Security scans with guided fixes

SecuPress Pro automates recurring security work and provides tools to review a WordPress website's defenses. Its scanner checks 35 security points in about five minutes, then gives the site a security grade and a report of findings. You can select many suggested fixes with a checkbox. When a change needs your decision, the plugin asks before proceeding. Export the analysis as a PDF to share with clients or colleagues.

Three scheduled tasks cover routine checks: a security scan that emails a report of actions to consider, a backup of the database and files that you can download, and malware scans at regular intervals.

Account and login controls

Login protections address repeated or suspicious attempts. SecuPress can limit bad login attempts, protect against password spraying, ban attempts using non-existing usernames, and set a non-login time slot. It also controls visitor sessions and adds two-factor authentication.

• Set password lifetimes and require strong passwords.
• Forbid vague usernames such as www or admin.
• Move the WordPress login page with the included Move Login capability.

Checks for components and files

Plugin and theme checks look for vulnerable components or files tampered with to contain malicious code. When a vulnerable plugin or theme is found, SecuPress can send an email alert and display a warning in WordPress. Its malware scanner checks for bad files in FTP and dangerous files in the uploads folder, and looks for potential phishing attempts through index.php loads.

Additional controls can limit plugin activation, deactivation, installation, and removal on a live site, and lock down plugin and theme uploads through ZIP files. Security alarms hosted on SecuPress servers provide daily data about recently vulnerable extensions and themes.

Firewall and traffic controls

Firewall functions block malicious incoming requests, bad user agents, disallowed request methods, suspicious URL contents, and SQL injection scanners. Administrators can also block bad bots, suspicious IPs, or traffic from a country using geolocation. Other controls protect WordPress endpoints and APIs from bad XML-RPC or REST API requests, reduce information disclosure, block hotlinking, and filter spam.

Alerts, logs, and site setup

Email alerts report important security events. A daily report summarizes attempted attacks and activity blocked by SecuPress. Security logs record important events and 404 pages, and include controls for banned IPs.

SecuPress supports multisite activation from the main network site and is compatible with WordPress caching and multilingual add-ons. The supplied product information advises against running it alongside another security plugin because their rules can conflict.

To get started, install and activate SecuPress Pro for the site or network, then open its options and execute the security scanner. Review the grade and findings, apply suitable hardening actions, and configure login protection, firewall features, alerts, malware scans, and scheduled tasks for the site's needs.