WordPress security features

Monitor, get alerted, take action: day-to-day monitoring

A site can be compromised for weeks before anyone notices. WP Masquerade Pro keeps watch for you and only bothers you when there is something to do. Here is, in practice, what happens once Pro is active.

When	What Pro checks	What you get
Continuously	Administrator sign-ins, password guessing, bot trap hits, sensitive actions (plugins, accounts, settings)	An email when someone signs in from a new device; temporary blocking of addresses that pile up failures; banning of persistent bots; everything recorded in the activity log
Every hour	Your images displayed by other sites, when hotlink protection is in Detect or Protect mode	An email when a new site displays your images beyond the threshold you set; the details (images, requests, bandwidth) in the Hotlinks tab
Every day	Versions of your plugins, themes and WordPress checked against published vulnerabilities; core files compared with the official wordpress.org checksums	An email as soon as a known vulnerability affects you, with its severity and the version that fixes it; an email if a core file is modified, missing or unknown
Every day, for all your sites	Pending updates (WordPress, plugins, themes, with security releases flagged), PHP version and its end of support, number of known vulnerabilities	The status of each site in your member area: “Up to date”, “Security update pending”, “Vulnerable”, or a warning when a site has stopped reporting
Every Monday	Summary of the week	The security report of each site and, if you turn it on, a summary of the sites to update, sent only when one of them needs your attention

What is sent to the member area, and nothing else: the WordPress and PHP versions, the list of plugins and themes waiting for an update, and the number of known vulnerabilities. No content, no users, no passwords.

Who is it for?

For site publishers

Blog, online media, business site: much of your traffic comes from search engines, and your readers trust you. A hack that injects spam pages or malicious code can bring up the “This site may be hacked” label under your Google results, or a full-screen browser warning, and the review takes time (see how a hack affects your search rankings and how to get off the Safe Browsing list).

• login moved, two-factor authentication and limited attempts for every author;
• an alert as soon as an installed plugin is affected by a published vulnerability;
• 1-site license at €59 per year excl. tax.

For agencies

When you maintain your clients’ sites, a vulnerability in a popular plugin can hit ten sites at once, and the client turns to you. Pro gives you the big picture without signing in to each site.

• A single member area for all your licenses and all your sites, with the update status of each one, filters (“Needs attention”, “Up to date”) and sorting by urgency;
• an optional summary every Monday listing the sites to update;
• per-site alerts, sent to the address of your choice;
• an activity log to know who, from your team or the client’s, installed a plugin or changed a setting;
• the same configuration everywhere with settings import and export, and an admin in 7 languages for your clients;
• an agency dashboard: a security score per site, client groups, client reports under your name, settings profiles sent to the sites that accept them, and white-label;
• 10-site (€149 per year), 100-site (€399 per year) or unlimited (€990 once) licenses, excl. tax, with a slot freed in one click when a client leaves.

For businesses and online stores

For a WooCommerce store or a site that collects customer data, a hack means interrupted sales, worried customers and legal obligations: when a personal data breach poses a risk to people, the GDPR requires you to notify your supervisory authority (CNIL in France) within 72 hours, and to inform the people concerned when the risk is high.

• privileged accounts protected: two-factor authentication required per role, limited attempts, wp-admin hidden from visitors;
• traceability: the activity log helps document an incident (who, what, when), with CSV export;
• early detection: known vulnerabilities, modified core files and sign-ins from a new device reported by email;
• minimal data: IP addresses truncated in logs, two-factor secrets encrypted.

How much would a hack cost your business? We gathered the public prices of cleanup services, Google’s review times and GDPR obligations: what a hacked site costs.

How to secure your WordPress site: where to start

A security plugin is not enough on its own. Here is the order we recommend to secure a WordPress site, and what WP Masquerade contributes at each step.

1. Update everything: WordPress, plugins and themes, and remove what you no longer use. With Pro, vulnerability alerts report every day the versions affected by a published vulnerability.
2. Protect the login: unique passwords, a moved login URL (free), two-factor authentication and brute force protection (Pro).
3. Reduce the attack surface: hide WordPress, block XML-RPC and pingbacks with hardening, hide the author list (Pro).
4. Filter and monitor: a firewall (host, Cloudflare or plugin) and file scanning, which WP Masquerade doesn’t provide; bot traps, plus the integrity check and the activity log with Pro.
5. Back up off the server and test restoring.

For the full list, follow our 40-point WordPress security checklist. To choose the plugins that complement WP Masquerade, read our comparison of the best WordPress security plugins; for spam, see what WP Masquerade blocks and what needs an anti-spam plugin.

Free or Pro at a glance

Free: WordPress hidden and an authentic generator tag for 5 popular profiles (or a name of your choice), basic technical links removed, plugin HTML comments and generator tags removed, custom login URL with wp-login.php and wp-admin hidden, pingbacks and XML-RPC blocked, trap counting, plugin files invisible to scanners, admin in 7 languages.

Pro: everything else. 41 profiles and Wappalyzer markers, REST and oEmbed discovery links removed, hidden author list, file URL aliases, unknown AJAX requests answered with 404, login attempt limiting, two-factor authentication, security headers, integrity check, email alerts, banning, log and fake admin pages, signature feed, updates and priority support. New in 1.1: vulnerable plugin alerts, administrator activity log, Cloudflare support and settings import and export. New in 1.2: image hotlink protection. New: update monitoring of all your sites in your member area. Also new: AI crawler control, the agency dashboard and updates of the disguised plugins catalogue between releases. See the line-by-line comparison.

What stays the same

• Your site’s look: theme, copy and pages stay identical for your visitors.
• Your files: physical folders aren’t moved and WordPress core isn’t modified.
• Your admin: when logged in, you see the site without camouflage; the dashboard works just as before.
• Your server configuration: the plugin gives you rules to copy, and never edits your Nginx configuration on its own. The one exception, hotlink protection (Pro, off by default), writes its own block in .htaccess on Apache and LiteSpeed, checks it and removes it as soon as you turn it off.