Sucuri Firewall + WordPress Security Plugin helps administrators review WordPress security activity, check file integrity, scan remotely for malware and blocklist status, and apply hardening guidance. A Sucuri Firewall account and its WAF API key are required for firewall management and vulnerability scans.

Monitor activity and file changes

After installation, generate the plugin API key to activate event monitoring. Audit logs record security events such as user logins and content changes. Administrators can search and filter entries by date, event type, severity, add-on, or theme, then export the audit trail as a CSV file. Sucuri says these logs are not stored in the WordPress database.

File integrity monitoring makes a known-good baseline when the plugin is installed, covering directories at the root of the WordPress installation, including core files, plugins, and themes. Later checks compare files with that baseline and report added, modified, or removed files.

Run remote checks and review alerts

The remote malware scanner checks the website as a regular visitor would. It looks for known malware, viruses, malicious code, blocklist status, website errors, and outdated software. Blocklist monitoring checks multiple services and reports when a site is flagged. Customizable security alerts let administrators pick which events to receive and how often.

The Hardening section offers recommendations that can depend on the hosting environment. Examples include disabling the plugin and theme editor, blocking PHP files in upload and WordPress directories, and updating secret keys. If a compromise occurs, the Post-Hack section guides administrators through updating secret keys, resetting user passwords, resetting installed extensions, and updating plugins and themes.

What a Firewall account includes

The Website Firewall runs in the cloud and does not require this plugin. Connecting the plugin with a valid WAF API key lets administrators view and manage supported firewall settings in the WordPress dashboard. The firewall is described as addressing denial-of-service and DDoS attacks, software vulnerability exploitation, zero-day disclosures, and brute-force attacks against access controls. Its listed capabilities also include performance optimization, advanced access control, failover, and redundancy.

The connected account also unlocks vulnerability scans for WordPress core files, installed plugins, themes, and the PHP environment. These scans require a Sucuri Firewall account and its WAF API key.

Set up the plugin

Install and activate the plugin on the WordPress site. Open its dashboard and generate the plugin API key to enable event monitoring, then configure alerts, hardening settings, file system scanner paths, and API communication as needed. To manage firewall settings or use the additional vulnerability scans, enter the WAF API key in Firewall Management.