{ "title": "Jetpack", "seo_title": "Jetpack: review, recommended settings and limits", "h1": "Jetpack", "description": "Jetpack free or paid: strengths, limitations, Pro and Complete pricing, recommended security and performance settings, and patched vulnerabilities.", "lead": "Jetpack, Automattic’s toolkit, connects your site to the WordPress.com cloud for stats, an image CDN, security and backups. Our take on what is really free, the paid plans, the security settings to turn on and the vulnerabilities that have been patched.", "language": "en", "locale": "en-US", "type": "plugin-sheet", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/jetpack/", "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/jetpack/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/jetpack/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/jetpack/index.json", "published": "2026-11-04T08:00:00+00:00", "modified": "2026-11-05T21:13:01+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "Jetpack", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/jetpack/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/jetpack/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/jetpack/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "Jetpack", "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/jetpack/", "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/jetpack/index.md", "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/jetpack/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "Jetpack", "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/jetpack/", "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/jetpack/index.md", "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/jetpack/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "Jetpack", "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/jetpack/", "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/jetpack/index.md", "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/jetpack/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "Jetpack", "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/jetpack/", "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/jetpack/index.md", "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/jetpack/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "Jetpack", "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/jetpack/", "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/jetpack/index.md", "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/jetpack/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "Jetpack", "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/jetpack/", "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/jetpack/index.md", "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/jetpack/index.json" } ], "headings": [ { "level": 1, "text": "Jetpack" }, { "level": 2, "text": "What Jetpack does on your site" }, { "level": 2, "text": "Which sites Jetpack suits best" }, { "level": 2, "text": "Jetpack strengths and limitations" }, { "level": 3, "text": "Strengths" }, { "level": 3, "text": "Limitations" }, { "level": 2, "text": "The Jetpack settings we recommend" }, { "level": 2, "text": "Jetpack security: rare flaws with a wide reach" }, { "level": 2, "text": "Jetpack FAQ", "id": "faq" } ], "body": "## The essentials\n\n- Best for personal blogs that want stats, an image CDN and login protection without paying.\n- Main caveat: it needs a WordPress.com account, a public site and working XML-RPC.\n- Free; Pro costs €324 per year and adds commercial stats and real-time backups.\n\n## What Jetpack does on your site\n\nJetpack is the toolkit from Automattic, the company behind WordPress.com and WooCommerce. It plugs your site into the WordPress.com cloud, which does the heavy lifting instead of your host: stats, an image [CDN](https://www.wp-masquerade.com/glossary/cdn/), backups and security scanning. That explains its requirements: a free WordPress.com account (separate from your own admin login) and a publicly reachable site with XML-RPC enabled.\n\nThe plugin bundles dozens of modules you can switch on one by one: brute force protection, downtime monitoring, stats, social sharing, newsletters, forms, SEO tools and an XML sitemap, WP.me shortlinks and more than fifty blocks. Security settings live under Jetpack > Protect. Jetpack also acts as an MCP bridge to ChatGPT, Claude and other AI agents; that access stays off until you turn it on.\n\nThe free plan works on any site, commercial or not. On the pricing page, only free Stats is limited to personal sites; stats for a commercial site, real-time backups, malware scanning with one-click fixes and automatic firewall rules need a paid plan. Several tools also ship as standalone plugins (Jetpack Protect, Jetpack Boost, Jetpack Stats, VaultPress Backup).\n\n![Diagram: Jetpack works on visitors and bots, wordpress, database and files. Public traces: signed HTML comments (removed, free version); short link (removed, free version); folder name (hidden with Pro); tag IDs (hidden with Pro); CSS classes (still visible); files served by the vendor (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/jetpack/diagram-en.svg?v=9ae8d72f)\n\n## Which sites Jetpack suits best\n\n- **Personal blogs and nonprofit sites**: stats, social sharing, email subscriptions and login protection at no cost; free Stats is meant for personal sites only.\n- **Sites on modest hosting**: images served from the WordPress.com CDN, stats crunched away from your server.\n- **WooCommerce stores ready to pay**: VaultPress Backup saves every change in real time and restores in one click, orders included.\n\nIt is the wrong pick for a site that must run without third-party services, for a staging site that is not reachable from the internet, or if your host blocks xmlrpc.php (see our article on [XML-RPC and its uses](https://www.wp-masquerade.com/wordpress-xml-rpc-risks/)). For a full firewall without a subscription, [Wordfence](https://www.wp-masquerade.com/features/camouflaged-plugins/wordfence/) is a better fit; for free backups to your own storage, look at [UpdraftPlus](https://www.wp-masquerade.com/features/camouflaged-plugins/updraftplus/).\n\n## Jetpack strengths and limitations\n\n### Strengths\n\n- **Plenty of free features.** Brute force protection, downtime monitoring, an image CDN, personal stats and social sharing.\n- **Offloaded processing.** Stats, backups and scans run in the WordPress.com cloud, not on your hosting.\n- **Pick-and-choose modules.** Each feature can be turned on separately, and several exist as standalone plugins.\n- **Far-reaching fixes.** In both 2023 and 2024, Automattic shipped patches for older branches; in 2024, most sites were updated automatically.\n\n### Limitations\n\n- **Tied to WordPress.com.** Without a connected account, a public site and reachable XML-RPC, most features stop working.\n- **Free Stats for personal sites only.** A commercial site pays for stats, and any site pays for real-time backups and malware scanning.\n- **Limited free security.** The free firewall only takes manual rules, and the free check only looks at plugin and theme versions.\n- **Pricey plans.** Pro costs €324 and Complete €540 per year for one site; discounts require at least five sites.\n\n## The Jetpack settings we recommend\n\nAll of these settings exist in the current free version once the site is connected to WordPress.com.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Login protection** Jetpack > Protect > Settings | On | Blocks IP addresses that keep failing to log in. |\n| **Always allowed IP addresses** Same screen | Your IP address, only if it is static | Keeps you from locking yourself out; pointless with an address that changes. |\n| **Account protection** Same screen | On | A user whose password has leaked must verify their identity and choose a new one. |\n| **Downtime monitoring** Same screen | On | An email goes to your WordPress.com account address when the site goes down, then when it comes back. |\n| **Require accounts to use WordPress.com Two-Step Authentication** Same screen, WordPress.com login section | On if you use this login | Otherwise a linked WordPress.com account without two-factor authentication can open your dashboard. |\n| **Speed up image load times** Jetpack > Settings > Performance | On if no other image CDN is running | Images are served from i0.wp.com; two services rewriting the same images get in each other’s way. |\n| **Speed up static file load times** Same screen | Test on a copy of the site first | It changes where some CSS and JavaScript files load from; check the layout with your cache. |\n| **Generate XML sitemaps** Jetpack > Settings > Traffic | Off if an SEO plugin already builds one | A single sitemap avoids two competing indexes. |\n| **WP.me Shortlinks** Same screen | Off (default) | Adds a shortlink that gives Jetpack away, useless if you never share it. |\n\n- Open Jetpack > My Jetpack, then the Classic Modules list, and deactivate every module you don’t use.\n- After changing a firewall or server rule, check in My Jetpack that the WordPress.com connection is still active.\n- View the source of a public page: with the image accelerator on, image URLs start with i0.wp.com.\n\n## Jetpack security: rare flaws with a wide reach\n\nBecause Jetpack runs on a huge number of sites, each of its flaws affects a lot of people. The most notable ones:\n\n- **CVE-2023-2996, fixed in 12.1.1**: an Author account could modify or delete site files through the API, in rare cases leading to code execution. Older branches received their own patch.\n- **CVE-2024-10075 and CVE-2024-10076, fixed in 13.8**: unauthenticated execution of shortcodes and blocks through the contact form, and stored XSS by a Contributor through the site accelerator.\n- **CVE-2024-9926, fixed in 13.9.1**: any logged-in user, even a Subscriber, could read messages sent through the contact form. The bug dated back to version 3.9.9 (2016), and every branch got a patched release.\n\nSo turn on auto-updates for Jetpack under Plugins (see our guide to automatic plugin updates); the full timeline is in our article on [Jetpack security vulnerabilities](https://www.wp-masquerade.com/jetpack-security-vulnerabilities/). WP Masquerade removes the HTML comments and the shortlink that give Jetpack away, but calls to stats.wp.com and i0.wp.com stay visible, and this camouflage never replaces updating.\n\n## Jetpack FAQ\n\n**Is Jetpack really free?**\n\nYes, the free plan works on any site, commercial ones included: login protection, the image CDN, downtime monitoring. Free Stats, however, is limited to personal sites, and real-time backups and malware scanning need a paid plan.\n\n**Why does Jetpack need a WordPress.com account?**\n\nIts services run in the WordPress.com cloud: backups, stats, the image CDN, spam filtering and the AI agent connection. This free account is different from the one you use to log in to your own site.\n\n**How much do Jetpack Pro and Jetpack Complete cost?**\n\nThe pricing page lists €324 per year for Pro (50GB of real-time backups, commercial stats up to 50,000 views a month) and €540 per year for Complete (1TB of backups, VideoPress). Yearly plans can be refunded within 14 days.\n\n**Can I run Jetpack alongside Wordfence or another security plugin?**\n\nYes, as long as you don’t double up: one tool for login protection, one firewall. Above all, make sure the other plugin does not block xmlrpc.php, which Jetpack needs.\n\n## Key facts\n\n- Category: Utilities\n- Vendor: Automattic Inc.\n- Price: Free (free Stats for personal sites only); Jetpack Pro at €324 per year and Complete at €540 per year for one site\n- Active installations (wordpress.org): 3 000 000+\n- Version: 16.4\n- Official page: https://wordpress.org/plugins/jetpack/\n\n## What WP Masquerade hides\n\n- Handled by the free version of WP Masquerade\n- Removed by the free version: signed HTML comments, short link\n- With Pro: folder name, tag IDs\n- Still visible: CSS classes, files served by the vendor", "catalog": "jetpack", "essentials": [ "Best for personal blogs that want stats, an image CDN and login protection without paying.", "Main caveat: it needs a WordPress.com account, a public site and working XML-RPC.", "Free; Pro costs €324 per year and adds commercial stats and real-time backups." ], "format": "application/json" }