Confused about Sucuri vs Wordfence, don’t worry I will tell you which one of these will be the best WordPress security plugin for you.
Both of them are good in protecting WordPress websites but we only need one.
So how to pick one that suits our requirements. I compared both and provided you full information based on these points
- Introduction to Sucuri & Wordfence and how they work
- Comparison of Essential Security Features
- Pricing of Wordfence & Sucuri
You can also read about Solid Security vs Wordfence.
How Sucuri & Wordfence Works
Overview of Sucuri
Sucuri is a cloud-based website security and performance service since 2009. It was acquired by GoDaddy in 2017 but continues to operate as a standalone brand.
It protects your website from online threats, removes malware and hacks, provides WAF (Website Application Firewall), and stops DDoS attacks.
They not only protect your website but also speed up your website with their CDN (Anycast) available with all paid plans.
They claim to have 100% guaranteed protection with 99% support ticket satisfaction (Of course for paid service)
Source: Sucuri.net
How Sucuri Works
To understand the workings of Sucuri we have to differentiate between free and paid versions.
Free Option – It is a free WordPress plugin available in the WordPress repository known as “Sucuri Security – Auditing, Malware Scanner, and Security Hardening”
This free plugin has more than 800,000+ Active Installations. It provides basic WordPress security hardening, post-hack recommendations, regular email alerts, and security logs.
Paid Option: It is a cloud-based service that provides the following.
- Support – 24/7/365 ticketing system, dedicated account management, SSL certificate support, etc.
- Monitoring & Detection – Security scans, malware detection, file change detection, DNS & SSL monitoring, etc.
- Protection – Using WAF, Intrusion Detection System (IDS). DDoS, Brute force protection, and block hack attempts.
- Response – Hack cleanup, malware removal, full website cleanup, Quarantined Backups, and Post-cleanup recommendations.
- Performance – CDN and smart caching options.
I will explain how you can use Sucuri Free and also improve your WordPress security with the paid version. I will also explain what are the essential features a security plugin should have and whether Sucuri Free has those or not.
Overview of Wordfence
Wordfence is the most popular Security plugin protecting WordPress websites across the world. They claimed that they block 290M attacks every day and approximately 8.7B in the past 30 days across their network.
Source: Wordfence.com
They are incorporated as Defiant Inc. in Delaware and their headquarters is in Seattle, Washington. They have a team of 40 people based in USA, Europe, UK, and Australia who work remotely.
How Wordfence Works
Similar to Sucuri, Wordfence also has free and paid options.
Free Option
The free plugin is known as “Wordfence Security – Firewall, Malware Scan, and Login Security” and has the highest number of active installations on WordPress for any security plugin.
Wordfence has 5+ million active installations with 4172 reviews and a 4.5-star rating.
Wordfence Free has a Firewall, Malware scanner, file change detection, theme/plugin vulnerability monitoring,
Login Security, and a regular alert system to protect your website.
I think no security plugin has this much number. If you know about any please do comment below.
On the basis of my experience with Wordfence, I can say if you are looking for a free plugin to secure your website, Wordfence can be the best choice for you.
Yet it lacks some features but still, it has a lot of features that only paid plugins offer. Recently I compared Wordfence with Solid Security which can give you more information about which plugin to choose.
Paid Option
Wordfence paid option provides features like
- Real-time IP Blocklist
- Country blocking
- Installation, configuration, and optimization
- Security Audit
- Malware cleaning
- Brute force protection
- Hands-on Support
- Along with Wordfence-free features
Essential Security Features
- Malware Scanning
- Firewall Protection
Malware Scanning
Malware scanning is something that gives us the feeling of regular antivirus that we use for our computers and mobile.
It gives us the satisfaction that we can scan our website anytime we want. The malware scanners in Wordfence and Sucuri may find the malware in their free versions can be debatable but yes both have malware scanners.
Wordfence
Wordfence uses signature matching to catch malware on your website. But how it works, actually it compares your website’s code to a database of malware signatures and flags any file that matches with malware signatures as malware.
They have malware scanners in both free and paid versions. But the paid version has real-time malware signature updates. Now real-time here means as soon as their team found a new malware in the universe they add it to their database of malware signatures. But if they skip it they may not catch it on your website. While the free version has malware signatures that are delayed by 30 days.
How does it Work
To use it simply go to Wordfence and click on Scan
Now click on the Start New Scan button to start malware scanning.
The scan will take some time as it will scan your whole website for malware, file changes, content safety, password strength, and outdated plugins/themes.
You can schedule automatic scans but Wordfence will decide when to scan in the free version. In the premium version, you can schedule when to scan your website.
Sucuri
Sucuri has two scanners
- Sucuri Sitecheck
- Server Scanner
Sucuri Sitecheck – It is an online site checker tool that does not scan the full website and is only able to scan common malware. You don’t need to install the plugin to use this tool.
Server Scanner – This scanner is available with the Sucuri plugin. Sucuri Sitecheck can only scan front-end files, server scanners can scan actual files on your server.
As opposed to Wordfence free you can schedule when and which files to scan. But Sucuri will warn you that “scanning your project files too frequently may affect the performance of your website.”
How it Works
To use Sucuri Sitecheck go to their site checker tool and enter your website URL. It will show the result like this.
To use the Sucuri Server Scanner
- Install Sucuri plugin
- Go to the Settings Tab under Sucuri Security and click on Scanner
- Now Select the files that you want to scan or simply select all files.
- Click on the Submit button to scan the website.
Note: To set automatic scheduling select other options from drop-down under Action.
- Go to Sucuri Dashboard to see the result of the scan.
This is how Sucuri plugin does Malware scanning.
Firewall Protection
WordPress security plugins have a firewall feature known as a web application firewall.
It acts like a wall between your website and internet traffic.
It’s a kind of security system that monitors, filters and blocks HTTP/HTTPS traffic to and from a web application.
You must have a WAF (Web Application Firewall) to protect your website from cyber threats, including cross-site scripting (XSS), SQL injection, and file inclusion.
It should act in a way that it allows your regular kind of traffic and stops spammy traffic to protect your website.
Is it different from traditional firewalls?
Suppose you heard about the OSI network model. In that case, WAF focuses on the 7th Layer i.e. Application layer while traditional firewall focus on the 3rd and 4th layers i.e. Network layer and Transport Layer.
Source: Cloudflare
Wordfence
Wordfence has WAF in both free and paid versions. Its free version firewall is pretty decent to protect you from unknown threats.
However, the effectiveness of any WAF depends on the firewall rules. The free firewall gets a rule update after 30 days while premium users get it instantly.
Another difference between the free and premium versions is that the free version’s firewall loads as a regular plugin after WordPress has loaded. For the best protection of the website, the firewall should load before the website loads.
How it Works
When you install Wordfence for the first time it will go into learning mode. It is recommended step to keep Wordfence in learning mode for at least one week. During this time firewall understands what is your regular traffic and after learning mode, it only allows that kind of traffic and stops malicious traffic.
You can start configuring Wordfence in learning mode.
Go to Wordfence > Firewall > All Firewall Options
Here click on Optimize the Wordfence Firewall button
When you first install Wordfence firewall loads as a regular plugin after WordPress loads. For the best protection of the website, the firewall should load before the website loads. To load Wordfence firewall before WordPress follow steps given below
When you click on the button it will ask you to download htaccess file to keep a backup. Download file and click on continue button and you are done.
Now you have an optimized firewall and now the firewall will load before WordPress.
Keep all other changes as it is and click on the Save button in the top right corner.
Sucuri
Sucuri’s free version does not have a firewall option. But their paid firewall option is a very popular one.
For Bloggers and small website owners, they have a Firewall with CDN plans that start from $9.99 per month.
Their firewall can stop vulnerabilities like unrestricted file uploads, XSS, and SQL injections.
Their firewall + CDN service acts like a layer between incoming traffic and your website. This means all the traffic will first hit Sucuri’s firewall and then redirected
to your website.
CDN ensures faster page loading speeds and global availability with extra cost.
How it Works:
As you can see in step 3 you have to change your DNS records to activate the firewall.
It means your domain will point to Sucuri first, traffic will be analyzed here, and then only allowed will reach out to your website.
This step requires expertise with name servers and DNS configuration. If we compare it with Wordfence Care and Wordfence Response they do all the installation works but they are a bit costly which will be covered in the pricing section.
Pricing
Both Wordfence and Sucuri have free versions. However, their paid versions have different plans for different users.
Sucuri
In the paid version of Sucuri, you will get two options
- Firewall with CDN
- Website Security Platform
Firewall with CDN:
This is the cheaper option in which you will get a Website Application Firewall (WAF) and CDN Speed Enhancement. This plan starts with $9.99 per month for one website. This is very basic plan and you will not get advance security options like malware and hack removal service, SLA to remove malware (remove malware time frame starts from 30 hours), advance security scans and blocklist monitoring etc.
To get these advanced security services you have to choose one of their Security Platform Plans that starts from $199.99 per year.
Wordfence
Wordfence free version has many features of paid version but firewall rules and malware signatures are delayed by 30 days.
So some new malware discovered in past 30 days attack on your website you will not get the protection.
To get real-time firewall rules and malware signature updates along with IP Blocklist, Country Blocking, Customer Support and many other feature you will have to upgrade to Wordfence premium.
Their basic plan starts from $119 per year. The basic plan pricing is less than that of Sucuri but as you go for higher plans Wordfence costs more than Sucuri.
Conclusion
Both Sucuri and Wordfence are good choices for WordPress website security.
If you are looking for a free plugin for basic website security then Wordfence free is the best option.
If you are looking for paid option with basic Firewall and CDN to secure and speed up your website, Sucuri firewall with CDN plans that starts from $9.99 are the good options.
For more advanced security you can choose Sucuri’s full security plan.
