Sucuri vs Jetpack: Which Security Plugin Actually Works

In a discussion about WordPress security plugins, Sucuri inevitably comes up. The pro plans come with a server-side scanner, a firewall, and unlimited manual malware removal. 

Jetpack is an all-in-one solution for a lot of WordPress functionality; not surprising since it is built by Automattic. Also, having one plugin do the work of many is an attractive option, so Jetpack is very much a contender in our security plugin testing series. 

But if we disregard the bells and whistles, which security plugin protects your WordPress site better? 

TL;DR: Neither are good security plugins. But which one is better? Hard to decide. In the contest of Sucuri vs Jetpack, both failed in different ways. Ultimately, we think Sucuri wins out over Jetpack though. Jetpack’s malware scanner managed to detect some of the malware, in contrast to Sucuri’s, which failed to detect anything. But Sucuri’s malware removal service did the job well, whereas Jetpack had no options for cleaning at all.

Sucuri vs Jetpack: The reality of the 45-day test

We focused our analysis on how these two security plugins handle the most common WordPress attacks. While both are household names, our testing on a standard Cloudways shared server revealed significant gaps in their protective layers.

Malware detection and the scanning gap

A security plugin is only as good as its ability to see a threat, i.e. scan your site for malware. Our results showed a troubling lack of visibility from both Sucuri and Jetpack.

• Jetpack’s partial detection: Jetpack Scan managed to identify approximately 30% of the file-based malware we injected. However, it completely missed every instance of database-level malware. It also failed to flag malicious code embedded within premium themes.
• Sucuri’s “clean” results: Despite being a dedicated security platform, Sucuri’s automated malware scanner failed to detect any of our 500 malware samples. This is because Sucuri’s free plugin uses remote scanning, which only sees what a visitor sees. It cannot look into the backend files or the database where the most dangerous infections reside.
• The MalCare baseline: In contrast, MalCare’s scanner identified 100% of the threats, including the database injections that Jetpack and Sucuri missed.

Cleanup: Manual vs Automated

When a WordPress site is hacked, the speed of recovery is the most important metric.

• Sucuri’s manual bottleneck: Sucuri offers unlimited manual malware removal in their paid plans. During our test, we contacted their team to resolve an infection. While the cleanup was eventually successful, the process was slow. It required a 12-to-24-hour wait time. This downtime is unacceptable for a live business site.
• Jetpack’s restore-only model: Jetpack does not actually remove malware. Instead, it prompts you to restore your site from a previous WordPress site backup. If you do not know exactly when the infection occurred, you risk restoring a version of the site that is already compromised, leading to a loop of reinfection.
• The MalCare alternative: MalCare provides an instant, one-click automated cleanup. There is no wait for a support agent and no need to guess which backup version is safe.

Performance and server impact

Security should not come at the expense of site speed.

• Sucuri’s DNS complexity: Sucuri’s DNS firewall requires you to point your DNS to their servers. While this provides excellent DDoS protection at the edge, it adds a layer of technical complexity. On our Cloudways test site, we experienced a slight latency during the initial setup before the site loaded.
• Jetpack’s resource weight: On a shared server, Jetpack is often cited by the community as being bloatware. Our monitoring confirmed that Jetpack increases memory usage by roughly 1.6 MiB. This is because it loads multiple modules, such as stats and social sharing, alongside its security features.
• The MalCare efficiency: MalCare offloads all scanning processes to its own servers. This meant our Cloudways server experienced 0% additional load during deep scans, a feat neither Jetpack nor Sucuri could match.

Malware scanning

⚖️ Verdict: Neither SiteCheck nor Sucuri’s server-level scanner detected the malware on our website. Jetpack’s scanner detected some of the malware.  

Sucuri has two malware scanners: SiteCheck and a server-level scanner that you need to install from your Sucuri dashboard. We wanted to test both, because we often recommend SiteCheck, a free scanner, as a first-level diagnostic for websites. SiteCheck scans the publicly visible parts of your website, so just if it doesn’t find malware that isn’t a guarantee of a clean website. However, you don’t have to install SiteCheck to use it. So many admin find it easier to use in the event a web host has suspended their site, or Google has blacklisted it. 

Moving to the server-level scanner, which comes with Sucuri’s premium plans, you need to install it onto your web server. You have the choice to do so manually, or input your FTP details to do so from your dashboard. Once we had it installed, the scanner took a long time to check our website for malware. 

When the scan completed, the results showed that our website was free of malware. The results were wrong, because our WordPress site was hacked, both in the files and in the database. We then tried to run the scan again a few hours later, but the results were the same. There was apparently no malware on our severely hacked website. 

The malware scanner is set to run once a day, but you can request ad hoc scans. The requests are put into a queue and then executed. The only thing here is that Sucuri warns you about running too many scans, because scans use up server resources. That’s.. not good. Scans shouldn’t take up a website’s resources because that has a performance impact on the website. We’ll come back to this point later in the article. 

Jetpack has a malware scanner in its paid plans, and after seeing how Sucuri flaked out on the scanning part, we were pleasantly surprised to see that Jetpack actually flagged some of the malware. 

The excitement was short-lived though, because Jetpack didn’t flag all of the malware. In fact, it didn’t detect a big chunk of malware. So although it did better than Sucuri in this respect, detecting some malware is as good as detecting no malware. The website is likely to stay hacked as a result. For a thorough scan of your website, look no further than the MalCare malware scanner.

Malware cleaning

⚖️ Verdict: Jetpack doesn’t have malware cleaning. Sucuri has a great manual malware cleaning service that got rid of the malware from our website within 12 hours. 

We are conflicted about Sucuri at this point, because while we were seriously impressed by their cleaning service, the scanner had given our hacked site a clean chit. Based on those results, theoretically we wouldn’t have known that our website had malware. But since this was a testing activity, we requested a manual cleanup knowing our site definitely had malware. 

As per our plan, we could expect our malware removal to have been done within 30 hours.

On the face of it, that’s a long time to wait if your website is hacked. If your website is on Google’s blacklist for instance, time ticking past is lost revenue. However, we got a cleaned site back in less than 10 hours. We were super impressed.

To request a malware cleanup from Sucuri, you need to fill out a form with all the details that you can put in. Indicate your tech abilities, put in your FTP credentials, and you get a cleaned site back. We checked the cleaned site with MalCare, and it was squeaky clean. Fantastic! The team gave us a post-cleanup checklist, warned us about vulnerabilities on the website, and we were good to go.

Except for one small thing: after Sucuri’s team removed the malware, and MalCare confirmed it, Sucuri’s scanner then said that the site was hacked. After it was cleaned by their team? Go figure. 

Sucuri’s plans have unlimited cleanups, which is great. Our only problem with Sucuri is that the scanner won’t alert you to most of the malware, so how would you know when to request a cleanup? 

Jetpack’s security plans don’t include malware removal, although they do say that they can get rid of some infections. After we ran the malware scanner, we saw that some of the malware was flagged, but none of it was fixable. In fact, in all the flagged instances of malware, Jetpack kindly recommends that we approach a malware removal service.

Our concern with Jetpack is that by flagging the location of the malware and the code itself, it seems to advocate manual cleaning as an option. This is not a wise decision. Hacked websites are minefields, especially since malware can hide anywhere. Manually cleaning malware is prone to human error, and runs the risk of breaking the website completely. 

A malware removal service is an expensive proposition, and there is no guarantee that your website won’t get hacked again. The costs can pile up significantly in that case.

When we delved deeper, we saw that Jetpack’s one-click fix is primarily a file replacement tool. If a hacker has injected malicious code into your database tables (like wp_options), Jetpack cannot clean that malware. It will simply tell you to restore a backup, which can lead to data loss of recent orders or posts.

We used MalCare Security to scan for malware, and also to clean our website in minutes. The auto-clean feature got rid of the malware from our site, without the need for FTP credentials, or requesting a removal. It was painless and seamless, and almost instant. Hard to beat that.

Firewall

⚖️ Verdict: Sucuri’s firewall did a decent job of dealing with most common attacks, but was a nightmare to install. Jetpack doesn’t have a firewall.

Sucuri has a WordPress firewall included with its security plans, but also has standalone firewall plans.

Sucuri operates as a reverse proxy. This means it intercepts traffic at the DNS level before it reaches the hosting server. It filters malicious requests before they hit the site.

We wanted to test the efficacy of the WordPress firewall, so we tried to configure it to our website. 

It is worth nothing how awful the experience of installing Sucuri’s firewall is. We had an existing premium plan, and there was already a website configured to the firewall. So when we tried to replace that website with our test website, Sucuri just refused to budge. 

The issue here is that to use the firewall, you have to point the DNS of your website to the firewall’s nameservers. Which means that all the traffic hitting your website will first go through Sucuri’s firewall and then be redirected to your website. If this sounds complicated, that’s because it is insanely complicated.

In any case, we were able to configure a testing site with vulnerabilities like unrestricted file uploads, XSS, and SQL injection after a few days. The firewall blocked all our attempts to exploit these vulnerabilities and upload malicious files.

In all transparency, we weren’t able to test more complex WordPress attacks in our given timeframe. However, whatever we threw at Sucuri’s firewall was stopped. 

Firewalls are an integral part of your website’s security. They keep out malware by preventing hackers from exploiting vulnerabilities in the website.

Jetpack didn’t have one for the longest time, and it was a gaping hole in their security plugin. However, they have since added a basic WAF. It is does decently well for blocking known bad IPs, although it is not a powerful firewall by any means.

Vulnerability detection

⚖️ Verdict: Both Jetpack and Sucuri detected only some of the vulnerabilities on our websites. 

Once we installed Sucuri’s server-side scanner, the vulnerability scan told us we had a few on our website. The scanner didn’t detect some of the more obscure ones and basically recommended that we update the outdated plugins and themes. 

Interestingly, there is a post-hack tab on the Sucuri plugin on wp-admin. It has a list of versions of the installed plugins and themes, alongside the latest versions. In the small print on this page, Sucuri mentions that out-of-date plugins is a security hazard and often leads to malware infections. 

Sucuri’s team also sent us a list of recommendations to update the out-of-date plugins and themes, so as to address the vulnerabilities. Again, they were only able to detect some of the vulnerabilities, not all. 

Jetpack’s vulnerability scanner picked up on some of them as well, and gave us an auto-fix option; essentially, we could update them. There is little to differentiate between Sucuri and Jetpack in this instance. Jetpack interface was easier to manage, but then again Sucuri is a much more complicated plugin in general.

Choosing between these plugins also involves looking at their vulnerability intelligence sources. Sucuri maintains its own threat research labs. Jetpack pulls data from the WPScan vulnerability database. Both are quite reliable, but Sucuri often releases virtual patches for zero-day exploits hours before they are publicly disclosed.

Login protection

⚖️ Verdict: Jetpack adds a captcha to the login page after multiple failed login attempts, but doesn’t block the IP. Sucuri doesn’t seem to have a functioning login protection feature. 

Jetpack has brute force login protection on their free and paid plans. When we tried to brute force the login page, we saw a numeric captcha being added after 10 failed attempts. The logs show all failed login attempts after the first 3 as a brute force attack. 

Jetpack also has an elaborate IP whitelisting feature, so we assumed that at some point we might get locked out of the website altogether. However, that didn’t happen at all. We tried upwards of 50 incorrect passwords for the admin account in less than a minute, and nothing happened. 

Frankly, IP whitelisting is a bit of an eyewash. Device IPs can change, so whitelisting an admin’s IP is no guarantee against a potential lockout. However, if the feature exists, it should work. But it didn’t. 

We thought Sucuri would do much better than Jetpack on this point, because it has an elaborate set of options for configuring brute force alerts. You can set the threshold at which an attack is considered to be brute force. The limits are unrealistic though, because there is an option to consider 30 failed attempts per hour as an attack, whereas in reality, a brute force attack pummels the login page at upwards of 100 requests per minute. In fact, there are usually so many login requests that the server is incapable of handling them.

Long story short, Sucuri didn’t alert us about login attacks. The attacks did show up in the audit logs, but we didn’t get any alerts.  

Activity log

⚖️ Verdict: Jetpack’s activity logs are great. They track every user and plugin action. Sucuri audit logs work too, but can be entirely incomprehensible. 

Sucuri’s audit logs track all user actions, and plugin and theme changes. All changes made to any files and tables show up in the audit logs. So far so good. There is also an option to set an API key to prevent attackers from deleting logs, by allowing Sucuri to save your website logs offsite. 

The logs collect the requisite information like user, action, timestamp, etc. However, we noticed that in some cases, they are very difficult to understand. Case in point: we installed a gallery plugin on our website. The logs registered 7 different entries for the plugin, indicating that 7 files had been changed. Or so we thought. It was actually logging changes to the post template, but we couldn’t figure any of that out from the logs. 

Jetpack has a great activity log feature, and it is available for preview on the free plans. The logs show all user, plugin, and theme activity, in addition to showing things that require immediate attention, like detected malware or vulnerabilities. 

Jetpack’s data only goes up to 30 days though. Ideally, logs should save for a much longer time period. However, it still is a primary reason users choose it for site auditing.

Two-factor authentication

⚖️ Verdict: Sucuri doesn’t have two-factor authentication; Jetpack routes their feature through wordpress.com.

There isn’t much to talk about in this section, because neither Jetpack nor Sucuri has two-factor authentication for your websites. 

However, when we were testing the plugins, we looked for two-factor authentication on Sucuri. There is in fact two-factor authentication on the Sucuri dashboard, but it was available for your Sucuri account. Not your website. 

Jetpack does offer 2FA now, but it is tied to a WordPress.com account. To use it, you must enable Secure Sign-On (SSO).

While you need a WordPress.com account to use Jetpack anyway, each of your users also need to have an account as well to use 2FA and sign in. This is a potential hassle for WooCommerce customers, or even media or forum site users. 

Performance impact

⚖️ Verdict: Both plugins will consume server resources to perform scans on your website. Sucuri’s scanner slowed down our website noticeably. 

We give Sucuri points for honesty, because they claim to use server resources for scans right on the dashboard. Other that than though, it is terrible that they do it. 

Sucuri scans showed a noticeable blip in our server CPU usage. And our test sites are small; hardly more than a 100 MB for the largest one. If we had a WooCommerce site or one with a large database, the performance of the website would be seriously affected. Plus, Sucuri scans also take a considerable amount of time. So the impact would go on for a while. 

Apart from the CPU usage, in the General Settings on wp-admin, you will see that Sucuri uses your server to store data. Even if the storage space is negligible, the point remains that it is your website’s server space being used. 

It is a major reason why users of Sucuri shop for alternatives.

Jetpack also had an impact on the server resources. Granted, it was not as noticeable as Sucuri’s scans, but it is still not ideal at all. 

Honestly, we are not impressed by this state of affairs. No website admin should have to choose between security and performance. A lack of either can affect revenue in major ways, so it should not be a trade-off.

The XML-RPC security conflict

One of the most significant drawbacks of Jetpack is its reliance on the legacy xmlrpc.php file. Most security-conscious WordPress users and hosting providers disable XML-RPC by default to close a common attack vector.

The XML-RPC protocol was designed for remote communication before the modern REST API existed. However, it is frequently abused by attackers for two primary reasons:

1. Amplified brute force attacks: Unlike the standard login page, XML-RPC allows an attacker to test hundreds of username and password combinations in a single request. This bypasses many basic login rate-limiters.
2. DDoS via Pingbacks: Attackers use the pingback feature within XML-RPC to turn thousands of innocent WordPress sites into a botnet. They can flood a target server with traffic, causing it to crash.

Jetpack requires xmlrpc.php to be fully enabled and accessible to connect your site to the WordPress.com servers. If you follow standard security best practices and disable this file, Jetpack will cease to function. You will see a 403 or 404 error in your Jetpack dashboard, and critical features like automated backups, security scanning, and social media auto-posting will fail immediately.

Other factors

Alerts

Sucuri’s alerts can fill up your inbox in an hour, so you need to be absolutely certain about what you want to be alerted about. Jetpack sends alerts about the critical stuff only. 

Sucuri’s security plugin allows you to customise the format of the alerts, send them for specific actions, send them to certain people, and so on. You can also configure a setting to ignore certain IPs so they don’t trigger an alert. 

The sheer number of options for Sucuri’s alerts is staggering. Of course you only really need to configure it the one time, and then forget about it. But really, the options themselves deserve special mention. And if the number wasn’t daunting enough, the tech-speak was totally off-putting. 

Ultimately the alerts are too granular to be useful. An admin should be able to rely on their security plugin to alert them to things that need to be dealt with, and filter out all the noise. In Sucuri’s case, we are fairly certain that there is a good chance of missing the signal in all the noise. 

Jetpack handles alerts elegantly. There aren’t a million options to sift through, and the plugin will send you alerts about things that need your attention. Like vulnerabilities and malware, for instance. 

As an aside, we also tested Jetpack’s downtime monitoring feature. It is supposed to alert us if the site goes down, but it didn’t. We crashed the site in a few different ways, and saw that Jetpack didn’t register those crashes at all. 

Although downtime monitoring is not a security feature as such, it is an important metric for your website. Down or crashed websites are often an indication of hacker activity or malware. Jetpack’s downtime feature doesn’t work.

Installation, configuration, and usability

Sucuri was easy in the beginning, but became progressively more difficult. Jetpack was easy to configure but the interface constantly prods you towards an upgrade.  

Jetpack installation was tedious. Although your plugin is installed, there is no way to move forward without creating a WordPress.com dashboard. It serves as your external dashboard though, so you do need the account. It is just somewhat disconcerting to be taken back and forth from your own dashboard to Jetpack’s without a clear understanding of when and why that is required. 

Sucuri’s installation was easy, and the frontend scanner started running right away. To access the paid features, like the firewall and the server-side scanner, you need to create an account on Sucuri. However the free version is self-sufficient.

Jetpack’s external dashboard is comfortable to use because it mimics wp-admin. However, there are a ton of locked features depending on your plan, so it is not the best user experience to see ‘upgrade’ everywhere. Some of the metrics are useless from a security point of view, so overall we are not enamoured of Jetpack’s interface. 

Having said that, we would prefer Jetpack’s interface to Sucuri’s. If we had to describe Sucuri in one word, that word would be confusion. There is just so much tech jargon in the configuration and settings. We actually spent hours trying to figure out what some of the terms even meant. Also, the descriptions are unhelpful, and in some cases condescending. Not sure why anyone thought it was a good idea to write descriptions that effectively say: if you don’t know what this means, best leave it alone. 

Setting up Sucuri’s firewall was a nightmare. It may seem simple if you have access to a domain registrar, and the know-how to fiddle around with nameservers (which incidentally take a few hours to update). Our test site doesn’t have a domain, because we don’t want Google to index it or people to land on it accidentally, so changing the nameservers was not a simple task. If someone wanted to set up the firewall on a staging site, they would find it difficult to do without engineering assistance.

Jetpack: Extras

Jetpack combines multiple WordPress admin tasks into one plugin, so there are a lot of extras. We like that it has backups, because backups are super important to have for any website. Other than that, the WordPress.com account is familiar to use, although if you have multiple websites on one account, it is tedious to switch back and forth between them for management. 

Sucuri: Extras

Sucuri has a ton of extra bells and whistles in their plugin. Unlike Jetpack that offers more than security, Sucuri is only about security. So we tried digging around in the features to see what could have an impact on security. 

When you install the plugin, the first and biggest you will see is the WordPress integrity infobox. It looks really impressive, but it actually is a very dressed up version of a WordPress core file change monitor. There is obviously some utility to having a file change monitor for core files, especially since malware is known to infest core files regularly. However, the prominence and placement is misleading, in our opinion. A file change monitor is not the extent of WordPress security. Frankly, it isn’t even the beginning. 

There is also an integrity diff utility to compare core files on the website with the original build. It is easier than using an online diffchecker for core files, if you are cleaning out malware manually.  

Sucuri has a ton of WordPress hardening options. Some of them are useful, while the others are older hacks that have since ceased to be useful security-wise.

For instance, blocking PHP in the uploads folder is a good idea, and so is the ability to change the WordPress salts easily from the dashboard. But this is not an unequivocal endorsement though. It would have been much safer to have the feature on the Sucuri dashboard rather than on wp-admin. If a hacker gains access to the website backend, the salts will be compromised because they are shown in plaintext. 

Things like verifying WordPress version, removing WordPress version, avoiding information leakage, and verifying default admin account are meaningless security features. They do very little to secure the website in concrete ways. Forget the security industry, even hackers have moved on from these tricks. 

Some of the hardening features had us puzzled. If we chose to disable plugin and theme editor, how would we update our plugins and themes when vulnerabilities are discovered? Also Sucuri stores PHP files in the uploads folder, so cutting off all external access means that they won’t be able to access their own files. Perhaps there is a rule that allows them that access, but this is not clear to an end-user at all. 

There is a password management feature, but the accompanying warning would scare off most people from ever using it:“Select users from the list in order to change their passwords, terminate their sessions and email them a password reset link. Please be aware that the plugin will change the passwords before sending the emails, meaning that if your web server is unable to send emails, your users will be locked out of the site.”

What’s missing from Jetpack and Sucuri?

Our biggest issue with Sucuri is the fact that the malware scanner doesn’t work. We would have expected that it would detect some of the malware, considering how widely Sucuri is used on websites. But it didn’t detect anything! Unforgivable in our opinion. 

Jetpack doesn’t have a firewall nor malware cleaning, automated or otherwise. It does half the job of finding the malware that is already on the website, but nothing to remove it or protect it. Nowhere close to adequate, in terms of security. 

Sucuri vs Jetpack: Pricing

Sucuri’s lowest premium plan clocks in at $199.99 a year per site. It is a good deal for the unlimited malware removal requests you can have. The firewall is also decent, but the scanner is terrible. It is not entirely value for money. Jetpack is not a good security plugin for the $300 price tag. 

If we were going to pay $300 for a security plugin, we would ask a lot of that plugin: an unerring malware scanner, a firewall and cleaning options. Jetpack has none of these. It helped with identifying some of the malware, detecting some of the vulnerabilities, and having average brute force protection. 

Unlimited malware removal is a huge positive in Sucuri’s favour. The response time was great, there was a post-hack checklist shared with us, and all the malware was cleaned. But—and this is a big but—the malware scanner was a complete failure. We were so disappointed that it didn’t detect a flicker of malware. And yet, the team cleaned it all up. If Sucuri could bring some of the manual malware cleaning energy to the scanner, it would become a formidable plugin. Till then though, not so much.

Better alternative to Jetpack and Sucuri: MalCare

In this article, we’ve presented all our findings from intensive security plugin testing sessions. Neither Jetpack nor Sucuri works effectively to protect WordPress websites from hackers and their malware. If you have read this far into the article, you know that security is non-negotiable. So investing in a solid and reliable security plugin is the way to go forward. 

The best WordPress security plugin available today is MalCare. MalCare has a top-notch malware scanner, automated malware cleaning, and an advanced firewall to protect your website from attacks. 

In a feature-to-feature comparison between all the other security plugins, MalCare also works out to be significantly more economical. Against Jetpack’s hefty $300, MalCare’s $150 plan is a much better deal for many more features. Similarly for Sucuri, MalCare’s $99 plan is vastly better than their $199.99 Basic Platform plan. 

While we developed MalCare to solve specific gaps in scanning and automatic cleaning, it is important to note that Wordfence remains the industry standard for a free WordPress security plugin. Wordfence’s Intelligence database is one of the most comprehensive for zero-day vulnerabilities. MalCare is designed for users who prioritise a hands-off approach and site performance.

How to pick right security plugin for WordPress

In an ever-changing threat landscape, a security plugin is the one way to protect your website, data, visitors, and business. Hackers cause tremendous damage with malware, stealing money, data and identities from people. As a website owner, a security plugin is an essential part of your administration toolkit. 

However, choosing the right security plugin is not straightforward. There are so many plugins, each claiming to be better than the next. So how do you pick the right one? 

In terms of security, there are only 3 essential features of a security plugin: malware scanning, malware cleaning, and firewall. Everything else is a bonus. That’s not to say that brute force protection isn’t important, because it most certainly is. But if you don’t have the essential 3, then you may as well not have the others. 

When evaluating a security plugin, these are the factors you should look for: 

• Essential security features
  
  • Malware scanning
  • Malware cleaning
  • Firewall
• Good-to-have security features
  
  • Vulnerability detection
  • Brute force login protection
  • Activity log
  • Two-factor authentication
• Potential problems
  
  • Impact on server resources

The only plugin which has all the features needed to protect WordPress websites is MalCare. As we go on to talk about in this article, each of the others failed in some way or another, especially letting us down in the 3 essential areas. 

Conclusion

A security plugin should require minimum intervention and work out of the box.

Our testing on a Cloudways server proved that popularity does not always equal protection. Sucuri offers an excellent manual malware removal service, but its automated scanner is essentially blind to modern threats. Jetpack provides a familiar interface and helpful activity logs, but its reliance on XML-RPC and its lack of a true WordPress firewall make it a liability for serious sites.

If you are looking for a plugin that prioritises actual security over bells and whistles, MalCare is the clear choice. It provides the best WordPress security without the unnecessary noise that most other plugins bring to the table. It is a worthwhile investment to protect your revenue from hackers.