Our firewall blocksattacks before your siteruns them.

Every request is checked before WordPress executes anything — against rules learned from attacks on 400,000+ sites, usually before the same attack ever reaches you. Zero configuration, zero load on your server.

Protect my site →How it works
2B+ blocked / mo/18B+ analyzed / mo/0 config
Trusted by 400,000+ sites · 120 countries

The firewall sees every request
before WordPress does.

MalCare’s firewall loads ahead of WordPress, so it sees every request first. Attacks get a 403 before a single line of your site’s code runs.

Each request is checked against

  1. 01

    WordPress-specific rules

    Written for the way WordPress plugins and themes are actually attacked.

  2. 02

    Known attack signatures

    Payloads that have already been used in real attacks.

  3. 03

    Network behavior signals

    How the sender has behaved across 400,000+ sites.

Why it matters: 95% of hacked WordPress sites were hacked through a vulnerable plugin or theme. The firewall stops the request before that code can run.

What the firewall blocks:
OWASP Top 10, then WordPress.

Generic firewalls run generic rules, so WordPress-specific attacks get through. MalCare’s rules are written only for WordPress.

Beyond the OWASP list

WordPress-specific rules

Attack patterns aimed at WordPress itself — the ones a generic rule set doesn’t describe.

  • Plugin & theme codeExploits aimed at known-vulnerable versions
  • admin-ajax.phpCrafted actions sent to plugin handlers
  • /wp-json/Abuse of REST API routes
  • wp-login.php · xmlrpc.phpPassword guessing and login floods
OWASP Top 10 threat classes10 of 10 covered
  1. 01
    InjectionSQL, command and code injection
  2. 02
    Broken access controlPrivilege and path abuse
  3. 03
    Cross-site scriptingStored and reflected XSS
  4. 04
    Insecure designAbusable flows and logic
  5. 05
    Security misconfigurationExposed surfaces
  6. 06
    Vulnerable componentsPlugin and theme exploits
  7. 07
    Authentication failuresCredential attacks
  8. 08
    Integrity failuresTampered updates and data
  9. 09
    Logging & monitoring gapsSecurity events kept on the record
  10. 10
    Server-side request forgerySSRF patterns

An attack on one site becomes
a firewall rule on yours.

400,000+ sites share one firewall network. When one of them is attacked, MalCare turns that attack into a rule for every site — usually before it reaches you.

2B+attacks blocked across the network every month

18B+requests analyzed every month

400,000+sites whose firewalls share what they see

Monthly figures as of July 2026

A firewall inside your site.
Heavy lifting on our servers.

Because it’s part of WordPress, there’s no side door to find. Because MalCare’s servers do the heavy lifting, your site keeps serving customers.

No way around it.

A cloud firewall sits in front of your server, and anyone who finds the server’s real address can go straight past it. MalCare’s firewall is part of your site, so every request goes through it.

Up to 70% lighter server load.

Bot floods are turned away before WordPress loads, and the analysis runs on MalCare’s servers. It’s the only security plugin that makes your site faster.

Five more firewall layers.
All included.

The core firewall checks every request. These five extend it, with the same network, the same dashboard and no extra cost.

  1. 01Vulnerability ShieldPatches a plugin or theme flaw the day it’s disclosed — before you can update.Acts onKnown plugin & theme flaws
  2. 02Atomic SecurityAdds rules made for your site, against flaws nobody has found yet.Acts onYour site’s own setup
  3. 03Bot ProtectionBlocks bad bots. Search engines and other good bots always get through.Acts onAutomated traffic
  4. 04GeoblockingBlocks traffic from countries you don’t do business with.Acts onCountry of origin
  5. 05Login ProtectionLogin limits, captcha and built-in 2FA on the login form and XML-RPC.Acts onwp-login.php · xmlrpc.php

A zero-config firewall.
Real visitors get through.

MalCare reads your site and sets up the firewall when you connect. After that, it keeps itself up to date.

  • Sets itself up when you connect your site — no rules to write
  • No maintenance — new rules arrive from the network on their own
  • Real visitors, search engines and your integrations get through
  • Every blocked request is logged in your dashboard

In their words. Hundreds of attacks, quietly stopped.

Rated 5 out of 5
MalCare sends few security notifications, so one day out of curiosity I checked their firewall section. I was pleasantly surprised that hundreds of attacks were being quietly thwarted! I really like this 'strong & silent' protection.
Jo WalthamCallia Web
Rated 5 out of 5
I was on the beach with my family when MalCare notified me of a plugin vulnerability across 50 of my sites. With one click on my smartphone, all sites were fixed within minutes.
Paul LaceyWordPress expert
Rated 5 out of 5
I had been running iThemes, WordFence & Sucuri, but they kept getting hacked. Then I installed MalCare, which quickly found the malware and cleaned up the entire site.
Adam SilverFounder · ConciergeWP

Firewall questions, answered.

Comparing firewalls? A security expert will tell you what MalCare blocks that your current setup doesn’t.

Yes. Updates only fix flaws that are already known, and only once you install them. Attacks arrive whenever they like — and 95% of hacked WordPress sites were hacked through a vulnerable plugin or theme, not a password. The firewall blocks those attacks in the gap.
Three ways. WAFs such as Cloudflare have generic rules which allow most attacks to pass through; MalCare's rules are built only for WordPress. A cloud WAF sits in front of your site and can be skipped by anyone who finds your server's real address; MalCare's firewall is part of your site, so there is nothing to skip. And there is nothing to configure.
No. The work on your server is light — MalCare servers do all the heavy lifting so your site will only be serving customers. Because the firewall turns away bot floods, server load can drop by up to 70%.
Not by going around it. The firewall runs inside your site, so every request that reaches WordPress passes through it. There is no separate address to find.
It's built not to. Blocking a real customer costs you more than most attacks, so false positives are designed out. Search engines, good bots, APIs and your integrations are recognized and let through.
The OWASP Top 10 threat classes, WordPress-specific exploit patterns against vulnerable plugins and themes, bot floods, and login attacks — plus virtual patching, site-specific atomic rules, geoblocking, and login protection.
No. The firewall sets itself up when you connect your site, and new rules arrive continuously from the 400,000+ site network. There is nothing to tune.
Included — along with every specialist layer on this page. One plugin, one dashboard, every plan.

Turn on the firewall. There’s nothing to configure.

Connect your site and MalCare’s firewall sets itself up — WordPress-specific rules, updated from 400,000+ sites, included in every plan.

Protect my site →Talk to an expert
Sets itself up/No way around it/Included in every plan