The most-installed security plugin, and its free version genuinely does three useful things: an endpoint firewall, a malware scanner that compares core, theme and plugin files against known-good copies, and redundant login protection.

The file comparison is the part that ages well. Checking whether your WordPress files differ from the official versions does not depend on signature freshness, and it catches a large share of file-based infections regardless of what is circulating this week. What ages badly is the signature-driven half: new firewall rules and malware signatures arrive 30 days after Premium, which is the gap described above. Run it, use it as an early-warning system, and understand that a currently circulating variant may be invisible to it for a month. Premium is $149 a year per site when you decide to close that gap.

• Free covers: Endpoint firewall, file comparison scanning, login protection
• The gap: Rules and signatures lag Premium by 30 days
• Best for: Detection and login hardening on any site
• Upgrade: $149 a year per site for real-time intelligence

Free, small, and the highest-value five minutes available if you currently have nothing. It caps failed logins from an address and locks it out, which defeats automated brute-force attacks outright.

Crucially, this protection does not depend on threat intelligence at all, so there is no free-tier gap to worry about. What it does not address is credential stuffing, where an attacker tries one already-correct password per account from a breach dump and never generates enough failures to trigger a lockout. That distinction is why this belongs alongside two-factor authentication rather than instead of it. Install it, and stop worrying about the login noise in your logs.

• Free covers: Rate limiting and lockouts against brute force
• The gap: Little effect against credential stuffing
• Best for: Every site, as a first measure
• Upgrade: Not needed; pair with two-factor instead

Two free plugins that together put passkeys on a WordPress site, which is the strongest authentication method available and the only one that is phishing-resistant by design.

This is the item on the list where free is not a compromise at all. WP 2FA puts passkeys in its premium tier; this combination provides them for nothing, because Two Factor is community-maintained, currently at version 0.16.0 released in March 2026, and the WebAuthn Provider plugin extends it with FIDO2 and hardware key support. A cryptographic key that never leaves the device and is bound to your domain cannot be captured by a fake login page, which is a categorical improvement rather than an incremental one. What you give up is role enforcement, onboarding flows and support, none of which affects the protection itself.

• Free covers: Passkeys, WebAuthn, FIDO2 hardware keys, app codes
• The gap: No role enforcement or user onboarding flow
• Best for: Everyone; this is best-in-class and free
• Upgrade: WP 2FA if you must enforce it across many users

A free plan providing an edge firewall, rate limiting, bot filtering and a CDN, sitting in front of your site so hostile traffic never reaches your server. Most sites either do not use it or use it without turning the security features on.

Its strength is the layer it occupies. An endpoint plugin filters requests after WordPress has started; an edge service filters them before your host is involved at all, which also means the junk traffic stops consuming your resources. It absorbs volumetric attacks that would otherwise take the site down and makes the site faster as a side effect. Its limitation is specificity: generic managed rules do not know that a particular form plugin disclosed a flaw on Thursday, and Patchstack’s 2026 research found hosting-layer defences block only a fraction of exploits. Treat it as an excellent free layer, not as coverage.

• Free covers: Edge firewall, rate limiting, bot filtering, CDN
• The gap: Generic rules, not per-vulnerability intelligence
• Best for: Every site, as a free first layer
• Upgrade: Paid tiers add managed rule sets and controls

Two established free plugins covering the hardening layer: login protection, user role controls, file change detection, and the various configuration adjustments that reduce exposure without depending on threat intelligence.

Hardening is the underrated half of free security. Blocking user enumeration, disabling the theme and plugin file editor, restricting XML-RPC where nothing uses it, and enforcing sensible password policies are all permanent improvements that no signature delay affects. Both plugins bundle these behind sensible defaults, which is worth more than the individual settings because it means they actually get applied. Do not run two of them, or either alongside another firewall plugin: overlapping request filters conflict, slow the site, and produce confusing failures.

• Free covers: Hardening, login controls, file change detection
• The gap: Not a substitute for vulnerability intelligence
• Best for: Applying good defaults without configuring each one
• Upgrade: Paid tiers add patching and reporting

Free, requires no installation, and reduces risk more than anything else on this list. Plugins accounted for 91% of the 11,334 WordPress vulnerabilities disclosed in 2025, with just two found in core.

That statistic makes the arithmetic simple. Every plugin you remove is a proportional reduction in your exposure, permanently, with no subscription and no configuration. Deactivated plugins count, because their files remain on disk and remain exploitable. Then turn on automatic updates, which is the actual fix rather than a mitigation, and pair them with an off-site backup so a bad update is an inconvenience. A site running twelve well-maintained plugins with automatic updates is in a materially better position than one running thirty with a paid firewall, and the first arrangement is free.

• Free covers: The 91% of risk that lives in plugins
• The gap: None; this is the real fix, not a mitigation
• Best for: Every site, before installing anything
• Upgrade: Not applicable; just do it this afternoon