A concrete map of WordPress security in WP Umbrella: what every account gets, what the Security add-on adds for 2€/month per site, and what the add-on is not.
Site Protect became the Security add-on in July 2026, at the same price. If you knew Site Protect, the short version: everything it did is still here, and the scope grew. Details in the FAQ below.
Capability | Included on every plan | Security add-on (+2€/month per site) |
Vulnerability monitoring (Patchstack database, checked every 6 hours) | ✅ | |
Vulnerabilities grouped by plugin/theme/core, with severity scores, one-click fixing update, re-scan on demand | ✅ | |
Site Health checks with dismissible warnings | ✅ | |
Security hardening toggles, per site (application + .htaccess level) | ✅ | |
Activity Log for platform operations (what happens inside WP Umbrella) | ✅ | |
Uptime, PHP error, and performance monitoring | ✅ | |
Firewall & virtual patching (blocks exploits before you can update) | ✅ | |
Firewall insights (attacks blocked, top IPs, top rules) | ✅ | |
Malicious-IP blocklist at login, learned across the whole WP Umbrella network | ✅ | |
Security-Driven Activity Log (attack detections on the sites themselves, with evidence) | ✅ | |
Daily malware scanner (flags known malicious files) | ✅ | |
Malware cleanup, on demand | ✅ |
Vulnerability monitoring. Every site is checked against Patchstack's vulnerability database every 6 hours. Known issues are grouped by plugin, theme, and WordPress core, each with a severity score, the vulnerability type, the affected versions, and the version that fixes it (shown even before that update is released). When the fixing update is available, it is one click away.
The panel also keeps a resolved-vulnerabilities counter, so you can show clients what was handled, and a re-scan button when you don't want to wait for the next automatic check.
Site Health with dismissible warnings. SSL, WordPress version, PHP version, search-engine indexability, WP_DEBUG, inactive plugins and themes. Checks are split into "Attention needed" and "Passed". Warnings you have consciously accepted (a PHP version pinned by the host, for example) can be dismissed, so the panel stays a real to-do list.
Security hardening, per site. Toggles that close the doors attackers try first:
Hide your WordPress version. Removes it from your site's HTML and feeds, so attackers can't target version-specific exploits.
Block user enumeration. Stops bots from listing your usernames through author pages and the REST API, a common first step before a brute-force attack.
Mask login error messages. Shows one generic message on failed logins, so attackers can't tell whether a username exists.
Disable the theme and plugin file editor. Removes the built-in code editor from wp-admin, so a compromised account can't inject PHP.
Add security headers. Sends hardening HTTP headers such as X-Frame-Options and X-Content-Type-Options against clickjacking and content sniffing.
Rate-limit login attempts. Throttles repeated failed logins from the same source.
Disable XML-RPC. Closes the endpoint attackers abuse for brute-force amplification and pingback attacks. Leave it off if the site relies on the WordPress mobile app or Jetpack.
Protect your uploads folder. Blocks PHP files from running inside your uploads folder, a common malware hiding spot, with an automatic safety check that rolls back on the rare server setups it breaks.
One more toggle sits in the same Hardening section: blocking known malicious IPs at login. That one is part of the Security add-on, because it draws on the network-wide blocklist described below.
The platform Activity Log. Who on your team did what inside WP Umbrella, and when.
These are the visibility and hygiene layers: they tell you what's exposed, close the common doors, and track changes. The add-on is the active protection layer on top.
Four components, enabled together with sensible defaults. When the add-on is active, the Site Health header confirms it: "This site is protected. We're blocking known exploits, applying hardening, and logging changes in the background."
Firewall & Virtual Patching (powered by Patchstack). Blocks exploitation of known vulnerabilities at runtime, before the fixing update is applied or even released, plus common attack vectors: file access probes (readme.txt requests, for example) and attempts to run PHP inside /wp-content/uploads/ or /wp-includes/. The insights view shows attacks blocked over the last 30 days, the top blocked IPs with their countries, and the rules that caught them.
Network-learned IP blocklist. WP Umbrella runs a self-learning module that watches login attacks across every site on the platform and continuously builds a shared blocklist of malicious IP addresses. Once an IP is flagged anywhere on the network, it is blocked on your login page in advance, before it ever reaches your site. The toggle lives in the Hardening section, marked "Included in Security add-on".
The Security-Driven Activity Log. Watches what happens on the WordPress sites themselves and raises detections across eight checks: brute-force attempts, new admin accounts, sign-ins from new locations, file integrity (WordPress core and theme files verified against their expected versions), critical settings changes (site address, admin email, registration), mass content deletion, hidden administrator accounts, and .htaccess changes.
Findings are split into "Needs attention" and "All clear", and every alert carries its evidence: the accounts involved, the IPs, the timeline, and a recommended response. Below the detections, a searchable stream records every event and filters by period, severity, component, and user.
Daily malware scanner (released July 2026). Scans the site every day and flags known malicious files, so an infection that slipped past prevention stops being invisible. The Malware section lists every flagged file, keeps a count of scans performed, and confirms in plain words when the latest scan found nothing. Files you have verified yourself can be dismissed into their own list. And if the scanner flags a real infection, malware cleanup is available on demand: contact support and the team takes it from there.
Price: 2€ / $2 per site per month, on top of your per-site subscription. Per site means you can protect the sites that need it without paying for the ones that don't.
How to enable: in bulk from the main dashboard or the security bulk view, or site by site from the Security tab (the switch sits in the Site Health header). Enabling turns on all four components with recommended defaults; every piece can then be adjusted per site, since the firewall, the activity log, and each hardening toggle have their own switches.
Honesty section. The add-on is not:
A DNS or CDN-level firewall. It works at the PHP level, on the site. It complements (and runs happily alongside) Cloudflare and hosting-level protections; it doesn't replace DDoS mitigation.
A replacement for updates. Virtual patching buys you time between a vulnerability's disclosure and your update. The durable fix is the update, and WP Umbrella's safe updates (included) are the other half of that workflow.
A replacement for backups. Protection reduces risk; it never makes recovery unnecessary. Backups are included on every account, and they stay your last line of defense.
Why the rename from Site Protect?
The scope outgrew the name. Site Protect was virtual patching plus a set of invisible background hardening rules. Today the hardening rules are visible toggles included on every plan, and the Security add-on is four components: the firewall, the network-learned IP blocklist, the Security-Driven Activity Log, and the daily malware scanner.
I was paying for Site Protect. What changes for me?
Nothing on the invoice: same price, 2€/month per site. Your virtual patching never stopped. The capabilities added since (the firewall insights view, the IP blocklist, the Security-Driven Activity Log, the malware scanner) are included at no extra cost. Visit each protected site's Security tab to check they're switched on and tuned to that site.
Did any Site Protect protection disappear?
No. Everything Site Protect blocked is still blocked. The background hardening rules became visible toggles in the Hardening section (on by default where they were on before, and now included on every plan), and proxy comment blocking lives in the firewall rules.
When does the malware scanner run?
Daily. On a newly protected site, the first scan runs right after the next backup completes. Each scan refreshes the flagged-files list and the scan counter in the Malware section.
The scanner flagged a file I know is safe. What do I do?
Dismiss it. Dismissed files move to their own tab and stop counting as open flags. If you are not sure whether a file is safe, ask support before dismissing.
The scanner found malware. Now what?
Contact support: malware cleanup is available on demand, and the team handles the removal with you. Your backups remain the recovery path for the worst cases.
Do I still need Wordfence, Sucuri, or Solid Security on the site?
No. The add-on replaces in-WordPress security plugins with a more comprehensive security suite (firewall, hardening, attack detections, daily malware scanning) managed from one dashboard for all your sites, and it does not impact site performance.
Where do I see all of this in the dashboard?
Each site has a Security tab with sub-sections: Site Health, Vulnerabilities, Firewall, Hardening, Activity Log, and Malware.
What happens if I disable the add-on on a site?
Virtual patching rules are removed, the network-learned blocklist stops protecting the login page, and security detections and daily malware scans stop. The layers included in your plan (vulnerability monitoring, Site Health, the hardening toggles, the platform Activity Log) keep working. You can re-enable anytime; everything is reapplied immediately.
