8 Free Plugins That Close the Holes in a WordPress Site

The reason a small site gets compromised is rarely a clever attack. It is one of four things: a password that is also used somewhere else, a plugin that has been abandoned with a known vulnerability in it, a PHP file sitting in the uploads directory, or an XML-RPC endpoint left open so that a script can try ten thousand passwords without tripping anything. Every one of those has a free defence, and the defences are in different plugins.

So the useful way to read a security plugin list is not by feature count. It is by hole. Each of the eight below is here because it closes one specific hole, with the version, last-updated date and install count from its wordpress.org listing on 2026-10-16. Several of them overlap, which means installing all eight is a mistake. The last section says which three or four to run.

Wordfence closes the request path, and the free tier pays for it in delay

Wordfence is 9.0.2, published 2026-09-30, with more than five million active installations and 5,025 reviews averaging 94%. It runs at the point where the request arrives, which is why it is the one plugin on this list that can stop an exploit before the vulnerable code executes: the web application firewall inspects the request, the scanner compares core and plugin files against known signatures, and the login security module adds passkeys and time-based one-time-password two factor. The live traffic view is the part people underrate, because it answers the question "was that 500 an attacker or a plugin" in one screen.

Where it stops being enough: the free tier's firewall rules and malware signatures are delayed by 30 days, which its own readme states plainly. For a newly disclosed vulnerability in a plugin you run, a 30-day delay is the difference between protected and compromised, and the real-time feed is a paid feature. It also cannot protect a plugin that is already unpatched if the exploit looks like a normal request.

Sucuri's free plugin watches files rather than traffic, and that is the useful half

Sucuri Security is 2.8.1, published 2026-10-14, with around 600,000 active installations and 384 reviews averaging 84%, the lowest rating in this list. The free plugin does four things: it logs security events, it monitors file integrity and tells you when a file changes, it monitors whether the domain is on a blocklist, and it offers hardening switches for the usual weak defaults. The remote malware scanner uses the vendor's SiteCheck service and does not require a paid subscription.

Where it stops being enough: the web application firewall is part of a separate paid product, not this plugin, so the free download is monitoring and cleanup rather than prevention. It also needs an API key from the vendor to activate event monitoring, which means your site talks to Sucuri's service whether or not you ever pay. If you already run Wordfence, the file integrity check is the only unique part, and it is worth having on a site where a modified theme file would otherwise go unnoticed for months.

Really Simple Security is 9.8.3, published 2026-09-15, with more than three million active installations and 8,868 reviews averaging 98%, the highest rating here. Its job is the unglamorous half: force HTTPS and redirect the HTTP version, set secure cookies, stop PHP files in the uploads directory from executing, disable XML-RPC, turn off user enumeration, and add two-factor authentication by email with the option to require it for specific roles.

Where it stops being enough: the readme lists time-based one-time-password 2FA as a Pro feature, so the free tier's second factor is a code sent by email. Email codes are much better than nothing and worse than an authenticator app, because the mailbox becomes the second factor and a compromised mailbox defeats both. Its vulnerability detection is also a scanner, not a firewall: it will tell you a plugin has a known problem, and it will not block the request that exploits it.

Three plugins deal with credentials, and they do different jobs

Limit Login Attempts Security, the brute force half, is 3.3.10, published 2026-09-23, with around a million active installations and 1,487 reviews averaging 96%. Its readme has a section headed "Features Included in the Free Version" that lists built-in two-factor authentication and a login firewall, which is unusually generous. By default WordPress will let an automated script try passwords as fast as the server can answer, and xmlrpc.php lets it try many passwords in a single request. This plugin limits failed attempts by IP and by username, blocks the offending address for a period you set, and secures the login and XML-RPC paths.

Where it stops being enough: local lockouts are trivially defeated by an attacker with a pool of addresses, because each new address gets a fresh set of attempts. The vendor's cloud-based protection, which correlates attacks across sites, is the paid tier; the free plugin is doing the work one server can do alone. On a site behind a proxy or a CDN, check that the plugin is reading the real client address rather than the proxy's, or you will lock out your own visitors.

For the second factor itself, the Two Factor plugin is 0.17.0, published 2026-09-28, with around 100,000 active installations and 208 reviews averaging 96%. It is maintained by the WordPress.org team, it supports authenticator apps over TOTP, email codes and ten single-use backup codes, and it is small enough to read. Of everything on this list it is the one that most reliably stops a real breach, because the most common way a small site is taken over is a password that leaked from somewhere else.

Where the free options stop being enough: the Two Factor plugin does not enforce itself. Each user configures it from their own profile, and it requires WordPress 7.0 or newer, so the one account nobody chased is the account that gets used. Enforcement by role is available in Really Simple Security and Wordfence instead. What you lose by using the standalone plugin is the policy, not the mechanism.

Two plugins cover the questions you ask after the fact

WP Activity Log is 5.6.7, published 2026-09-23, with around 300,000 active installations and 488 reviews averaging 94%. It records logins and failed logins, user creation and role changes, plugin and theme installation, and content changes, with the value before and after. That is the difference between "the site was defaced on Tuesday" and "user X changed the administrator's email address at 02:14 and then installed a plugin". The value of a log is almost entirely in the timeline it gives you after something has gone wrong.

Where it stops being enough: real-time alerts, report exports and session management are premium features, so the free tier is a log you have to remember to read. It also writes a lot of rows, and on a busy site the log table is the one that grows fastest. Decide up front whether you are keeping 30 or 90 days and configure that, or you will be deleting a million rows with a maintenance plugin in six months.

Patchstack, the second, is 2.3.7, published 2026-07-28, with around 70,000 active installations and 61 reviews averaging 98%. It exists for the hole that no firewall can close well: a vulnerability that is disclosed and fixed in a plugin version you have not installed yet. The free tier gives up to 48-hour early warning of new vulnerabilities and can automatically update the affected plugin, which is the part that matters at three in the morning when nobody is watching the dashboard. It also reports on core and theme vulnerabilities.

Where it stops being enough: automatic updating is a two-edged tool, and a plugin update that breaks a checkout at midnight is its own incident. Test that behaviour on a staging copy before turning it on for everything. And the feature that patched vulnerabilities without updating, the virtual patches, is the paid tier; the free plugin's honest answer to a vulnerable plugin is "update it now".

Kadence Security is a checklist, and checklists catch what you forgot

Kadence Security is 10.0.6, published 2026-10-14, with around 700,000 active installations and 3,992 reviews averaging 92%. It was iThemes Security, then Solid Security, and the slug is still better-wp-security, so older guides find the right plugin under the wrong name. What it offers is a set of hardening decisions made once: file change detection, brute force protection with a network of other sites feeding it, a password policy, site templates that apply a sensible configuration for a shop or a blog, and two-factor authentication. Its strength is that it walks you through the list instead of leaving you to remember it.

Where it stops being enough: a checklist applied without reading it creates its own problems. The feature that changes the login URL breaks other plugins, your own bookmarks and any documentation you have given a client. Password policies lock out the account that was fine yesterday. Apply one setting at a time and test the login page from a private window after each one, unless you enjoy locking yourself out of your own site.

What none of these eight fixes, and the three or four to install

No plugin here fixes a weak password that a user chooses anyway. None of them fixes a theme with a backdoor, a developer's SSH key on a laptop that gets stolen, or credential reuse across the photographer's email account and the site. Backups are the other omission: everything in this list is about preventing an incident, and a backup is what you have when prevention fails. A WordPress security stack without a backup is a plan for a bad afternoon.

They also do not stop each other from causing trouble. Two firewall plugins will both inspect the same request and both write their own rules. Two login limiters can lock out the same user twice. Two activity logs double the rows. The useful configuration on a small site is three or four: one firewall and scanner, one login protection layer, one two-factor plugin, and one vulnerability alert. If you want a single decision, that is Wordfence for the firewall and login layer, Two Factor for the second factor, and Patchstack for the disclosure alerts.

Monday: four commands' worth of work, in order

Before any of the eight, know who can administer the site. The administrator list is the thing that changes without anyone telling you, and it is the first surprise on most sites.

1. Find out who can administer the site. The query below lists every account, which is usually the first surprise.
2. Turn on two-factor for those accounts, starting with the one you log in with. Do not skip the backup codes.
3. Install one firewall, then install Patchstack and enable automatic updates for the plugins nothing else depends on. Leave the rest manual.
4. Run the hardening switches one at a time and test the login page after each change.
5. Confirm that you have a backup you have actually restored from. A backup nobody has tested is a hope.

SELECT u.ID, u.user_login, u.user_email, u.user_registered,
       IF( m.meta_value LIKE '%administrator%', 'yes', 'no' ) AS is_admin
FROM wp_users AS u
LEFT JOIN wp_usermeta AS m
       ON m.user_id = u.ID
      AND m.meta_key LIKE '%capabilities'
ORDER BY is_admin DESC, u.user_registered ASC;

That query is worth running once a year even on a site you built, because the administrator list is the thing that changes without anyone telling you. Everything else on this list is automation around a decision somebody has to make: who has access, what is updated automatically, and what happens if it all goes wrong anyway. Paid WordPress security: what you are actually paying for takes the same eight holes and looks at which paid tiers change the answer, and which ones sell a dashboard you will never open.