WordPress security plugins: what they can and cannot do

Where a security plugin works and where a cloud firewall works, what Wordfence and Sucuri state, their WordPress.org figures and CVE entries.

Key points

A security plugin runs inside WordPress. A cloud firewall filters requests before they reach your server. They do different jobs.
The two security plugins listed here are Wordfence, with 5,000,000+ active installs on WordPress.org, and Sucuri, with 600,000+.
No plugin replaces updates. Security plugins have flaws too and need updates like any other plugin.

Two places to stop an attack

Inside WordPress: a security plugin checks requests after they have reached your server. Wordfence says its firewall runs inside WordPress, “at the endpoint.” Every request still reaches your server and starts PHP.

In front of your server: a cloud firewall receives the traffic first and passes on only what it lets through. You switch it on by changing your domain’s DNS records. Sucuri’s firewall works this way, and so does Cloudflare’s. Attacks it blocks never reach your server.

What the makers state

	Wordfence	Sucuri
Firewall	runs inside WordPress	runs in front of your server, not part of the free plugin
Free version	yes; firewall rules and malware signatures arrive “delayed by 30 days,” Premium gets them in real time	yes: activity log, file integrity monitoring, remote malware scan, and hardening
Login protection	passkeys, two-factor login, a login CAPTCHA, and blocking passwords known from leaks, none marked as Premium	the cloud firewall blocks brute-force attacks
Cleanup after a hack	not stated	every platform plan includes unlimited manual malware cleanups

The table shows what the makers state on their own pages. This site has not tested the plugins.

What this archive collected

	Wordfence	Sucuri
Active installs on WordPress.org	5,000,000+	600,000+
Rating on WordPress.org	4.7 of 5	4.2 of 5
Own CVE entries since 2021	1	2
Newest entry	September 2022	August 2026

What a security plugin cannot do

It cannot fix a flaw in another plugin. It can only block known attack patterns until you install the fix. How fast it gets new rules matters: according to Wordfence, its free version gets them 30 days after Premium. Patchstack measured that heavily exploited flaws in WordPress software were first attacked about five hours after they became public.

It cannot protect you if it is outdated itself. The table above shows that security plugins have CVE entries too.

It does not replace backups. If an attack gets through, only a backup brings your site back. The guide WordPress backups: set them up and test them explains how.

How to choose

Start with updates, strong logins, and backups. No plugin replaces them.
Add a security plugin if you want a malware scanner and login protection inside WordPress.
Add a cloud firewall if you want attacks blocked before they reach your server. It needs a change of your DNS records.
Check how fast new rules arrive in the version you use, free or paid.
Keep the security plugin itself up to date.

Next step

The page Web security tools lists both plugins and the firewalls with what their makers state.

The figures in this guide come from the archive and change with every data update. As of November 13, 2026.

WordPress security plugins: what they do and what they cannot do