If you go to the official WordPress repository and do a quick search for security, you will find over 4,298 plugins with distinct categorizations and feature sets.
We’ll break down the categories and explain their importance so you can find the right solutions for your needs.
Prevention Category
These plugins provide a perimeter defense for your website. Their objective is to stop hacks from happening by filtering incoming traffic.
Attacks against server software cannot be prevented with security plugins, which is why we recommend considering a cloud-based WAF instead.
Detection Category
These plugins will attempt to identify intruders through file integrity checks, scanning for indicators of compromise, or a combination of the two mechanisms.
If the plugin is based on integrity checks, it needs to be installed on a fresh, known-good environment to use as a baseline.
Auditing Category
Security is not a set it and forget it undertaking. You have to invest time into the process and become acclimated with what is going on, who is logging in, what is changing, and when the changes are being made.
Auditing plugins can help you answer these questions by offering basic administration features that help you identify, thwart, or respond to a compromise.
WordPress Security Tip
Detection plugins are important in identifying if something has gone wrong on your website. These tools ensure that you’re informed when a security incident occurs.
Utility Category
This is perhaps the most diverse bucket of the entire WordPress security plugin ecosystem.
These plugins can be exhaustive in their security configuration options. They have every possible configuration you could ever want to employ.
Utility plugins are best suited for users who like to tinker or want the ability to configure specific options to meet their needs. For example, some security plugins simply disable XML-RPC or move your login page.
We also reserve this category for toolsets like backups or maintenance plugins that address specific security functions.
