Rather than scanning files on your WordPress site’s servers, MalCare copies your files to its own servers and runs the scan there. Running scans on your own server can consume a lot of resources, so this approach is a little more performance-friendly. This is the same approach used by the VaultPress service from Automattic/Jetpack.
Additionally, you’ll manage your site’s security from the MalCare cloud dashboard, rather than your WordPress dashboard.
MalCare is from the same developer as the popular BlogVault backup service, and you can integrate the two services so that you can have one solution handle both backups and security.
Sucuri vs Wordfence vs MalCare: Security Features
Now that you know the basic approaches, let’s compare some of the specific features that each tool offers across four broad categories:
- General security hardening
- Website firewall
- Login protection
- Malware scanning
Security hardening
By “security hardening”, I mean basic tweaks that make your WordPress site more secure.
Sucuri
Sucuri includes a Hardening Options area that makes it easy to implement basic tweaks like blocking PHP files in certain directories, disabling in-dashboard file editing, and more:
Wordfence
A lot of Wordfence’s hardening rules fall into the other categories (e.g. login protection and the firewall), but it does still include some general hardening principles like:
- Disabling code execution in the uploads directory.
- Hiding your WordPress version.
MalCare
MalCare divides its security hardening into three categories:
- Essential – blocking PHP execution and disabling file editing.
- Advanced – blocking theme/plugin installation.
- Paranoid – changing security keys and resetting all user passwords.
Web application firewall (WAF)
A web application firewall (WAF), helps proactively protect your website by filtering requests before they hit your WordPress site. Think of it kind of like a wall between your website and the Internet at large. The gate is open to regular users, but malicious actors get stopped before they can enter.
While lots of WordPress security plugins list a WAF as a feature, a WAF is really only as good as the rules and policies that it uses to filter traffic. As the nature of malicious attacks are constantly changing, you also want a solution that will update its rules to keep your site secure.
Sucuri
Sucuri’s paid firewall service is both a WAF and a CDN in one (kind of like Cloudflare). It helps proactively protect your site by filtering traffic to your site, including protection against zero-day exploits. It also helps ensure global availability and faster page load times via the CDN network.
The combination of firewall and CDN is unique as far as the plugins on this list go, and Sucuri has a great reputation when it comes to the quality of its firewall service.
Wordfence
Wordfence includes a WAF in the free version at WordPress.org that protects against both general attacks and WordPress-specific attacks. It also updates the firewall rules to protect from newly-discovered attacks.
However, if you want access to the latest firewall rules right away, you’ll need to pay for the premium version of Wordfence. If you use the firewall in the free version, there’s a 30-day delay before those rules are added to the firewall. This is a big part of how Wordfence monetizes the plugin, as the free version is otherwise almost full-featured.
MalCare
MalCare advertises a firewall, but it doesn’t seem to be as comprehensive as Sucuri or Wordfence. MalCare’s firewall can help block malicious IP addresses, which is certainly helpful. But it doesn’t seem to have the same type of regularly-updated ruleset that you get with Sucuri or Wordfence.
Login protection
The best security in the world can’t stop a hacker if they walk in the front door. That is, if hackers can use your login page to access a real WordPress administrator account, they can do whatever they want.
Brute force attacks are a common attack vector, so you’ll want to lock down your WordPress login page to keep things secure.
Sucuri
Sucuri can help protect your login page from malicious actors with its firewall, but it doesn’t include any CAPTCHA, limiting login attempts, or two-factor authentication functionality.
If you want additional login protection, you’ll want to pair it with a different plugin.
Wordfence
Wordfence offers the most comprehensive suite of login protection options on this list, including two-factor authentication, which none of the other plugins offer.
For two-factor, you can enable two-factor for specific user roles and also require administrators to use two-factor.
You can also add a CAPTCHA to your login and registration pages via reCAPTCHA v3, which doesn’t require users to perform any action unless their browser fails.
In addition to the Wordfence firewall, other login protection features include:
- The option to limit login attempts and block IP addresses after a certain number of failures.
- Ability to enforce strong passwords for users and check password strength when a user updates their profile. You can save your strong passwords in a password manager.
- Rate limiting.
MalCare
MalCare can help protect your login page via its firewall, and it also can help you add a CAPTCHA to your login page. However, it doesn’t support two-factor authentication or limiting login attempts.
Malware scanning
All three plugins offer malware scanning, but they go about it in different ways.
Sucuri
Sucuri offers malware scanning in both the free plugin and the paid service.
In the free plugin, you can monitor the integrity of your core WordPress files and also run malware scans via the free SiteCheck tool. You don’t actually need the plugin to run these scans – you could just plug in your site’s URL.
It’s important to understand that, with the free plugin, Sucuri only checks the front-end files on your site. Because it’s not checking the actual files on your server, it won’t be able to find 100% of all malware. Learn more here.
However, with the paid service, Sucuri runs server-side malware scanning, which can identify vulnerabilities in files that might not appear on the front-end of your site. So if you want the most comprehensive malware scanning, you’ll need to pay for the premium service.
Wordfence
Wordfence lets you run malware scans from right inside your WordPress dashboard – all you do is click Start New Scan:
Then, Wordfence will scan the files on your server. The scan checks for more than just malware – it will also check for basic issues, like out-of-date plugins and weak passwords:
You can run full malware scans with both free and paid versions. The only difference is that the premium version gets real-time malware signature updates, while updates to the free version’s malware signatures are delayed by 30 days.
MalCare
Malware scanning is MalCare’s core feature, so the plugin has a heavy emphasis on scanning your site’s files.
Again, the unique thing about how MalCare runs malware scans is that it copies your files to an off-site location and scans them there, rather than using your server’s resources to run scans.
If you have the premium version, MalCare also offers one-click malware cleaning, which is another strong point of this service when it comes to malware scanning.
Comparing setup and ease of use
All those security features above are only important if you’re able to implement them, so, unless you’re a technical user, it’s important that it’s easy for you to set everything up and get the plugin working.
Beyond that, if you’re managing the security for multiple WordPress sites, it’s helpful to be able to do that from a single dashboard, which some of these tools allow for.
In this section, I’ll compare:
- How the plugin works on a single site.
- Whether or not the plugin lets you manage multiple WordPress sites from one location.
Setting up a single WordPress site
Sucuri
There are potentially two parts to setting up Sucuri, depending on whether you’re using the plugin, the firewall service, or both.
Setting up and using the plugin is simple. To get started, you can install the free plugin from WordPress.org.
Then, you can head to the Sucuri Security tab in your WordPress dashboard to view results and configure settings:
Sucuri does a good job at making it easy to see the state of your website in the sidebar:
If you want to use the premium Sucuri firewall service, you’ll need to sign up for a Sucuri account and point your domain’s nameservers to Sucuri. You can change your nameservers wherever you registered your website’s domain name. This step is a little more technical, but it’s what lets Sucuri filter traffic before it hits your site and speed up your site with a CDN.
Wordfence
To get started with Wordfence, you can install the free plugin from WordPress.org. Then, Wordfence will prompt you to enter your email address to receive security alerts.
Then, when you go to the Wordfence tab in your WordPress dashboard, Wordfence will give you this handy intro wizard to show you where important features are:
You’ll also get similar guides when you access other features, like Wordfence’s firewall or scanning tool.
In general, the Wordfence dashboard also does a good job of telling you what you need to do. You’ll get prompts to configure important functionality (1) as well as notifications keeping you updated with important issues (2):
So while Wordfence does include a lot of features, the way that they’ve designed the dashboard helps you understand what everything does and what you need to pay attention to.
MalCare
There are two parts to MalCare – the free plugin at WordPress.org and the MalCare cloud dashboard.
To get started, you’ll install the free plugin. Then, you’ll enter your email to start the sync process with the MalCare cloud dashboard:
From there, you’ll manage everything else in the MalCare cloud dashboard – not your WordPress dashboard:
With the premium version, you’ll get more options in this dashboard, like the ability to configure the aforementioned hardening settings:
Managing multiple WordPress sites
Sucuri
Sucuri has special agency plans for web professionals if you’re managing multiple websites with the Sucuri firewall service or security platform.
However, there’s not a tool for managing multiple websites with the free plugin at WordPress.org – you’d need to do that on a site-by-site basis.
Wordfence
If you’re managing multiple WordPress sites with Wordfence, Wordfence includes a tool called Wordfence Central that lets you manage all of those sites from a single unified dashboard:
In addition to seeing a snapshot of each site’s status and potential issues, you can also create security templates and apply them to multiple sites, which is really convenient if you want to make a change across multiple sites.
MalCare
If you connect multiple sites to your MalCare account, you can manage all of them from the same MalCare account:
You can also add tags to help you organize sites.
Because you already use the MalCare cloud dashboard to configure everything, it’s quite convenient to manage multiple sites.
MalCare also includes white-labeling and reports if you’re working with client sites.
Comparing pricing and license options
Finally, there’s the issue of price. All three tools have limited free versions with premium versions/features.
Sucuri
The plugin version of Sucuri is 100% free. You’ll only need to pay if you want to subscribe to the Sucuri firewall and CDN service or to the broader Sucuri security platform.
First, you can pay for just the firewall and CDN, which will cost you $9.99 per month per WordPress website. However, this plan does not include malware scans and hack cleanup.
If you want those services, you’ll need the full Sucuri platform, which starts at $199.99 per year for a single website.
You can also add an automatic backup service for an extra $5 per month.
Wordfence
The core Wordfence plugin is free and available at WordPress.org. By itself, it gives you access to all of the features you saw above. However, remember that there are some important differences between the free and premium service.
With the free version, you have to wait 30 days for updates to Wordfence’s firewall rules and malware scanning signatures. So while you’ll be protected against known threats, you won’t necessarily have protection against threats that have been discovered within the past 30 days.
If you pay for Wordfence premium, you’ll get real-time updates, as well as support for country blocking and more frequent scans.
Wordfence Premium plans start at $99 per site, but you can save money if you buy for more sites or pay for multiple years upfront.
MalCare
The free MalCare plugin at WordPress.org gives you access to basic malware scanning.
However, for access to all of the security hardening features, one-click malware removal, and some other features, you’ll need a paid plan.
Paid plans start at $99 per year for a single site.
Conclusion: Sucuri vs Wordfence vs MalCare
That wraps up the meat of our Sucuri vs Wordfence vs MalCare comparison.
I don’t think there’s a single “best WordPress security plugin” here as each tool has a slightly different approach.
Wordfence has the most generous free version, as it gives access to pretty much all the functionality for free and covers everything from hardening to two-factor authentication to malware scans and a firewall. If you’re exclusively looking for a free security plugin, it’s probably the best option for you.
Sucuri’s free WordPress plugin is a good option for basic security hardening, but most of the proactive measures are in the premium Sucuri services. You can buy the standalone firewall/CDN service or spring for the more expensive security platform. While the full security platform is the priciest option on this list, it comes with the peace of mind of malware removal and hack cleanup.
Finally, MalCare offers the unique approach of scanning your files off-site, which lessens the resource hit on your server. Its core focus is on malware scanning and removal, but it still includes some other security features like basic hardening and a firewall. You can also integrate it with the BlogVault service for even more peace of mind.
Do you have any questions about deciding between Sucuri vs Wordfence vs MalCare? Ask away in the comments!
