What Jetpack does on your site
Jetpack is the toolkit from Automattic, the company behind WordPress.com and WooCommerce. It plugs your site into the WordPress.com cloud, which does the heavy lifting instead of your host: stats, an image CDN, backups and security scanning. That explains its requirements: a free WordPress.com account (separate from your own admin login) and a publicly reachable site with XML-RPC enabled.
The plugin bundles dozens of modules you can switch on one by one: brute force protection, downtime monitoring, stats, social sharing, newsletters, forms, SEO tools and an XML sitemap, WP.me shortlinks and more than fifty blocks. Security settings live under Jetpack > Protect. Jetpack also acts as an MCP bridge to ChatGPT, Claude and other AI agents; that access stays off until you turn it on.
The free plan works on any site, commercial or not. On the pricing page, only free Stats is limited to personal sites; stats for a commercial site, real-time backups, malware scanning with one-click fixes and automatic firewall rules need a paid plan. Several tools also ship as standalone plugins (Jetpack Protect, Jetpack Boost, Jetpack Stats, VaultPress Backup).
Which sites Jetpack suits best
- Personal blogs and nonprofit sites: stats, social sharing, email subscriptions and login protection at no cost; free Stats is meant for personal sites only.
- Sites on modest hosting: images served from the WordPress.com CDN, stats crunched away from your server.
- WooCommerce stores ready to pay: VaultPress Backup saves every change in real time and restores in one click, orders included.
It is the wrong pick for a site that must run without third-party services, for a staging site that is not reachable from the internet, or if your host blocks xmlrpc.php (see our article on XML-RPC and its uses). For a full firewall without a subscription, Wordfence is a better fit; for free backups to your own storage, look at UpdraftPlus.
Jetpack strengths and limitations
Strengths
- Plenty of free features. Brute force protection, downtime monitoring, an image CDN, personal stats and social sharing.
- Offloaded processing. Stats, backups and scans run in the WordPress.com cloud, not on your hosting.
- Pick-and-choose modules. Each feature can be turned on separately, and several exist as standalone plugins.
- Far-reaching fixes. In both 2023 and 2024, Automattic shipped patches for older branches; in 2024, most sites were updated automatically.
Limitations
- Tied to WordPress.com. Without a connected account, a public site and reachable XML-RPC, most features stop working.
- Free Stats for personal sites only. A commercial site pays for stats, and any site pays for real-time backups and malware scanning.
- Limited free security. The free firewall only takes manual rules, and the free check only looks at plugin and theme versions.
- Pricey plans. Pro costs €324 and Complete €540 per year for one site; discounts require at least five sites.
The Jetpack settings we recommend
All of these settings exist in the current free version once the site is connected to WordPress.com.
| Setting | Recommended value | Why |
|---|---|---|
| Login protection Jetpack > Protect > Settings | On | Blocks IP addresses that keep failing to log in. |
| Always allowed IP addresses Same screen | Your IP address, only if it is static | Keeps you from locking yourself out; pointless with an address that changes. |
| Account protection Same screen | On | A user whose password has leaked must verify their identity and choose a new one. |
| Downtime monitoring Same screen | On | An email goes to your WordPress.com account address when the site goes down, then when it comes back. |
| Require accounts to use WordPress.com Two-Step Authentication Same screen, WordPress.com login section | On if you use this login | Otherwise a linked WordPress.com account without two-factor authentication can open your dashboard. |
| Speed up image load times Jetpack > Settings > Performance | On if no other image CDN is running | Images are served from i0.wp.com; two services rewriting the same images get in each other’s way. |
| Speed up static file load times Same screen | Test on a copy of the site first | It changes where some CSS and JavaScript files load from; check the layout with your cache. |
| Generate XML sitemaps Jetpack > Settings > Traffic | Off if an SEO plugin already builds one | A single sitemap avoids two competing indexes. |
| WP.me Shortlinks Same screen | Off (default) | Adds a shortlink that gives Jetpack away, useless if you never share it. |
- Open Jetpack > My Jetpack, then the Classic Modules list, and deactivate every module you don’t use.
- After changing a firewall or server rule, check in My Jetpack that the WordPress.com connection is still active.
- View the source of a public page: with the image accelerator on, image URLs start with i0.wp.com.
Jetpack security: rare flaws with a wide reach
Because Jetpack runs on a huge number of sites, each of its flaws affects a lot of people. The most notable ones:
- CVE-2023-2996, fixed in 12.1.1: an Author account could modify or delete site files through the API, in rare cases leading to code execution. Older branches received their own patch.
- CVE-2024-10075 and CVE-2024-10076, fixed in 13.8: unauthenticated execution of shortcodes and blocks through the contact form, and stored XSS by a Contributor through the site accelerator.
- CVE-2024-9926, fixed in 13.9.1: any logged-in user, even a Subscriber, could read messages sent through the contact form. The bug dated back to version 3.9.9 (2016), and every branch got a patched release.
So turn on auto-updates for Jetpack under Plugins (see our guide to automatic plugin updates); the full timeline is in our article on Jetpack security vulnerabilities. WP Masquerade removes the HTML comments and the shortlink that give Jetpack away, but calls to stats.wp.com and i0.wp.com stay visible, and this camouflage never replaces updating.
What WP Masquerade hides for Jetpack
Free version Handled by the free version of WP Masquerade
Jetpack is one of the 50 most used plugins known to the free version. Pro goes further by renaming its files.
Free version
- signed HTML comments
- short link
With Pro
- folder name
- tag IDs
Still visible
- CSS classes
jetpack-*, jp-* - files served by the vendor
stats.wp.com, i0.wp.com
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Jetpack FAQ
Is Jetpack really free?
Yes, the free plan works on any site, commercial ones included: login protection, the image CDN, downtime monitoring. Free Stats, however, is limited to personal sites, and real-time backups and malware scanning need a paid plan.
Why does Jetpack need a WordPress.com account?
Its services run in the WordPress.com cloud: backups, stats, the image CDN, spam filtering and the AI agent connection. This free account is different from the one you use to log in to your own site.
How much do Jetpack Pro and Jetpack Complete cost?
The pricing page lists €324 per year for Pro (50GB of real-time backups, commercial stats up to 50,000 views a month) and €540 per year for Complete (1TB of backups, VideoPress). Yearly plans can be refunded within 14 days.
Can I run Jetpack alongside Wordfence or another security plugin?
Yes, as long as you don’t double up: one tool for login protection, one firewall. Above all, make sure the other plugin does not block xmlrpc.php, which Jetpack needs.