crackthe.net
Web security tools
Tools for people who run a website: WordPress security plugins, backups, and firewalls, with WordPress.org figures and CVE entries since 2021.
For people who run a website. Many flaws on the timeline, PHP2Shell among them, hit servers and websites. The tools below protect WordPress, keep backups, or filter attacks before they reach the server. Features are as the makers state them. This archive adds each plugin's figures from WordPress.org and its own CVE entries. More entries do not simply mean less safety, since popular plugins are examined more often. What counts is fast fixes and installed updates.
- Company
Inactiv.com Media Solutions Private Limited, India- Free plan
- no
- Free trial
- 7 days
- Open source
- partly
- WordPress.org
- 80,000+ active installations, rated 4.6 of 5
- Own CVE entries since 2021
- 1, in August 2026
- Says it keeps backups off your server, as “nine encrypted copies across two providers.”
- Lists backups every 24 hours kept 30 days (Personal), every 12 hours kept 90 days (Business), and hourly kept 365 days (WooCommerce).
- Company
BunnyWay d.o.o., Slovenia- Free plan
- no
- Free trial
- 14 days
- Open source
- no
- Lists the Basic tier of its Bunny Shield firewall as free: “the baseline WAF package, full DDoS protection, basic inspection features.”
- Says its firewall blocks “zero-day exploits, OWASP Top 10, and emerging risks,” with real-time logs.
- Custom firewall rules need the Advanced plan or higher; the CDN it runs on is billed by use, with a monthly minimum.
- Company
Cloudflare, Inc., United States- Free plan
- yes
- Open source
- no
- Says its free plan includes “Unmetered DDoS Protection,” a web application firewall, and the “Free Managed Ruleset.”
- Its documentation lists 5 custom firewall rules on Free, 20 on Pro, 100 on Business, and 1,000 on Enterprise.
- Says its PHP2Shell rules protected sites behind its free or paid firewall from October 21, 2026; it still advises patching PHP.
- Company
- Incsub, LLC, United States
- Free plan
- yes
- Money back
- 30 days
- Open source
- partly
- WordPress.org
- 80,000+ active installations, rated 4.8 of 5
- Own CVE entries since 2021
- 8, the latest in August 2026
- Free version includes a malware scanner that flags changed core files, known vulnerabilities, and suspicious code.
- Says the free “AntiBot Global Firewall” blocks harmful traffic and spam bots “with a single click.”
- Pro adds scheduled scans, reports, 24/7 live support, and AntiBot on every connected site.
- Company
- Automattic Inc., United States
- Free plan
- yes
- Money back
- 14 days
- Open source
- partly
- WordPress.org
- 3,000,000+ active installations, rated 3.7 of 5
- Own CVE entries since 2021
- 14, the latest in October 2026
- Free plan, for non-commercial sites per its FAQ: brute-force protection, downtime monitoring, an activity log, and a firewall with manual rules.
- Paid plans add real-time backups (50 GB or 1 TB), real-time malware scanning, and automatic firewall rules.
- Says backups are stored “redundantly on Jetpack servers in multiple locations around the globe.”
- Company
- Liquid Web, LLC, United States
- Free plan
- yes
- Money back
- 30 days
- Open source
- partly
- WordPress.org
- 700,000+ active installations, rated 4.6 of 5
- Own CVE entries since 2021
- 3, the latest in June 2024
- Formerly Solid Security and iThemes Security. Says the free version checks core, plugins, and themes for known vulnerabilities four times a day.
- Free two-factor login works with apps “like Authy and Google Authenticator,” email, and backup codes, plus brute-force protection.
- Pro adds “automated virtual patching of some vulnerabilities” through Patchstack.
- Company
- Inactiv.com Media Solutions Private Limited, India
- Free plan
- yes
- Open source
- partly
- WordPress.org
- 100,000+ active installations, rated 4.4 of 5
- Own CVE entries since 2021
- 2, the latest in September 2026
- Free plan: “malware scan every 7 days, vulnerability alerts, basic firewall, login protection”; it flags malware but does not remove it.
- Says it copies your site's files to its own servers and scans them there; storage in the EU is “on request.”
- Paid plans add an advanced firewall, virtual patching, and daily scans; the higher plans also clean up malware.
- Company
Patchstack OÜ, Estonia- Free plan
- yes
- Free trial
- 30 days
- Open source
- partly
- WordPress.org
- 100,000+ active installations, rated 4.8 of 5
- Own CVE entries since 2021
- none found
- Free plan: email alerts about vulnerable core, plugin, and theme versions on up to three sites; “the free version does not include a firewall.”
- Says its paid protection rules work “a lot like a WAF” but run “within the website itself.”
- Claims protection “up to 48h before public disclosure” of a vulnerability.
- Company
- GoDaddy Media Temple, Inc. d/b/a Sucuri, United States
- Free plan
- yes
- Money back
- 30 days
- Open source
- partly
- WordPress.org
- 600,000+ active installations, rated 4.2 of 5
- Own CVE entries since 2021
- 2, the latest in August 2026
- Says its cloud firewall blocks “layer 3, 4, and 7 DDoS attacks” and brute-force attacks; you switch it on by changing your DNS records.
- Says every platform plan includes unlimited manual malware cleanups, server-side scanning, and blocklist monitoring.
- Free WordPress plugin: activity log, file integrity monitoring, remote malware scan, and hardening; the firewall is not part of it.
- Company
Updraft WP Software Ltd, United Kingdom- Free plan
- yes
- Open source
- partly
- WordPress.org
- 4,000,000+ active installations, rated 4.8 of 5
- Own CVE entries since 2021
- 12, the latest in September 2026
- Free version: scheduled backups from every 2 hours to monthly, restored “in just a few clicks.”
- Free version backs up to Dropbox, Google Drive, Amazon S3, FTP, email, and other storage.
- Premium adds database encryption, incremental backups, automatic backups before updates, and its own UpdraftVault storage on Amazon AWS.
- Company
- Defiant, Inc., United States
- Free plan
- yes
- Open source
- yes
- WordPress.org
- 5,000,000+ active installations, rated 4.7 of 5
- Own CVE entries since 2021
- 1, in September 2022
- Says its firewall runs inside WordPress (“at the endpoint”) and its scanner checks core, theme, and plugin files for malware and backdoors.
- In the free version, firewall rules and malware signatures arrive “delayed by 30 days”; Premium gets them in real time.
- Lists passkeys, two-factor login, a login CAPTCHA, and blocking passwords known from leaks, none of them marked Premium.