WordPress Security Plugins Compared: What Each Type Actually Does
“WordPress security plugin” describes at least four different products. Installing two of the same type gives you overlap and conflicts; installing one type and assuming you are covered gives you a gap.
The four types
Firewalls (WAF) — inspect incoming traffic and block requests matching known attack patterns. Good at buying time before you patch. They do not tell you what is installed, and rules for a brand-new flaw arrive after the flaw does.
Malware scanners — compare files against known-good versions and signatures. Good at finding a compromise after the fact. They tell you nothing about a vulnerable-but-not-yet-exploited plugin.
Backup tools — the only category that reliably saves you when everything else fails. Not prevention; recovery. Untested backups are not backups.
Vulnerability monitors — inventory your components and compare versions against published records. Tell you what to fix before anything happens. They do not block traffic and do not clean infections. This is what WPDeeply Risk Monitor is.
A sensible minimum
Backups that leave the server and have been restored at least once.
Vulnerability monitoring, so patching is driven by facts rather than by the update badge.
Two-factor authentication on administrators.
A firewall at the CDN or host level if you are a plausible target, or run a store.
What not to do
Do not run two firewalls, or two malware scanners. They conflict, and the performance cost is real.
Do not treat a security plugin as a substitute for updating. Nearly every compromise involves software with a fix already available.
Do not forget that a security plugin is also code with vulnerabilities — Loginizer is the standing example.
Hardening reduces the damage. Patching removes the hole. Scan your site free to see what still needs patching.
