---
description: Review of WordSec Software: system overview, features, price and cost information. Get free demos and compare to similar programs.
image: https://gdm-localsites-assets-gfprod.imgix.net/images/software_advice/og_logo-55146305bbe7b450bea05c18e9be9c9a.png
title: WordSec | Reviews, Pricing & Demos - SoftwareAdvice GB
---

Breadcrumb: [Home](/) > [Cybersecurity Software](/directory/4643/cybersecurity/software) > [WordSec](/software/560640/WordSec)

# WordSec

Canonical: https://www.softwareadvice.co.uk/software/560640/WordSec

> WordSec is a complete WordPress security plugin. Its eight modules cover the firewall, the malware scanner, login security, live traffic, IP and country blocking, supply-chain intelligence, the audit log and real-time alerts, so you can block attacks, find malware and harden your site from one dashboard instead of installing eight separate plugins.

If your WordPress site gets hacked you do not just lose the site. You lose customer trust, your Google rankings and days of work restoring backups. WordSec is built to stop that before it happens.

\*\*Free, and no license key to enter.\*\* The WAF firewall rules, malware and file-integrity scanning, brute force protection, two factor authentication, login security, IP and country blocking, the audit log and one-click hardening all run locally on your own server, and with no key the plugin makes no outbound request to the WordSec service at all. Every module can be enabled or disabled independently, so you get exactly the protection your site needs without paying for it in performance, and your live security score is always in view.

= Firewall =
Inspect every request, write your own rules, and harden WordPress with one-click toggles.
\* Multi-condition custom rule builder with regex and wildcard matching
\* Built-in rules across the major attack categories (SQL injection, XSS, path traversal, PHP and command injection, and more)
\* WAF learning and active modes, bot blocking and security headers
\* 25+ one-click hardening toggles for wp-config access, author enumeration, REST API and more
\* Optional Extended Protection: pre-WordPress request inspection via an \`auto\_prepend\_file\` bootstrap (explicit opt-in, fully reverted when disabled or on deactivation)
\* Endpoint rate limiting, XML-RPC protection and detailed firewall logs

= Scanner =
A seven-stage scanning system that examines files, the database and scheduled tasks.
\* malware detection rules (synced from the WordSec service) based content scanning
\* WordPress core, plugin and theme file-integrity verification (via the WordPress.org API)
\* Scheduled scans with batch processing to avoid timeouts
\* One-click quarantine and restore, with complete scan history

= Login Security =
Stop credential attacks before they start.
\* Role-based two-factor authentication (RFC 6238 TOTP), no external library required
\* Three CAPTCHA providers (reCAPTCHA, hCaptcha, Cloudflare Turnstile) plus a built-in math CAPTCHA
\* Brute-force protection with progressive lockout and honeypot traps
\* Leaked-password checking (Have I Been Pwned, k-anonymity) and Argon2 password enforcement
\* Session management and a custom login page designer

= Live Traffic =
Watch your traffic in real time, then replay it historically.
\* Real-time request logging (IP, URI, method, status, response time)
\* Safe request and response inspection with automatic bot detection
\* Exclusion filtering by role, IP, country or URI, with CSV export

= Blocking =
\* Country and continent allow or block lists
\* Single IP and CIDR range blocking, temporary or permanent, with allow-list support
\* Automatic abuse protection and endpoint rate limiting
\* Custom block messages

= Supply Chain =
\* Reputation scoring for every installed plugin and theme
\* Known-vulnerability alerts (data from the WordSec service) for core, plugins, themes and PHP
\* Abandoned plugin and theme detection
\* Update-integrity verification with automatic backups and a full SBOM inventory

= Audit Log =
\* Complete activity tracking across 11 object types and 14 actions
\* Content changes, plugin, theme and setting changes, and more
\* Fast filtering and one-click export

= Alarm =
\* 36 event types across six categories
\* Delivery by Email, Telegram or Slack
\* Basic, Advanced and Full alert modes

WordSec is fully functional out of the box. Every feature (WAF, malware and file-integrity scanning, login security, two-factor authentication, hardening, IP and country blocking, audit log, supply-chain monitoring and alarms) runs locally.
> 
> Verdict: Rated \*\*\*\* by 0 users. Top-rated for **Overall Quality**.

-----

## About the vendor

- **Company**: WordSec

## Commercial Context

- **Starting Price**: US$0.00
- **Pricing model**: Flat Rate (Free version available)
- **Target Audience**: Self Employed, 2–10, 11–50, 51–200, 201–500, 501–1,000, 1,001–5,000, 5,001–10,000, 10,000+
- **Deployment & Platforms**: Cloud, SaaS, Web-based
- **Supported Languages**: Arabic, Chinese, Dutch, English, French, German, Italian, Japanese, Korean, Portuguese, Russian, Spanish, Thai, Turkish, Ukrainian, Vietnamese
- **Available Countries**: Angola, Argentina, Aruba, Australia, Austria, Bahamas, Bahrain, Belgium, Bermuda, Bosnia & Herzegovina, Botswana, Brazil, Bulgaria, Canada, Cayman Islands, Chile, China, Colombia, Costa Rica, Croatia and 68 more

## Features

- API
- Activity Dashboard
- Activity Monitoring
- Activity Tracking
- Alerts/Notifications
- Audit Management
- Audit Trail
- Authentication
- Data Security
- Endpoint Protection Software
- Event Logs
- Firewalls
- Monitoring
- Policy Management
- Real-Time Analytics
- Real-Time Data
- Real-Time Monitoring
- Real-Time Notifications
- Real-Time Reporting
- Risk Alerts

## Integrations (1 total)

- WordPress

## Support Options

- Email/Help Desk
- FAQs/Forum

## Category

- [Cybersecurity Software](https://www.softwareadvice.co.uk/directory/4643/cybersecurity/software)

## Links

- [View on SoftwareAdvice](https://www.softwareadvice.co.uk/software/560640/WordSec)

## This page is available in the following languages

| Locale | URL |
| en | <https://www.softwareadvice.com/product/560640-WordSec/> |
| en-AU | <https://www.softwareadvice.com.au/software/560640/WordSec> |
| en-GB | <https://www.softwareadvice.co.uk/software/560640/WordSec> |
| en-IE | <https://www.softwareadvice.ie/software/560640/WordSec> |
| en-NZ | <https://www.softwareadvice.co.nz/software/560640/WordSec> |

-----

## Structured Data

<script type="application/ld+json">
  {"@context":"https://schema.org","@graph":[{"name":"SoftwareAdvice UK","address":{"@type":"PostalAddress","addressLocality":"Egham","addressRegion":"ENG","postalCode":"TW20 9AH","streetAddress":"Tamesis, The Glanty, Staines-upon-Thames Egham TW20 9AH United Kingdom"},"description":"Software Advice helps businesses in the UK find the best software with confidence. Compare software options and learn more from our research and user reviews.","email":"info@softwareadvice.co.uk","url":"https://www.softwareadvice.co.uk/","logo":"https://dm-localsites-assets-prod.imgix.net/images/software_advice/logo-white-d2cfd05bdd863947d19a4d1b9567dde8.svg","@id":"https://www.softwareadvice.co.uk/#organization","@type":"Organization","parentOrganization":"G2.com, Inc.","sameAs":[]},{"name":"WordSec","description":"WordSec is a complete WordPress security plugin. Its eight modules cover the firewall, the malware scanner, login security, live traffic, IP and country blocking, supply-chain intelligence, the audit log and real-time alerts, so you can block attacks, find malware and harden your site from one dashboard instead of installing eight separate plugins.\n\nIf your WordPress site gets hacked you do not just lose the site. You lose customer trust, your Google rankings and days of work restoring backups. WordSec is built to stop that before it happens.\n\n**Free, and no license key to enter.** The WAF firewall rules, malware and file-integrity scanning, brute force protection, two factor authentication, login security, IP and country blocking, the audit log and one-click hardening all run locally on your own server, and with no key the plugin makes no outbound request to the WordSec service at all. Every module can be enabled or disabled independently, so you get exactly the protection your site needs without paying for it in performance, and your live security score is always in view.\n\n= Firewall =\nInspect every request, write your own rules, and harden WordPress with one-click toggles.\n* Multi-condition custom rule builder with regex and wildcard matching\n* Built-in rules across the major attack categories (SQL injection, XSS, path traversal, PHP and command injection, and more)\n* WAF learning and active modes, bot blocking and security headers\n* 25+ one-click hardening toggles for wp-config access, author enumeration, REST API and more\n* Optional Extended Protection: pre-WordPress request inspection via an `auto_prepend_file` bootstrap (explicit opt-in, fully reverted when disabled or on deactivation)\n* Endpoint rate limiting, XML-RPC protection and detailed firewall logs\n\n= Scanner =\nA seven-stage scanning system that examines files, the database and scheduled tasks.\n* malware detection rules (synced from the WordSec service) based content scanning\n* WordPress core, plugin and theme file-integrity verification (via the WordPress.org API)\n* Scheduled scans with batch processing to avoid timeouts\n* One-click quarantine and restore, with complete scan history\n\n= Login Security =\nStop credential attacks before they start.\n* Role-based two-factor authentication (RFC 6238 TOTP), no external library required\n* Three CAPTCHA providers (reCAPTCHA, hCaptcha, Cloudflare Turnstile) plus a built-in math CAPTCHA\n* Brute-force protection with progressive lockout and honeypot traps\n* Leaked-password checking (Have I Been Pwned, k-anonymity) and Argon2 password enforcement\n* Session management and a custom login page designer\n\n= Live Traffic =\nWatch your traffic in real time, then replay it historically.\n* Real-time request logging (IP, URI, method, status, response time)\n* Safe request and response inspection with automatic bot detection\n* Exclusion filtering by role, IP, country or URI, with CSV export\n\n= Blocking =\n* Country and continent allow or block lists\n* Single IP and CIDR range blocking, temporary or permanent, with allow-list support\n* Automatic abuse protection and endpoint rate limiting\n* Custom block messages\n\n= Supply Chain =\n* Reputation scoring for every installed plugin and theme\n* Known-vulnerability alerts (data from the WordSec service) for core, plugins, themes and PHP\n* Abandoned plugin and theme detection\n* Update-integrity verification with automatic backups and a full SBOM inventory\n\n= Audit Log =\n* Complete activity tracking across 11 object types and 14 actions\n* Content changes, plugin, theme and setting changes, and more\n* Fast filtering and one-click export\n\n= Alarm =\n* 36 event types across six categories\n* Delivery by Email, Telegram or Slack\n* Basic, Advanced and Full alert modes\n\nWordSec is fully functional out of the box. Every feature (WAF, malware and file-integrity scanning, login security, two-factor authentication, hardening, IP and country blocking, audit log, supply-chain monitoring and alarms) runs locally.","image":"https://gdm-catalog-fmapi-prod.imgix.net/ProductScreenshot/fc881467-1cb6-45a7-83a8-24b81eb2274f.jpeg","url":"https://www.softwareadvice.co.uk/software/560640/WordSec","@id":"https://www.softwareadvice.co.uk/software/560640/WordSec#software","@type":"SoftwareApplication","publisher":{"@id":"https://www.softwareadvice.co.uk/#organization"},"applicationCategory":"BusinessApplication","offers":{"price":"0","@type":"Offer","priceCurrency":"USD"},"operatingSystem":"Cloud"},{"@id":"https://www.softwareadvice.co.uk/software/560640/WordSec#breadcrumblist","@type":"BreadcrumbList","itemListElement":[{"name":"Home","position":1,"item":"/","@type":"ListItem"},{"name":"Cybersecurity Software","position":2,"item":"/directory/4643/cybersecurity/software","@type":"ListItem"},{"name":"WordSec","position":3,"item":"/software/560640/WordSec","@type":"ListItem"}]}]}
</script>