{ "title": "Sucuri and WP Masquerade: cloud firewall and a hidden WordPress", "seo_title": "Sucuri and WP Masquerade: cloud firewall and hiding", "h1": "Sucuri and WP Masquerade: cloud firewall and a hidden WordPress", "description": "The Sucuri plugin monitors, its firewall filters before the server, WP Masquerade hides WordPress: who does what, and visitors’ real IP.", "lead": "What Sucuri’s free plugin and paid firewall do, what WP Masquerade adds, the real IP address behind the firewall and the recommended setup.", "language": "en", "locale": "en-US", "type": "article", "url": "https://www.wp-masquerade.com/sucuri-and-wp-masquerade/", "canonical": "https://www.wp-masquerade.com/sucuri-and-wp-masquerade/", "markdown": "https://www.wp-masquerade.com/sucuri-and-wp-masquerade/index.md", "json": "https://www.wp-masquerade.com/sucuri-and-wp-masquerade/index.json", "published": "2026-10-24T07:00:00+00:00", "modified": "2026-11-05T20:54:52+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "Sucuri and WP Masquerade: cloud firewall and a hidden WordPress", "url": "https://www.wp-masquerade.com/sucuri-and-wp-masquerade/", "markdown": "https://www.wp-masquerade.com/sucuri-and-wp-masquerade/index.md", "json": "https://www.wp-masquerade.com/sucuri-and-wp-masquerade/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "Sucuri et WP Masquerade : pare-feu dans le cloud et WordPress masqué", "url": "https://www.wp-masquerade.com/fr/sucuri-et-wp-masquerade/", "markdown": "https://www.wp-masquerade.com/fr/sucuri-et-wp-masquerade/index.md", "json": "https://www.wp-masquerade.com/fr/sucuri-et-wp-masquerade/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "Sucuri y WP Masquerade: cortafuegos en la nube y WordPress oculto", "url": "https://www.wp-masquerade.com/es/sucuri-y-wp-masquerade/", "markdown": "https://www.wp-masquerade.com/es/sucuri-y-wp-masquerade/index.md", "json": "https://www.wp-masquerade.com/es/sucuri-y-wp-masquerade/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "Sucuri und WP Masquerade: Cloud-Firewall und verborgenes WordPress", "url": "https://www.wp-masquerade.com/de/sucuri-und-wp-masquerade/", "markdown": "https://www.wp-masquerade.com/de/sucuri-und-wp-masquerade/index.md", "json": "https://www.wp-masquerade.com/de/sucuri-und-wp-masquerade/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "Sucuri e WP Masquerade: firewall nel cloud e WordPress nascosto", "url": "https://www.wp-masquerade.com/it/sucuri-con-wp-masquerade/", "markdown": "https://www.wp-masquerade.com/it/sucuri-con-wp-masquerade/index.md", "json": "https://www.wp-masquerade.com/it/sucuri-con-wp-masquerade/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "Sucuri e WP Masquerade: firewall na nuvem e WordPress oculto", "url": "https://www.wp-masquerade.com/pt/sucuri-com-wp-masquerade/", "markdown": "https://www.wp-masquerade.com/pt/sucuri-com-wp-masquerade/index.md", "json": "https://www.wp-masquerade.com/pt/sucuri-com-wp-masquerade/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "Sucuri en WP Masquerade: firewall in de cloud en een verborgen WordPress", "url": "https://www.wp-masquerade.com/nl/sucuri-en-wp-masquerade/", "markdown": "https://www.wp-masquerade.com/nl/sucuri-en-wp-masquerade/index.md", "json": "https://www.wp-masquerade.com/nl/sucuri-en-wp-masquerade/index.json" } ], "headings": [ { "level": 1, "text": "Sucuri and WP Masquerade: cloud firewall and a hidden WordPress" }, { "level": 2, "text": "The Sucuri Security plugin: monitoring and hardening" }, { "level": 2, "text": "The Sucuri firewall: filtering before the server" }, { "level": 2, "text": "What the pair brings" }, { "level": 2, "text": "Visitors’ IP address behind the firewall" }, { "level": 2, "text": "Who does what: the recommended setup" }, { "level": 2, "text": "Step-by-step setup" }, { "level": 2, "text": "What the pair does not cover" }, { "level": 3, "text": "Key takeaways" }, { "level": 2, "text": "Sources" }, { "level": 2, "text": "WordPress security, without the noise", "id": "wpm-nl-box-title" } ], "body": "Sucuri is known for two very different things: a free monitoring plugin, installed on more than 600,000 sites, and a paid firewall that filters traffic in the cloud, before your server. WP Masquerade works inside WordPress: it hides the CMS, moves the login and spots bots. Here is what each Sucuri product really does, what the pair brings and how to avoid the two pitfalls of this combination: overlapping features and the IP address of visitors behind the firewall.\n\n*Disclosure: this article is published by the WP Masquerade team. Sucuri does not pay us and we use no affiliate links. The information about Sucuri comes from its wordpress.org page, its website, its documentation and the code of plugin version 2.8.1.*\n\n## The Sucuri Security plugin: monitoring and hardening\n\nThe free plugin (version 2.8.1 of October 14, 2026) contains no firewall. It is a monitoring and hardening tool, usable without an account or API key; according to its FAQ, Sucuri then collects no information.\n\n- **Audit log**: logins, changes to content, plugins and settings, with search, filters and CSV export since version 2.8.\n- **File integrity**: the plugin compares the state of the files with a baseline and reports additions, deletions and changes.\n- **Remote scanning** by SiteCheck, Sucuri’s free scanner: it visits the site like a visitor and looks for malware, errors and outdated software visible from the outside.\n- **Blocklist monitoring** (Google Safe Browsing, Sucuri Labs and others).\n- **One-click hardening**: removal of the WordPress version, blocking of PHP files in `uploads`, `wp-content` and `wp-includes`, disabling of the file editor, automatic renewal of the secret keys, and since version 2.7.4 a “Disable [XML-RPC](https://www.wp-masquerade.com/glossary/xml-rpc/)” option.\n- **Post-hack actions**: change the secret keys, reset passwords, reinstall plugins.\n- **[Two-factor authentication](https://www.wp-masquerade.com/glossary/two-factor-authentication/)** with an app, with ten backup codes since version 2.8, and management of a few headers (Cache-Control, CORS and [CSP](https://www.wp-masquerade.com/glossary/content-security-policy/) in report mode).\n\n## The Sucuri firewall: filtering before the server\n\nThe firewall is set up by changing the domain’s DNS records: traffic then goes through Sucuri’s network, which inspects it before passing it on to your hosting. According to the product page, it provides virtual patches for software that is not yet up to date, brute force protection, mitigation of denial-of-service attacks (layers 3, 4 and 7), a CDN, and “protected pages” behind a password, CAPTCHA, two-factor authentication or a list of allowed IP addresses. The plugin is not required to use it, but it lets you manage it from WordPress with an API key.\n\n| Plan | Listed price | Main content |\n| --- | --- | --- |\n| Sucuri Security plugin | Free | Audit, integrity, SiteCheck, blocklists, hardening, two-factor authentication |\n| Basic Firewall | $9.99 per month, 1 site | Cloud firewall, DDoS mitigation, CDN |\n| Pro Firewall | $19.98 per month, 1 site | Same, higher tier |\n| Basic Platform | $229 per year, 1 site | Firewall and unlimited manual malware cleanup (handled within 30 hours) |\n| Pro and Business Platform | $339 and $549 per year | Shorter cleanup times (12 hours, 6 hours) and more frequent scans |\n\n*Prices listed by Sucuri, each plan for one site, plus any applicable taxes.*\n\nThe firewall’s strength is its position: blocked requests never reach your server, which takes the load off it during a wave of attacks. Its limitation is the same as that of any upstream firewall: if the server’s real IP address is known, an attacker can target it directly. Our comparison of firewalls for WordPress explains these differences in position.\n\n## What the pair brings\n\nSucuri and WP Masquerade act in different places, with little overlap:\n\n- **The Sucuri firewall** stops known attacks and traffic surges before the server; **WP Masquerade** removes the clues that mark your site as WordPress and closes addresses that the firewall lets through because they are legitimate (`wp-login.php`, `xmlrpc.php`, author archives).\n- **The Sucuri plugin** monitors the state of the site (integrity, blocklists, audit); **WP Masquerade** adds what it lacks: a custom login address, other CMS imitation, bot traps and, with Pro, login attempt limiting inside WordPress, X-Frame-Options, Referrer-Policy and Permissions-Policy headers, file URL aliases and detailed vulnerability alerts.\n- **XML-RPC**: the Sucuri option uses the WordPress `xmlrpc_enabled` filter, which disables the methods that require authentication; `xmlrpc.php` keeps responding and pingbacks are not affected. The free version of WP Masquerade makes `xmlrpc.php` return 404 and turns off pingbacks.\n\n![Color-coded table of the layers covered by Sucuri (paid firewall and free plugin) and by WP Masquerade: filtering before the server and denial of service at Sucuri; hiding WordPress, login address and traps at WP Masquerade; two-factor authentication and integrity in both, to enable in only one; cleanup by humans in Sucuri’s Platform plans.](https://www.wp-masquerade.com/media/2026/10/couches-sucuri-wp-masquerade-en.webp)\n\n*The Sucuri firewall acts before the server, WP Masquerade inside WordPress; the blue cells are to be enabled on one side only.*\n\n## Visitors’ IP address behind the firewall\n\nBehind a cloud firewall, your server sees Sucuri’s addresses, not those of visitors. Sucuri’s documentation confirms this (“Same IP for All Users”): the real address is passed in a header, and for WordPress it recommends the official plugin, which restores it. According to the code of version 2.8.1, this restoration is turned on automatically when you save the firewall API key, and it happens early in the WordPress load (`init` action, priority 1).\n\n**WP Masquerade Pro restores the real address itself** from the `X-Sucuri-ClientIP` header, as soon as plugins load, so before the Sucuri plugin: the ban check for trapped bots, login limiting and the activity log see the real visitor, with or without the plugin. The header is only accepted when the connection comes from the Sucuri firewall’s official address ranges; otherwise it is ignored, so it cannot be used to fake an address.\n\nThe setting is in the “Proxy / CDN” card of the Protection tab, in Automatic mode by default (see [Cloudflare, Sucuri and real visitor IPs](https://www.wp-masquerade.com/features/cloudflare/)). Restoring the address at the server level remains good practice (Apache’s `remoteip` module, Nginx’s `real_ip` or your host’s equivalent setting, trusting the header only for the firewall’s addresses): server logs benefit too; then choose the Off mode in WP Masquerade. As Sucuri recommends, also block direct access to the origin server by only allowing the firewall’s addresses, so that nobody can bypass it.\n\n## Who does what: the recommended setup\n\n| Feature | Enable in Sucuri | Enable in WP Masquerade | Turn off |\n| --- | --- | --- | --- |\n| Firewall, DDoS, virtual patches | Yes (paid firewall) | Not applicable | Nothing |\n| File integrity | Yes (core, plugins, themes) | Core integrity check (Pro), optional | A single alert recipient to avoid duplicates |\n| External scanning and blocklists | Yes (SiteCheck) | Not applicable | Nothing |\n| Custom login address | Not applicable in the plugin | Yes (free) | If you use the firewall’s protected pages, add the new address to them |\n| Login attempt limiting | Firewall brute force protection | Yes (Pro): the real IP is restored by Pro or by the server | Nothing |\n| Two-factor authentication | Yes if you use the free version of WP Masquerade | Yes if you have Pro (per-role requirement) | The one you do not use |\n| XML-RPC and pingbacks | No | Yes: “Block XML-RPC” (free) | Sucuri’s “Disable XML-RPC”, now unnecessary |\n| WordPress version | Optional | Yes: other CMS imitation | Nothing: the imitated tag stays displayed |\n| Security headers | Cache-Control (for the firewall cache) | Yes: X-Frame-Options, Referrer-Policy, Permissions-Policy, CSP (Pro) | Sucuri’s report-mode CSP if you enable WP Masquerade’s CSP |\n| Activity log | Audit log (free) | Activity log (Pro), optional | Nothing: both can coexist |\n| Bot banning | Firewall | Traps (free); banning (Pro), with the real IP restored by Pro or by the server | Nothing |\n\n*Recommended split. The Sucuri labels are those of its English interface.*\n\nA detail about the version tag: Sucuri’s “Remove WordPress Version” option removes the WordPress generator tag, whereas WP Masquerade prints the tag of the imitated software itself. Both can therefore stay on without the imitation disappearing. For XML-RPC, the Sucuri plugin warns that a plugin such as Jetpack depends on it: this is also true for WP Masquerade’s blocking.\n\n![Diagram of the recommended setup, in the order in which a request meets each protection: DNS pointing to the Sucuri firewall, which filters and caches, server restoring the visitor’s real address, WP Masquerade making wp-login.php and xmlrpc.php return 404 and counting bots, login with limiting and two-factor authentication in only one plugin, pages without a WordPress signature, then monitoring by the Sucuri plugin (audit, integrity, SiteCheck).](https://www.wp-masquerade.com/media/2026/10/configuration-sucuri-wp-masquerade-en.webp)\n\n*The path of a request with the Sucuri firewall and WP Masquerade.*\n\n## Step-by-step setup\n\n1. Back up the site and the `.htaccess` file: the Sucuri plugin and WP Masquerade each write their own rules to it on Apache and LiteSpeed.\n2. Install the Sucuri plugin, apply the hardening you want (without “Disable XML-RPC”), and let it create its integrity baseline.\n3. If you take the firewall: change the DNS as instructed by Sucuri, save the API key in the plugin, then, if possible, ask your host to restore the real address at the server level and to only let the firewall’s addresses reach the origin server (WP Masquerade Pro restores it in WordPress anyway).\n4. Install WP Masquerade and follow the Getting started tab. Choose the login address, exclude it from the firewall cache and from your caching plugin, then test it with “Test and enable the new login”.\n5. If you use the firewall’s protected pages or its IP restriction for the admin area, check that they cover the new login address, and not only `wp-login.php`.\n6. Choose a single two-factor authentication, then test login, lost password and logout in a private window.\n\nA note on SiteCheck: it scans the site like a visitor. With other CMS imitation, what it infers from the public page about the software in use and its version no longer reflects your WordPress; rely on the plugin itself and on updates for that aspect.\n\n*Configuring the Sucuri Security plugin (in French; the interface has changed a little since).*\n\n## What the pair does not cover\n\n- **Without a firewall subscription**, neither plugin filters SQL injection or XSS: the free pair monitors and reduces the attack surface, it does not block exploitation of a vulnerability. In that case, add a web application firewall or virtual patches.\n- **Updates** remain the only fix for a vulnerability; WP Masquerade Pro’s [vulnerability alerts](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/) tell you what to update first.\n- **Comment spam** is a job for an anti-spam plugin: see [what WP Masquerade blocks and what it leaves to an anti-spam plugin](https://www.wp-masquerade.com/wordpress-anti-spam/).\n- **An already hacked site**: Sucuri’s Platform plans include cleanup; otherwise, follow our guide to [cleaning up a hacked WordPress site](https://www.wp-masquerade.com/clean-hacked-wordpress-site/).\n\nTo see where Sucuri stands among the other plugins, see our [comparison of the best WordPress security plugins](https://www.wp-masquerade.com/best-wordpress-security-plugins/). On the WP Masquerade side: [login page](https://www.wp-masquerade.com/features/custom-login-page/), [hardening](https://www.wp-masquerade.com/features/hardening/), [bot traps](https://www.wp-masquerade.com/features/bot-traps/) and [host and cache compatibility](https://www.wp-masquerade.com/features/hosting-and-cache-compatibility/).\n\n*The difference between the Sucuri plugin and the paid service (in English).*\n\n### Key takeaways\n\n- The free Sucuri plugin monitors and hardens; attack filtering is in the paid firewall, enabled through DNS.\n- WP Masquerade adds what Sucuri does not do inside WordPress: hiding, login address, complete XML-RPC blocking, traps, headers.\n- Behind the firewall, WP Masquerade Pro restores the real IP from the X-Sucuri-ClientIP header, for Sucuri’s official ranges only; server-level restoration and blocking direct access to the origin server are still recommended.\n- A single two-factor authentication, and the new login address in the firewall’s protected pages.\n\n## Sources\n\n- WordPress.org: Sucuri Security, changelog (2.7.4 to 2.8.1) (https://wordpress.org/plugins/sucuri-scanner/#developers)\n- Sucuri: Website Firewall (https://sucuri.net/website-firewall/)\n- Sucuri Docs: Same IP for All Users (https://docs.sucuri.net/website-firewall/troubleshooting/same-ip-for-all-users/)\n- WordPress Developer Resources: xmlrpc_enabled filter (https://developer.wordpress.org/reference/hooks/xmlrpc_enabled/)\n\nOther sources consulted: official vendor pages.\n\n## WordPress security, without the noise\n\nOne e-mail when something matters: new attacks seen in the wild, plugin updates and practical guides. No spam, unsubscribe in one click.", "categories": [ "Comparisons and combinations" ], "format": "application/json" }