WordPress login and security monitoring

Kadence Security Pro brings login controls, vulnerability monitoring, and site activity into a real-time security dashboard. It shows brute force attacks, banned visitors, active lockouts, scan results, and user security statistics. The plugin helps reduce exposure to common attack methods, but it cannot prevent every possible attack.

Setup templates cover ecommerce, network, non-profit, blog, portfolio, and brochure sites. You can also define user groups and apply different security requirements to clients, clients, administrators, or other users.

Login and account controls

Two-factor authentication can require a code alongside a password. Users can receive codes through apps such as Authy or Google Authenticator, email, or backup codes. Password requirements let you set a policy for user accounts.

• reCAPTCHA helps deter bots that attempt logins with compromised passwords, post spam, or scrape content.
• Passwordless logins let users sign in with a click while retaining two-factor authentication and strong password controls.
• Trusted Devices identifies approved devices to help limit session hijacking and restrict Administrator privileges to trusted devices.
• Privilege Escalation provides temporary administrator-level access.
• Local and network brute force protection can block repeat login attacks. Ban Users blocks specified users, while Magic Links allow login when a username is locked out by local brute force protection.

Vulnerability scans and software updates

The Site Scanner checks WordPress core documents, extensions, and themes for known vulnerabilities. In Pro, scheduled scans can execute hourly. Patchstack integration can apply fixes for some vulnerabilities before a extension or theme vendor has released a patch. Kadence Security Pro uses the Patchstack Priority score, which weighs the likelihood of exploitation and potential impact on a WordPress website.

Version Management can automatically update WordPress, plugins, and themes when configured. It also provides settings to harden sites running outdated software and scan for old websites.

Activity logs and other security tools

User Logging entries logins and logouts, registrations, plugin and theme changes, and edits to posts and pages. The dashboard brings this activity together with security and scan information.

• Enforce SSL forces site connections to use SSL/TLS.
• Database Backups can create scheduled backups and email them. These cover the WordPress database, not the complete site.
• Geolocation connects Trusted Devices with an external location or mapping API.
• Other tools can identify server IPs, check file permissions, change the first WordPress user ID or database prefix, and view or flush security rules in server configuration files and wp-config.php. Hide Login URL changes the login address to make it harder for bots to find.

Setup and compatibility

Choose the site template that matches your website, identify its user groups, then configure login protection, vulnerability scans, logging, and backups. Make a complete backup before applying features to an existing site; the database backup tool does not back up all site files. The plugin is tested and guaranteed for the latest stable WordPress release. It requires Apache or LiteSpeed with mod_rewrite, or NGINX.