSS, path-traversal and command-injection patterns as WordPress boots. Pro adds your own allow and block rules on top of the built-in engine.
Malware & integrity scanning
Resumable scans check your core files against the official WordPress checksums and flag backdoors and obfuscated code — then quarantine or repair them safely, never a blind delete.
GeoIP blocking & rate limiting
Block traffic by country behind your CDN and throttle abusive clients by requests-per-minute, with real client-IP detection.
Two-factor authentication
TOTP with any authenticator app and single-use backup codes — every user can enrol themselves. Pro adds enforcement by role: the roles you choose are prompted until they set it up.
Hide login & backend
Move wp-login.php to a secret address and keep bots — and non-administrators — out of wp-admin.
Brute-force protection & CAPTCHA
Login-attempt limits, automatic IP lockouts and an invisible CAPTCHA stop password-guessing bots. The web login and XML-RPC are tracked separately, so abuse of one never locks you out of the other.
Plus the complete security toolkit
Every install includes the full set — free features are always on, Pro features are marked.
Flags installed plugins and themes that are abandoned or have been pulled from the repository, and cross-checks them against any JSON advisory feed you point it at.
Honeypot and time-trap on comments and the major form plugins.
Keep XML-RPC working but require a 2FA code, instead of disabling it outright.
Enforce strong passwords on profile updates and resets.
X-Frame-Options, nosniff, Referrer-Policy and a report-only CSP, with an HTTPS/HSTS check.
Every login, change and security block — searchable, filterable and paginated. CSV export in Pro.
Hide the WordPress admin bar for non-administrators.
A transparent 0–100 score with a prioritised, actionable to-do list.
Three database-less escape routes that always get you back in.
Compose and ship a CSP from the dashboard, report-only first, without hand-editing headers.
Reject passwords found in known data breaches — only a short hash prefix is ever sent.
Administrator-login alerts and a weekly security digest by email.
Stop worrying about hacker attacks.
Botnets automatically probe thousands of WordPress sites every day, looking for outdated plugins or weak passwords. Scudo Security adds a strong, layered defense — firewall, brute-force protection and malware scanning working together.
- Custom firewall rules: Add your own allow and block rules on top of the built-in engine (Pro).
- GeoIP blocking: Block traffic from entire countries behind your CDN, with real client-IP detection (Pro).
- Activity log: See exactly who tries to access your site and from where — searchable, filterable and paginated.
Simple, transparent pricing.
Every plan includes the full Scudo Security PRO feature set — you only choose how many sites your licence covers. 14-day money-back guarantee.
Personal
Perfect for a single blog or portfolio.
- 1 site license
- Everything in the free version, always included
- Custom firewall rules — your own allow and block rules
- GeoIP country blocking & CDN real-IP detection
- Advanced per-IP rate limiting
- Hide the login URL & lock down wp-admin
- Two-factor enforcement by role
- Compromised-password blocking (k-anonymity)
- Content-Security-Policy builder
- Email alerts & weekly security report
- Activity-log CSV export
- Configuration export & import
- Optional AI security advisor (your own API key)
Business PRO
For e-commerce and important business sites.
- 3 site licenses
- Everything in the free version, always included
- Custom firewall rules — your own allow and block rules
- GeoIP country blocking & CDN real-IP detection
- Advanced per-IP rate limiting
- Hide the login URL & lock down wp-admin
- Two-factor enforcement by role
- Compromised-password blocking (k-anonymity)
- Content-Security-Policy builder
- Email alerts & weekly security report
- Activity-log CSV export
- Configuration export & import
- Optional AI security advisor (your own API key)
Agency
For developers and web agencies.
- 20 site licenses
- Everything in the free version, always included
- Custom firewall rules — your own allow and block rules
- GeoIP country blocking & CDN real-IP detection
- Advanced per-IP rate limiting
- Hide the login URL & lock down wp-admin
- Two-factor enforcement by role
- Compromised-password blocking (k-anonymity)
- Content-Security-Policy builder
- Email alerts & weekly security report
- Activity-log CSV export
- Configuration export & import
- Optional AI security advisor (your own API key)
Not ready for Pro? Start with Scudo Security free.
The free edition on WordPress.org is fully functional on its own — web application firewall, malware & integrity scanning, brute-force protection, two-factor authentication, hardening and Safe-Mode recovery. No account, no time limit. Upgrade to Pro whenever you need the advanced layer.
Free forever · Upgrade to Pro anytime
Frequently Asked Questions
Ready to lock down your WordPress site?
Set up serious protection in minutes — then get back to running your business.
Get Scudo Security PRO Now14-day money-back guarantee. The free version needs no credit card.