Sucuri Firewall + WordPress Security Plugin brings together WordPress activity records, file integrity checks, remote site scans, hardening guidance, and post-hack utilities. A separate cloud Website Firewall can be connected to the dashboard for firewall management, with its own account and API key requirements.

Monitor activity and file changes

After activation, generate the extension API key to enable event monitoring. Audit logs capture security events such as logins and content changes. Entries can be searched and filtered by date, event type, severity, add-on, or theme, then exported as a CSV file. Sucuri says these logs are not stored in the WordPress database.

File integrity monitoring establishes a known-good baseline when the plugin is installed. It checks directories at the WordPress installation root, including core documents, plugins, and themes, and reports files that were added, modified, or removed.

The remote scanner checks for malware, viruses, blocklist status, site errors, outdated software, and malicious code. Blocklist monitoring checks services such as Google Safe Browsing and reports security-related flags.

Firewall access and vulnerability scans

The Website Firewall runs in the cloud without the plugin. To view and manage supported firewall settings in WordPress, connect a Sucuri Firewall account with its WAF API key. The firewall helps protect against denial of service and distributed denial of service attacks, software vulnerability exploitation, and brute-force attacks. Its capability set also includes zero-day disclosure patches, performance optimization, access controls, failover, and redundancy.

A connected Sucuri Firewall account and valid WAF API key also unlock vulnerability scans for WordPress core, PHP, installed plugins, and themes. This WAF API key is separate from the plugin API key used to activate event monitoring. Installing the plugin does not make a Sucuri account or include the Website Firewall service.

Hardening and incident response

The Hardening and Prevention section provides recommendations that depend on the site environment. Options include disabling the plugin and theme editor, blocking PHP files in selected directories, checking the default administrator account, and updating secret keys.

If a site is compromised, the Post-Hack section guides administrators through four actions in order: update secret keys, reset user passwords, reset installed plugins, then update plugins and themes. Security alerts can be customized, including how often they are sent.

Installation

In the WordPress administration panel, open Plugins, select Add New, and search for “sucuri” or “sucuri-scanner.” Install the option published by Sucuri Inc. and activate it. Then generate the plugin API key from its dashboard to enable event monitoring. Use the settings to configure alerts, hardening settings, scanner paths, and API communication. Add a separate WAF API key in Firewall Management to connect a Sucuri Firewall account.