Sucuri Firewall + WordPress Security Plugin

Sucuri Firewall + WordPress Security Plugin brings WordPress monitoring into the dashboard alongside supported controls for Sucuri’s cloud Website Firewall. The firewall runs in the cloud without the add-on; installing the add-on lets administrators review and manage supported settings from WordPress.

After installation, generate the plugin API key to activate event monitoring. Firewall controls and vulnerability scanners for WordPress core, plugins, themes, and PHP require a Sucuri Firewall account and its WAF API key.

Review activity and file changes

Audit logs record security events such as user logins and content changes. Administrators can search and filter entries by event type, date, severity, plugin, or theme, then export the audit trail as a CSV file. Sucuri says these logs are not stored in the WordPress database.

File integrity monitoring makes a known-good baseline when the plugin is installed. It compares current documents with that baseline and reports added, modified, or removed files across WordPress core, plugin, and theme directories.

Run remote checks and apply hardening guidance

The remote malware scanner checks for known malware, viruses, blocklist status, website errors, outdated software, and malicious code. It accesses the website like a regular visitor, which can help detect threats that try to stay hidden from bots or search engines. Blocklist monitoring checks multiple services for security-related flags.

Hardening and prevention options provide recommendations such as disabling the plugin and theme editor, blocking PHP files in selected directories, and updating secret keys. Available actions depend on the website’s environment. Customizable security alerts let administrators choose which events to receive and how often.

Connect firewall protection and vulnerability scans

With a Sucuri Firewall account and WAF API key, administrators can manage supported firewall settings from WordPress and use the core, plugin, theme, and PHP vulnerability scanners. The cloud firewall helps protect against denial-of-service and DDoS attacks, software vulnerability exploits, zero-day disclosures, and brute-force attacks. Its feature set also includes advanced access controls, performance optimization, failover, and redundancy.

Prepare for incident response

Post-Hack tools guide administrators through updating secret keys, resetting user passwords, resetting installed plugins, and updating plugins and themes after a compromise. These actions support recovery work; they do not guarantee that a site will be restored.

To set up event monitoring, install the plugin in WordPress and generate its plugin API key. For firewall integration and account-gated scanners, enter the WAF API key under Firewall Management.