Ensomedia Security vs MalCare
MalCare is a WordPress security service that scans sites on its own servers and sells automatic malware cleanup in its paid plans. Ensomedia Security is a new scanner from the team behind shieldwave.io that scans on your own server. This page puts the two side by side, with the facts we could check and the date we checked them. It starts with what our plugin does not do.
- Compared
- Ensomedia Security 1.1.28 (22 October 2026), MalCare 6.76 (WordPress.org, updated 17 September 2026) and the MalCare pricing page
- Checked on
- 22 October 2026
- Installs
- MalCare: 100,000+ active installs, rated 4.4 from 557 reviews. Ensomedia Security: listed since 28 September 2026, fewer than 10 active installs, no reviews yet.
- Who wrote this
- ENSOMEDIA, which makes Ensomedia Security and runs shieldwave.io. We are not neutral, so every fact has a source below.
What Ensomedia Security does not do
- No automatic malware cleanup. MalCare Repair and Fortify remove malware from the dashboard, with a report afterwards. Ensomedia Security changes no file by itself: it puts back WordPress.org originals with one button, removes injected code only after you approve the exact change, and can move other files into quarantine. ENSOMEDIA cleans a hacked site only as a one-time service, quoted per case, with no published price or turnaround time.
- No shared list of attacking addresses and no bot protection. MalCare's paid plans block addresses in real time from its network and filter bad bots. Our firewall, added in 1.1.26 and off by default, acts only on the addresses and ranges you enter and on what your own site sees.
- The scan runs on your server. MalCare scans on its own servers, so the site does not do the work. Our scans run on your server in the background, in steps of a few seconds, with a low speed setting for busy shared hosting.
- No support with a response time. MalCare promises an expert reply within 72 hours on the free plan and faster on paid plans. We answer on the WordPress.org forum, with no promised time.
If you want malware removed for you on a subscription, MalCare sells that and we do not.
Side by side
| Feature | Ensomedia Security (free) | MalCare Free | MalCare paid plans |
|---|---|---|---|
| Price | 0. The shieldwave.io dashboard is free for every connected site. Pro is 12 USD a month per account and adds the outside scan of up to 25 sites, monitoring and reports | 0 | Protect 99, Repair 299, Fortify 499 USD a year for one site; 299, 899 and 1,499 USD for five sites |
| Account | Not needed | A MalCare account is needed to use the plugin | A MalCare account |
| Where the scan runs | On your server | On MalCare's servers | On MalCare's servers |
| Malware scan | Daily or weekly at the hour you choose: 57 built-in signature rules, checks for injected scripts, files, posts and options, opt-in signed feed of new rules | Every 7 days | Every 24 hours (Protect), 12 hours (Repair) or 1 hour (Fortify) |
| Core, plugin and theme files | Compared with the copies WordPress.org published for your versions | Not stated on the pages we read | Not stated on the pages we read |
| Known vulnerabilities | Opt-in lookup through shieldwave.io; the data comes from Wordfence Intelligence | Vulnerability alerts | Vulnerability alerts |
| Request firewall | Since 1.1.26, off by default, records only until you switch it to blocking. General rules updated with the plugin | Basic firewall | Advanced (Protect) or real-time (Repair, Fortify), with custom rules and OWASP protection |
| Virtual patches | From a signed feed, for known vulnerabilities of installed plugins, after you accept the protection offer | After 7 days | Yes |
| IP and country blocking | Opt-in in the firewall: addresses and ranges you enter; countries when the server or a trusted CDN supplies the country (Cloudflare's address ranges are built in since 1.1.28) | No | Geo-blocking and real-time IP blacklisting |
| Bot protection | Request and 404 limits in the firewall, opt-in | No | Yes |
| Repair | One button for core, plugin and theme files from WordPress.org; injected code removed after you approve the exact change, with a backup and an undo | No. The free plan finds malware but does not remove it | Automatic cleanup with a report (Repair), plus unlimited manual fixes (Fortify) |
| Malware removal by people | A one-time cleanup by ENSOMEDIA, ordered from the plugin or the dashboard, quoted per case | No | Unlimited manual security fixes in Fortify |
| Login limits | Per address and per user name, and on password reset requests | Login protection | Login protection |
| Bot check on login | Opt-in: a proof of work in the browser, or Cloudflare Turnstile with your own keys | CAPTCHA on the login page | CAPTCHA on the login page |
| Two-factor login | Authenticator app, recovery codes, required for the roles you choose, any number of users | For 2 administrators | For 5, 15 or all administrators by plan |
| Passkeys | As the second step, or opt-in to sign in without a password | Not on the pages we read | Not on the pages we read |
| Activity log | Free. Sign-ins, accounts, role changes, who edited a post or page, plugin and theme changes, key settings, kept 7 to 730 days | No | Not in Protect; 7 days in Repair, 60 days in Fortify |
| Certificate monitoring | Not in the plugin. The outside scan on shieldwave.io checks the certificate | SSL monitoring | SSL monitoring |
| Support | WordPress.org forum of the plugin | Expert reply within 72 hours | Within 48, 24 or 6 hours by plan |
What Ensomedia Security does differently
- No account and nothing sent by default. MalCare needs an account and scans the site on its servers. Ensomedia Security works without an account and sends nothing until you turn on a connection; each one is listed in the readme.
- Paid in MalCare, free here. Daily scans, two-factor login for any number of users and the activity log are in the free plugin. In MalCare they come with paid plans.
- Nothing changes on its own. Files, users and settings change only when you press a button or turn on a switch.
What each feature sends, and to whom, is on How it works and in the readme on WordPress.org.
Sources
- MalCare pricing, malcare.com/pricing, read 22 October 2026: plans, prices, scan frequency, firewall levels, virtual patching after 7 days on Free, cleanup, activity log, two-factor limits, response times.
- MalCare on WordPress.org, wordpress.org/plugins/malcare-security, version 6.76, updated 17 September 2026, read 22 October 2026: the account requirement, scanning on MalCare's servers, CAPTCHA on the login page, installs and rating.
- Ensomedia Security: the plugin's code, version 1.1.28 of 22 October 2026, and its readme on WordPress.org. Plan prices: shieldwave.io/pricing.
Something here out of date or wrong? Write to support@shieldwave.io and we will correct it.