Ensomedia Security vs All-In-One Security
All-In-One Security (AIOS) is a WordPress security plugin from Team Updraft, the makers of UpdraftPlus, with login security, firewall rules, spam blocking and an audit log in the free version. Ensomedia Security is a new scanner from the team behind shieldwave.io. This page puts the two side by side, with the facts we could check and the date we checked them. It starts with what our plugin does not do.
- Compared
- Ensomedia Security 1.1.28 (22 October 2026), All-In-One Security 5.4.10 (WordPress.org, updated 17 September 2026) and the AIOS Premium price page
- Checked on
- 22 October 2026
- Installs
- All-In-One Security: 1,000,000+ active installs, rated 4.7 from 1,718 reviews. Ensomedia Security: listed since 28 September 2026, fewer than 10 active installs, no reviews yet.
- Who wrote this
- ENSOMEDIA, which makes Ensomedia Security and runs shieldwave.io. We are not neutral, so every fact has a source below.
What Ensomedia Security does not do
- Its firewall is new. AIOS ships .htaccess rules, PHP rules and the 6G blacklist rules from Perishable Press in the free version, and blocks fake Googlebots. Our request firewall arrived in 1.1.26 on 21 October 2026, is off by default and records only until you switch it to blocking.
- No backups and no database prefix change. AIOS runs a database backup through UpdraftPlus and can change the
wp_table prefix. Ensomedia Security does neither; it only reports when no backup from the last 7 days is found. - No country lookup of its own. AIOS Premium blocks countries with its own address data. Our firewall blocks countries only when your server or a CDN you set as trusted supplies the visitor's country.
- No uptime monitoring in the plugin. AIOS Premium checks uptime every 5 minutes. Our plugin does not; uptime monitoring is in the Pro plan on shieldwave.io.
If those are what you need, AIOS has them and ours does not.
Side by side
| Feature | Ensomedia Security (free) | AIOS (free) | AIOS Premium |
|---|---|---|---|
| Price | 0. The shieldwave.io dashboard is free for every connected site. Pro is 12 USD a month per account and adds the outside scan of up to 25 sites, monitoring and reports | 0 | 89 USD a year for 2 sites, 149 for 10, 249 for 35, 349 for any number, before VAT. The first year was offered at half price when we read the page |
| Malware scan | On your server, daily or weekly: 57 built-in signature rules, checks for injected scripts, files, posts and options | No | Automatic scan every week |
| Core, plugin and theme files | Compared with the copies WordPress.org published for your versions | File change scanner, with folders you exclude | As the free version |
| Known vulnerabilities | Opt-in lookup through shieldwave.io; the data comes from Wordfence Intelligence | Not on the pages we read | Not on the pages we read |
| Request firewall | Since 1.1.26, off by default, records only until you switch it to blocking. Loads from a must-use file, or before WordPress through auto_prepend_file on PHP CGI and FastCGI hosts. General rules updated with the plugin | .htaccess rules, PHP rules, 6G blacklist rules, fake Googlebot blocking | As the free version |
| IP and country blocking | Opt-in in the firewall: addresses and ranges you enter; countries when the server or a trusted CDN supplies the country (Cloudflare's address ranges are built in since 1.1.28) | Blacklist and whitelist of IP ranges and user agents | Adds country blocking for the whole site or single pages |
| 404 limits | Opt-in in the firewall | No | Smart 404 blocking |
| Virtual patches | From a signed feed, for known vulnerabilities of installed plugins, after you accept the protection offer | Not on the pages we read | Not on the pages we read |
| Login limits | Per address and per user name, and on password reset requests | Failed attempts and lockout time you choose | As the free version |
| Two-factor login | Authenticator app, recovery codes, required for the roles you choose | Authenticator app, required for the roles you choose | Adds emergency codes, trusted devices and other login forms such as WooCommerce |
| Passkeys | As the second step, or opt-in to sign in without a password | Not on the pages we read | Not on the pages we read |
| Bot check on login | Opt-in: a proof of work in the browser, or Cloudflare Turnstile with your own keys | CAPTCHA; the changelog names Cloudflare Turnstile and Google reCAPTCHA | As the free version |
| Custom login address | Opt-in, with a way back through wp-config.php or WP-CLI | Rename Login Page | As the free version |
| Spam | Opt-in traps on comments, registration, Contact Form 7 and WPForms | Blocks comment spam from bots, blocks addresses after a number of spam comments, registration honeypot | As the free version |
| Activity log | Free. Sign-ins, accounts, role changes, who edited a post or page, plugin and theme changes, key settings, with a keyed hash chain and CSV export | Audit log: plugins and themes added, removed or updated, and more | As the free version |
| Sessions | See where you are signed in, sign out other sessions or every user | Active sessions, forced logout after a set time | As the free version |
| Backups | Makes none. A check reports when no backup from the last 7 days is found | Database backup through UpdraftPlus | As the free version |
| Repair and cleanup | One button for core, plugin and theme files from WordPress.org; injected code removed after you approve the exact change. A one-time cleanup by ENSOMEDIA can be ordered, quoted per case | No | Advice and support for malware removal by email |
| Uptime and blocklists | Not in the plugin. The Pro plan on shieldwave.io has uptime monitoring, and the outside scan checks public blocklists | No | Uptime every 5 minutes, response time, Google blacklist alert |
| Data sent from the site | Nothing until you turn on a connection; each one is listed in the readme | Its description says no information is sent to third parties | Not stated on the price page |
| Support | WordPress.org forum of the plugin | WordPress.org forum | Email support, most answers within 24 hours |
What Ensomedia Security does differently
- The malware scan is free. In AIOS the malware scan is a Premium feature and runs weekly. In Ensomedia Security it is in the free plugin and runs daily or weekly, at the hour you choose.
- Files are checked against official copies. Core, plugin and theme files are compared with what WordPress.org published for your version, so a changed file shows even if it was changed before the plugin was installed.
- Nothing changes on its own. Files, users and settings change only when you press a button or turn on a switch. Every connection to shieldwave.io is off until you turn it on.
What each feature sends, and to whom, is on How it works and in the readme on WordPress.org.
Sources
- All-In-One Security on WordPress.org, wordpress.org/plugins/all-in-one-wp-security-and-firewall, version 5.4.10, updated 17 September 2026, read 22 October 2026: free and Premium features, the changelog (CAPTCHA, Rename Login Page, registration honeypot), the privacy note, installs and rating.
- AIOS Premium pricing, teamupdraft.com/all-in-one-security/pricing, read 22 October 2026: plans, sites per plan, prices, malware scan, uptime, country and 404 blocking, support times.
- Ensomedia Security: the plugin's code, version 1.1.28 of 22 October 2026, and its readme on WordPress.org. Plan prices: shieldwave.io/pricing.
Something here out of date or wrong? Write to support@shieldwave.io and we will correct it.