What plugins are best for security?

Request
1

I just set up a new WordPress blog and need advice on security plugins. I know too many plugins can slow a site down, but are there any you’d say are really important for safety? Thanks!

2

I always use WordFence on my sites. It blocks unwanted login attempts and tracks logins by location. The free version is great. The only downside is the email notifications for updates—they can pile up if you manage multiple sites. Hopefully, they’ll add a way to turn these off completely.

3

@Brady
Hey, I’m the founder of WordFence. You can actually disable those alerts, and we have a tool called Wordfence Central to manage everything in one place. It’s free and really useful. We also have Wordfence CLI for advanced users—totally free and open source. Check it out on our website!

4

@Storm
I’ve been using WordFence for years but didn’t realize I could disable those notifications. Thanks for letting me know!

5

@Storm
Great service! Do you think you’ll ever offer a month-to-month pricing option?

6

@Storm
Thanks for the tip! I’ll check it out. When I first installed WordFence, there wasn’t an option to turn off the email reports. It’s good to know there’s one now.

7

@Storm
I’m new to this and haven’t used WordFence much. I’ve read that some plugins can change the login URL, but I heard WordFence doesn’t. Any plans to add that feature?

8

Harlan said:
@Storm
I’m new to this and haven’t used WordFence much. I’ve read that some plugins can change the login URL, but I heard WordFence doesn’t. Any plans to add that feature?

Changing the login URL is more about obscuring security than actually improving it. It can also cause issues with plugins or themes. Most hacks happen through plugin vulnerabilities, not logins. A good firewall, like ours, is the real defense.

9

@Storm
I tried WordFence because my site was hacked, but my host suggested Sitelock. I’ve read bad reviews about it, though.

10

@Storm
If you’re hosting WordPress, consider adding a firewall like NGINX or ModSecurity for better protection. It filters requests before they even reach WordPress.

11

@Storm
Got it. I thought it might help against brute force attacks. Thanks for explaining!

12

@Brady
You can turn off those email notifications in the settings.

13

Fable said:
@Brady
You can turn off those email notifications in the settings.

I tried that, but the emails didn’t stop, even when I adjusted all the alert levels.

14

Brady said:

Fable said:
@Brady
You can turn off those email notifications in the settings.

I tried that, but the emails didn’t stop, even when I adjusted all the alert levels.

Did you hit ‘save’ at the bottom of the page?

15

@Fable
Yep, I did.

16

Brady said:
@Fable
Yep, I did.

Feel free to post in our support forums for help. We’re happy to assist!

17

Brady said:
@Fable
Yep, I did.

That’s odd. I stopped using WordFence and now rely on Cloudflare. It’s been working fine for me.

18

Brady said:

Fable said:
@Brady
You can turn off those email notifications in the settings.

I tried that, but the emails didn’t stop, even when I adjusted all the alert levels.

You can disable specific alerts and reports in different sections of the settings. I manage a lot of sites and found these tweaks helpful.

19

Wordfence, Cloudflare, and a good host are all you need.