A free WordPress security plugin: what should it check, and what should it never do?

The WordPress.org directory lists many plugins with "security" in their name, and almost all of them have a free version. The descriptions sound alike, and you are not going to read the code. So how do you choose?

Below are five criteria you can judge yourself: from the directory listing, from the settings screen and from the first scan. After them comes a list of things a free plugin should not do, with references to the directory's own rules.

What a plugin can and cannot do

A security plugin works from inside your site. It sees the files on the server, the database, the user accounts and the settings. A scan from the outside cannot see any of that, so a good plugin covers the things that need access.

A plugin is still part of WordPress, though. Someone who takes over the site with administrator rights can switch it off or change its settings. That is why no plugin gives complete protection, and no honest one promises it. Treat it as one layer, next to updates, backups and checking the site from the outside.

1. It checks and reports, and changes things only when you say so

Most of the value comes from checks that only read:

• comparing WordPress, plugin and theme files with the official WordPress.org checksums for your version, which catches files that were tampered with,
• looking for PHP files in the uploads folder, where they have no business being,
• listing every account with administrator rights,
• finding files the server hands to anyone: copies of wp-config.php, database dumps, archives with a backup of the site,
• spotting settings that make a break-in easier: debug mode left on, the file editor in the admin panel, open user registration.

Changes, such as turning off XML-RPC or moving a file to quarantine, should happen only after you press a button. Automatic "fixes" can take a shop down: the plugin deletes a file it found suspicious, and the file turns out to be part of the theme.

How to check: look for a sentence in the listing saying the plugin changes nothing without your consent. After the first scan, see whether the results were only displayed or whether something has already been changed.

2. It does not slow the site down

A full file scan is real work for a server. A good plugin splits it into small steps in the background, skips files that have not changed, and does nothing heavy on every visit to your pages.

How to check: measure your load time in PageSpeed Insights before installing and a day after. Also look at your hosting panel, which usually shows CPU usage. If it rose clearly after the install and your host starts sending warnings, something is wrong.

3. It speaks plain language and does not cry wolf

Every finding needs three things: what it means, how serious it is and what to do. "Suspicious base64 string in file" with no explanation tells you nothing.

Alerts follow the same rule. A plugin that emails you about every trifle ends up, within a week, in a folder nobody reads. It is better when it writes only about problems that are new or got worse, and labels uncertain results as uncertain instead of sounding the alarm.

4. It keeps an eye on updates

Outdated plugins are the most common way into a WordPress site. There is more on this in the article about outdated WordPress plugins.

A good security plugin shows which plugin or theme has a known vulnerability and which version fixes it. It also warns about plugins closed in the WordPress.org directory or abandoned by their author, and reminds you that a deactivated plugin is still on the server. With that list you know what to update today and what to delete.

5. It gives you a path to the outside view

From the inside you do not see everything a visitor sees. Server settings, the email records in your DNS, the certificate as the internet sees it, forgotten subdomains: those are checked from the outside. A good plugin either requests its own site over the internet, for example to test whether files that should be private are reachable, or lets you connect to an outside scan.

The difference between the two views is explained in the article on online website security scanners.

What a free plugin should never do

The WordPress.org directory has detailed plugin guidelines. Several of them translate directly into what you can expect:

• It does not send data about you without consent. Guideline 7 says plugins may not track users without their consent. If a plugin talks to an outside service, its listing should name the service and say why.
• It does not take features away after a trial. Guideline 5 does not permit trialware in the directory, so a listed plugin should not stop working after a few days.
• It does not fill your dashboard with ads for the paid version. Guideline 11 says plugins should not hijack the admin dashboard. One notice about a paid plan is normal. Banners on every screen are not.
• It does not promise complete protection. A promise of total security is a sign to read the listing more carefully.

One option

I built one such plugin myself: Ensomedia Security in the WordPress.org directory, linked to ShieldWave. Judge it by the same five points as any other. The facts from its listing:

• it runs 23 checks, and every check, the scheduled scans and the email alerts are free, with no account and no limits,
• it compares files with the WordPress.org checksums and watches for changes in files WordPress.org cannot verify,
• it scans in the background in short steps and does not analyse unchanged files again,
• it changes files, users and settings only when you press a button or turn on a switch,
• it is not a full web application firewall and does not clean files for you: you, your developer or your host make the change it explains,
• it can optionally connect to the shieldwave.io dashboard, where the site appears next to its outside scan.

A screen by screen guide is in a separate article about the plugin.

What to do after installing any security plugin

1. Run the first scan and read the most severe findings first.
2. Update or delete plugins and themes with known vulnerabilities.
3. Go through the list of administrators and remove anyone who no longer works with you.
4. Schedule a scan. Once a week is enough.
5. Check the site from the outside to see what the plugin cannot.

Check your site from the outside. Enter your address at shieldwave.io. It takes about 90 seconds and needs no password and no plugin.