Kadence Security Pro helps you manage WordPress security from a live dashboard. Review brute force attacks, banned visitors, active lockouts, scan results, and user security statistics in one place. Its controls address common attack methods, though no add-on can prevent every possible attack.

Set access rules for your site and its users

Choose a setup template for an ecommerce, network, non-profit, blog, portfolio, or brochure site. User groups let you set various requirements for clients, customers, administrators, and other users. For example, you can require two-factor authentication for clients or set password rules for customer accounts.

• Two-factor authentication: Require a security code alongside a password. Users can receive codes through apps such as Authy or Google Authenticator, email, or backup codes.
• Password requirements: Create and enforce a password policy for user accounts.
• reCAPTCHA: Help deter bots that try compromised passwords, post spam, or scrape content.
• Passwordless logins: Let users log in with a click while retaining two-factor authentication and strong password controls.
• Trusted Devices: Identify approved devices to help limit session hijacking, and restrict Administrator privileges to trusted devices.
• Magic Links: Let users log in when their username is locked out by Local Brute Force Protection.
• Privilege Escalation: Grant temporary administrator-level access.

Scan for vulnerabilities and manage updates

The Site Scanner checks WordPress core documents, plugins, and themes for known vulnerabilities. Pro scans can execute hourly. The scanner also checks Google Safe Browsing blocklist status and alerts you if malware is reported for your site.

Patchstack integration can automatically apply fixes for some vulnerabilities, including cases where a plugin or theme developer has not yet issued a patch. Kadence Security uses the Patchstack Priority score to assess risk based on the likelihood of exploitation and potential impact on your site.

Version Management can automatically update WordPress, add-ons, and themes when configured. It also includes options for hardening a site running outdated software and scanning for old websites.

Review activity and use security tools

User Logging records events such as logins and logouts, registrations, plugin additions or removals, theme changes, and edits to posts and pages. File Change Detection logs changes to site files. The dashboard brings these records and scan information together for review.

• Brute force protection and lockouts: Local and network protection can block common login attacks. You can also ban repeat offenders.
• Enforce SSL: Require site connections to use SSL/TLS.
• Database Backups: Create and email scheduled WordPress database backups. These do not back up the complete site.
• Geolocation: Connect Trusted Devices to an external location or mapping API.
• Additional controls: Identify server IPs, check file permissions, change the first WordPress user ID or database prefix, review generated server and wp-config.php rules, rotate WordPress salts, and change the login URL.

Check requirements before setup

Kadence Security requires an Apache or LiteSpeed server with mod_rewrite, or NGINX. It can make significant changes to site files and the database, so make a complete backup before applying functions to an existing site. The plugin's database backup tool does not replace a full site backup.