Automate routine security checks

SecuPress Pro adds scheduled security tasks and security controls to a WordPress site. Its scanner reviews 35 security points in about five minutes, then provides a grade and a report of findings. You can choose many suggested fixes with a checkbox. When a change needs your decision, SecuPress asks before proceeding. Export the analysis as a PDF to share with clients or colleagues.

Three separate scheduled tasks can run a security scan, back up the database and files for download, or scan for malware. The scheduled scanner emails a report outlining actions to consider. Malware scans run at regular intervals.

Set login and account rules

• Limit failed login attempts and protect against password spraying.
• Ban login attempts that use non-existing usernames, set a non-login time slot, and control visitor sessions.
• Add two-factor authentication, set password lifetimes, and enforce strong passwords.
• Forbid vague usernames such as www or admin, and move the login page with the included Move Login feature.

Check components and website files

SecuPress checks extensions and themes for known vulnerabilities or files that have been tampered with to include malicious code. When it detects a vulnerable component, the security module can send an email alert and show a warning in WordPress. Security alarms hosted on SecuPress servers provide daily data about recently vulnerable extensions and themes.

Other controls limit extension activation, deactivation, installation, and removal on a live site, and can lock down plugin and theme uploads through ZIP files. SecuPress also reinforces WordPress core options, protects security keys and configuration, checks sensitive information, and can block bad requests to XML-RPC or REST API endpoints. Additional modules address hotlinking and disclosure of PHP or WordPress details.

Filter traffic and scan for malware

Firewall capabilities block malicious incoming requests, bad user agents, disallowed request methods, unsafe URL contents, SQL injection scanners, and brute-force attempts. SecuPress can block bad bots and suspicious IPs, including by country through geolocation. Its malware scan looks for bad files in FTP locations and the uploads folder, as well as potential phishing attempts through index.php loads.

An anti-spam system runs in the background when activated. Email alerts report important security events, and a daily report summarizes attempted attacks and activity blocked by SecuPress. Logs record important security activity and 404 pages, and include controls for banned IPs.

Network setup and compatibility

SecuPress can be activated for all subsites from the main site in a multisite network. The listing states compatibility with WordPress caching and multilingual plugins, and names hosts including o2switch, OVH, SiteGround, Bluehost, PlanetHoster, WP Engine, and GoDaddy. It also states that SecuPress is not compatible with another security plugin and recommends removing other security plugins before activation.

Install and activate SecuPress in WordPress, then open SecuPress settings. Start with the scanner, review its grade and recommendations, and apply appropriate hardening actions before configuring login rules, firewall capabilities, alerts, scans, and scheduled tasks.