Title: MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall Author: malcare Published: January 30, 2018 Last modified: March 23, 2026 --- Search plugins ![](https://ps.w.org/malcare-security/assets/banner-772x250.png?rev=2297655) ![](https://ps.w.org/malcare-security/assets/icon-256x256.png?rev=2297655) # MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall By [malcare](https://profiles.wordpress.org/malcare/) [Download](https://downloads.wordpress.org/plugin/malcare-security.zip) * [Details](https://wordpress.org/plugins/malcare-security/#description) * [Reviews](https://wordpress.org/plugins/malcare-security/#reviews) * [Development](https://wordpress.org/plugins/malcare-security/#developers) [Support](https://wordpress.org/support/plugin/malcare-security/) ## Description ### MALCARE SECURITY SERVICES Security Plugin For WordPress Websites ★★★★★ A WordPress security plugin ensures that your website remains completely safe and secure, always. We created [MalCare Security Plugin](https://www.malcare.com/) to help website owners worry less about their site security, achieve peace of mind and focus all their energies on growing their business or website. **Why you need MalCare Security?** **Difference Between MalCare Free vs Premium** **Why MalCare is best WordPress security plugin?** **MalCare in 1 Minute – Overview** **Important Links: [Security Features](https://www.malcare.com/features/) | [Why Choose MalCare?](https://www.malcare.com/) | [Comparisons](https://www.malcare.com/top-wordpress-security-plugins-compared/) | [Free vs Paid](https://www.malcare.com/malcare-free-premium/)** MalCare is the **fastest** malware detection and removal plugin loved by thousands of developers and agencies. With an industry-first **automatic one-click malware removal**, your WordPress website is clean before Google blacklists it or your web host takes it down. MalCare has been developed from the ground up after **analyzing over 240,000 websites over 2.5+ years**. Its **intelligent scanning methodology** will **never slow down your WordPress site** and **accurately identifies** the most complex malware that typically goes undetected in other popular WordPress security plugins. The **one-click malware cleaner** offers unlimited automated cleanups while the inbuilt **powerful cloud-based firewall** ensures round-the-clock website protection against spam attacks. Moreover, you can **block countries** to mitigate hack attacks. MalCare comes integrated with a **complete website management** module that ensures better WP security and site management to your websites from a single dashboard. The WP security plugin **notifies you if the WordPress site goes down** so that you can handle the situation before you start losing visitors. Performance Check enables WordPress users to keep an eye on their **loading speed**. MalCare offers a premium **White-Label** solution that lets agencies provide better website security to their clients without risking their business. And enables users to **generate beautiful reports** for their clients. ### Why Choose MalCare WordPress Security Plugin? * #### WordPress Malware Scanner - Cloud Based Deep malware scanner - Doesn’t Slow down your WordPress site - Detects malware BEFORE it’s too late - NO impact on your website - Finds ALL types of malware, even new & complex ones - Get Alerts about Security Risks with our WordPress Vulnerability Scanner * #### WordPress Malware Removal - View hacked file details - Cleans your site INSTANTLY, in less than 60 Secs - Removes ALL traces of malware - UNLIMITED hack cleanups * #### WordPress Website Protection - Blocks hacker BOTS from attacking login page - Identifies & blocks MALICIOUS traffic - Enables users to HARDEN their WordPress sites - Enables users to block ENTIRE countries * #### Easy to Use - Set up an account in 60 secs - Configure security once & never look at it again * #### Support - Agile & responsive customer support ### Why Is MalCare Such a Game-Changer? MalCare offers unparalleled security services. Some services are free and others are paid. #### MalCare’s FREE Services – 1. #### Cloud-Based Malware Scanning (Free) 2. MalCare’s Cloud-based Scanning ensures no impact on your website ever. Moreover, it detects Complex Malware missed by other popular security plugins for WordPress. 3. #### Web-Application WordPress Firewall (Free) 4. Get Real-Time Protection for your WordPress website against the latest security threats with MalCare’s Smart Firewall. Block hackers & bots before they harm your site. 5. #### CAPTCHA-Based Login Page Protection (Free) 6. Automatically prevent brute force attacks with MalCare’s Smart Captcha-Based Login Page Protection. Round-the-clock protection against malicious traffic. #### MalCare’s PAID Services – 1. #### Viewing Hacked Files (Paid) 2. View the infected files present on your WordPress website. Learn which themes or plugins or files or folders were infected by hackers. 3. #### Industry-First Instant Malware Removal (Paid) 4. Clean your hacked site instantly in less than 60 secs with MalCare’s 1-Click Cleaner. Clean your website before Google blacklists it or your web host takes it down. 5. #### WordPress Recommended Website Hardening (Paid) 6. Easily configure WordPress recommended best security practices with just 1-Click from right within MalCare’s dashboard. No technical knowledge needed. 7. #### Geo-blocking (Paid) 8. Restrict access to users based on their geographical location. Easily block all visitors from certain countries to mitigate the risk of being hacked. 9. #### Uptime Monitoring (Paid) 10. With MalCare’s Uptime Monitoring keep a steady eye on your WordPress site. It ensures that you are not oblivious to website downtime. ### Common Hack Attacks Prevented By MalCare MalCare protects websites against all common hack attacks which includes: * [Brute force attacks](https://www.malcare.com/blog/wordpress-brute-force/) * [Japanese keyword hack](https://www.malcare.com/blog/japanese-keyword-hack/) * [WordPress redirect hack](https://www.malcare.com/blog/wordpress-hacked-redirect/) * [Pharma hack](https://www.malcare.com/blog/what-is-pharma-hack-how-to-clean-it/) * [SEO spam hack](https://www.malcare.com/blog/seo-spam/) * [WordPress theme hack](https://www.malcare.com/blog/wordpress-theme-hacked/) * [WordPress spam link injections](https://www.malcare.com/blog/spam-link-injection-wordpress/) * [Revslider hack](https://www.malcare.com/blog/revslider-exploit/) * [TimThumb hack](https://www.malcare.com/blog/wordpress-timthumb/) * [Adminer.php hack](https://www.malcare.com/blog/adminer-php-hack/) * [XSS or cross-site scripting hack](https://www.malcare.com/blog/cross-site-scripting-xss-attacks-what-how-prevent-them/) * [WP-VCD hack](https://www.malcare.com/blog/how-to-detect-and-remove-wp-vcd-malware-a-step-by-step-guide-and-a-bonus-plugin/) * [SQL injection hack](https://www.malcare.com/blog/preventing-sql-injections/) * [WordPress malvertising hack](https://www.malcare.com/blog/wordpress-malvertising/) * [Google Blacklist hack](https://www.malcare.com/blog/remove-google-blacklist-warning/) * [Google Adwords hack](https://www.malcare.com/blog/google-adwords-account-suspended/) * [Cookie stealing & session hijacking](https://www.malcare.com/blog/session-hijacking-cookie-stealing/) * [WordPress phishing hack](https://www.malcare.com/blog/how-to-remove-phishing/) * [Favicon.ico virus hack](https://www.malcare.com/blog/favicon-ico-virus-wordpress/) * [WP-Feed.php & WP-Tmp.php](https://www.malcare.com/blog/removing-wp-feed-php-malware/) * [Backdoor hack](https://www.malcare.com/blog/how-to-scan-malware-and-backdoors-of-your-wordpress-site/) * [Coinhive hack](https://www.malcare.com/blog/coinhive-malware-wordpress/) * [WordPress deface hack](https://www.malcare.com/blog/deface-wordpress/) ### MalCare Free vs. MalCare Premium 1. #### Cloud Based Malware Scanner (FREE) 2. * Cloud-Based Malware Scanning **(Free)** * Deep Malware Scanning – Files & Database **(Free)** 3. #### Website Firewall (FREE) 4. * Web Application Firewall **(Free)** * Plugin Based Firewall **(Free)** * Rules update every 7 days **(Free)** * Login Page Protection **(Free)** * Bot Protection **(Free)** * Rules update every 5 mins **(Paid)** * Geo-Blocking **(Paid)** * Website Hardening **(Paid)** 5. #### Instant Malware Removal (PAID) 6. * View Malware Insights **(Paid)** * Instant One-Click Clean Ups **(Paid)** * Automatic Clean-Ups **(Paid)** * Unlimited Clean-Ups **(Paid)** 7. #### Personalized Customer Support (Paid) 8. * Support on WordPress forum **(Free)** * Support via email and chat **(Paid)** ### Who Can Benefit From MalCare? MalCare is perfect for: * Any WordPress Websites * Small Business Websites * Developer Websites * Web Designing Websites * eCommerce Stores * Niche Sites * Artists & Photographers Sites * Amateur & Professional Bloggers * Local Business Sites * Website for Startups * Websites Selling Courses * Influencer Sites * Web Hosting Companies * Website Maintenance Services or Agencies ### Detailed Setup Step-by-Step Tutorials This WordPress security plugin works in tandem with the [MalCare](https://www.malcare.com) servers. MalCare servers do all the heavy processing and will alert you if your site has any security issues. Hence a MalCare account is needed to use the plugin. This account can also be used by our other products including [BlogVault](https://blogvault.net). * [How to Set Up a MalCare Account?](https://malcare.freshdesk.com/support/solutions/articles/35000055512-how-do-i-set-up-a-malcare-account-)( Help Doc) * [How to Set Up a MalCare Account?](https://www.youtube.com/watch?v=v8L_DZllk7k&list=)( Video) ### MalCare Full Security Features List * #### Cloud Based Malware Scanner - Daily Scan Frequency - On-demand Site Scans - Scan Non-WP Files - Does not slow down your website ever * #### Instant Malware Removal - View Hacked Files details - Instant Automatic Malware Removal - Removal of Unknown & New Malware - Unlimited Malware Removal * #### Intelligent Malware Protection - Web Application Firewall - IP Whitelisting - CAPTCHA-based Login Page Protection - Traffic Logs - Login Logs - Geo-Blocking - Alerts for Suspicious Logins * #### Website Hardening - Block PHP Execution in Untrusted Folders - Disable Files Editor - Block Plugin or Theme Installation - Change Security Keys - Reset All Passwords * #### Complete Website Management - Centralized Dashboard - Plugins & Themes Management & Update - User Management - Team Management - Client Management - Generate & Schedule Reports - White-Labeling Solution - Uptime Monitoring - Site Speed Monitoring - Blacklist Alarm - Slack Integration * #### Support - Email - Chat - Social Media ### Fans Are Raving About Us * [MalCare Review on VisualComposer](https://visualcomposer.com/blog/malcare-review/) * [MalCare Review on ElegantThemes](https://www.elegantthemes.com/blog/resources/malcare-security-and-firewall-the-right-security-plugin-for-your-site) * [MalCare Review on Weglot](https://blog.weglot.com/ideal-security-solution-malcare-review/) * [MalCare Review on WPWhiteSecurity](https://www.wpwhitesecurity.com/malcare-wordpress-site-security-service-reviewed/) * [MalCare Reviews by WordPress Influencer Adam Preiser (Plus Real Malware Removal Demo)](https://www.youtube.com/watch?v=2yNIb4Pc_ig) ### Connect With Our Team of Security Experts [Join MalCare’s Facebook Community](https://www.facebook.com/groups/WordPressForWebCreators/)– The purpose of the group is to enable Web Creators to gain valuable insights and help from community members which will be valuable to their business. So, if you are a WordPress user & want to keep up with the latest industry news and get help for your business, [join us](https://www.facebook.com/groups/WordPressForWebCreators/)! ### Don’t Know Where to Getting Started? Start From Here – * [How to Setup MalCare Account?](https://malcare.freshdesk.com/support/solutions/articles/35000055512-how-do-i-set-up-a-malcare-account-) * [Join MalCare Facebook Group MalCare](https://www.facebook.com/groups/WordPressForWebCreators/) * [MalCare Tutorial Videos](https://www.youtube.com/channel/UC5oQAXXvndQJuyVrWgMRWqg) * [User Help Documentations](https://malcare.freshdesk.com/support/home) * [Frequently Asked Questions](https://www.malcare.com/faq/) * [Support for MalCare Users](https://malcare.freshdesk.com/support/tickets/new) ### MalCare vs. Others * [MalCare vs Sucuri vs Wordfence by CodeinWP](https://www.codeinwp.com/blog/sucuri-vs-wordfence-vs-malcare/) * [MalCare vs Sucuri vs Wordfence vs SiteLock vs iThemes Security by WPMayor](https://wpmayor.com/malcare-sucuri-wordfence-sitelock-ithemes-security-comparison/) ## Screenshots * [[ * It’s extremely easy to add a website to MalCare’s dashboard. All you need to do is add a URL and install the plugin on your website. * [[ * MalCare’s Early Detecting Technology uses 100+ intelligent signals to detect even the most complex malware that other WordPress security plugins cannot detect. * [[ * No more waiting for days or hours to clean your website. Clean your website of malicious code with surgical precision in One-Click. * [[ * MalCare offers Login Page Protection which limits the number of failed login attempts made by hackers and bots via Captcha protection. * [[ * MalCare’s Firewall automatically blocks malicious traffic with its intelligent visitor pattern detection technology. * [[ * MalCare helps implement Advanced Website Security Hardening measures to make your site more secure against hackers and bots. * [[ * MalCare’s Geoblocking effectively blocks countries from visiting your site with just a click of a button. * [[ * MalCare’s Uptime Monitoring notifies if a website goes down so that you can handle the situation before starting to lose visitors. ## FAQ ### Can I Setup my MalCare account myself? Yes. Take the help of this **[step-by-step guide](http://bit.ly/2RKSVCb)**. ### Why do you need my email? We require your email address to keep you informed about important updates related to your website, such as malware alerts, vulnerability alerts, and uptime alerts. Having an account is necessary to use our service, and your email address serves as a unique identifier for your account. In addition, we may use your email address to notify you about any changes or updates that we make to our service, as well as any new features or services that we may offer to help enhance your user experience. ### I am unable to reach the security plugin. What can I do? You can send an email to the support team at support@malcare.com and notify our team regarding this. ### Do you have a free version? How does it work? MalCare Security Service has a free version and a premium version. We’ll scan and protect your website with a Firewall in the **[free MalCare version](https://wordpress.org/plugins/malcare-security/)**. You can download the security plugin from the WordPress repository. The **[paid version](http://bit.ly/2ROFL7y)** includes Cleaning a Hacked Site, Website Hardening, Website Management, White-Labeling, Client Reporting, and taking Regular Backups. Kindly take a look at our security **[feature pages](http://bit.ly/2RKvMQo)** for more details. To learn more, please take a look at **[MalCare free vs premium page](http://bit.ly/2RMzUPY)**. ### How do I upgrade from a free to a premium account? To upgrade from a free trial version to a premium account, please take the help of **[this guide](http://bit.ly/2RMSBTP)**. ### How do I upgrade to a bigger Plan? To upgrade to a bigger Plan, take the help of **[this guide](http://bit.ly/2RMSBTP)**. ### Do I need to pay for support and help? Never! We will be with you for any queries at any time. **[Click here](https://www.malcare.com/contact/)** to get in touch with us! ### How many times does MalCare auto-scan a website? MalCare automatic security scans a website once every 24 hours. ### How does MalCare detect complex malware? MalCare Security Service scans all your website WordPress files beyond just signatures and evaluates them automatically using powerful technology with the collective knowledge of 240,000+ sites. It uses 100 + intelligent signals automatically for deep security scanning and combing through all the files. That is how it detects even the most complex and well-hidden malware on your site. ### Does MalCare affect my site performance? No, not at all. MalCare Security Service performs all the heavy lifting of scanning your entire site WordPress files on its own. It does not use your site resources. MalCare Security Service runs its security operations on MalCare servers, thereby ensuring zero loads from its side on your website. ### How does the unlimited cleanup policy work? A situation may occur where your site is being repeatedly infected. In such events, there is no limit to the number of times you can **[clean up a hacked website](http://bit.ly/2RHzkD2)**. But if the situation persists, then cleaning up the site, again and again, will not solve the problem. In such cases, you can **[contact us](https://www.malcare.com/contact/)**, and we will help improve your security posture. We’d ask you to take proactive measures based on the recommendation of the Support team. We reserve the right to refuse service until appropriate actions are taken from your end. In cases like this, we also reserve the right to deny refund or cancellation of the MalCare Security account. ### What do I need to clean my website? In order to begin the cleanup process, we need access to your server and its associated files. (Don’t worry, this will not compromise your site’s security). We get this access in the form of FTP, SFTP, or SSH access to your server. FTP stands for File Transfer Protocol, sFTP for Secure File Transfer Protocol, and SSH for Secure Shell. These are connection protocol mechanisms that allow us to log into servers to edit/add/remove files. These connection protocols allow us to log into your websites, specifically the server, and perform the remediation process. If you for some reason are unfamiliar with these protocols, don’t worry, our team of security analysts is prepared to assist you in the process. To do so, you’ll need to be willing to share access information to your hosting account. We covered how to clean a website **[here](http://bit.ly/2RHzkD2)**. Here’s a guide on **[how to find FTP credentials](http://bit.ly/2RFPeOl)** and another guide on** [how to locate a folder where WordPress is installed](http://bit.ly/2RFPf4R)**. ### How long does it take to clean a site? It really depends on the size of the website. In average, **[cleaning up with MalCare Security](http://bit.ly/2RHzkD2)** usually takes 5-10 mins. ### How does the Login Page Protection work? **[MalCare’s Login Protection](http://bit.ly/2RKbDKn)** feature prevents bots from entering your website stealing your data, spamming, and other malicious activities that threaten the security of your site. ### How does the Site Hardening work? WordPress has recommended a few extra security measures which will harden the security of your website. We have incorporated those recommendations in our Site Hardening feature. Kindly have a look at our guide on **[how to implement Site Hardening](http://bit.ly/2RGnSYt)**. ### How does the Firewall work? MalCare Security Service was created after analyzing over 240,000 sites from scratch. The Firewall constantly monitors traffic from all places and automatically blocks IPs that seem malicious in nature. As such, it is **[automatically enabled](http://bit.ly/2RKbZAH)** and needs minimal overseeing. **[MalCare Firewall Security](http://bit.ly/2RKIuyu)** ensures that attacks on your site by even bots are mitigated, without affecting your WordPress site. It monitors bots across a global level without ever overloading your server. ### Can I update WordPress core, plugins, and themes directly? Yes. Updating WordPress add-ons tightens the security of your website. Take a look at this **[Manage Site help doc](http://bit.ly/2RKhMGr)** to learn how to update WordPress add-ons. ### Can I manage my site users and their password directly? Yes. With MalCare managing WordPress, users have become easier. Take the help of this **[Manage Site help doc](http://bit.ly/2RKhMGr)**. Remember to delete the passive user account and encourage users to use a strong password for better security. ### Can I add Clients and Team Members to my account? Yes, you can. Our client feature is for your reference alone. You can assign a client to their site. If you want to give a user, dashboard access, please add them as your team members under the team section. Please see **[How do I add clients and team members](http://bit.ly/2RKcKtx)**? For the sake of security, give dashboard access to only people you can trust. ### Will MalCare Security work if my site is down? We understand the pains of a website going down. If a site goes down after you have** [added the website](http://bit.ly/2ROE7CU)** and **[installed the security plugin](http://bit.ly/2RI7eHW)** from the dashboard, **[MalCare will clean up your site](http://bit.ly/2RHzkD2)**. But if you add a website that was down beforehand, i.e. before adding the security plugin, then MalCare Security Service won’t work. ### What information does MalCare Security Service store? We only store data related to your site structure such as plugins/themes with their respective versions. This helps us identify vulnerabilities that may be present on the site. We track the IPs of visitors to your site, to identify malicious actors who might attack your site. ### What makes MalCare Security Service better than other WordPress security plugins? MalCare Security Service was developed after analyzing 240,000+ websites. 1. It uses 100+ internal signals to Scan and identify the most complex malware. 2. It pinpoints the malware’s exact location on your site. It does remote security scanning, to ensure there are Zero loads on your server. 3. MalCare comes with an industry- first One-Click Malware removal service that eliminates any malware in a jiffy. 4. We alert you only when there is a legitimate malicious discovery rather than ‘ possible hacks’. We feel these features set us apart from most other WordPress security plugins. For further information take a look at how MalCare Security Service stands when compared with **[Top Security Plugins](http://bit.ly/2RKFdPG)**. ### I already have a backup solution. Something happens to my site, I can simply restore it. Why do I need a security plugin? Backups play a very important role in WordPress security, but it has some limitations. We have noticed that in many cases, it is weeks before a site owner realizes that his/her website has been hacked. During this period multiple backups will be taken, and there will be a high chance that the files that contain the hack or the Malware are also backed up. In such a case restoring from backup is not sufficient as it will not clean your website. Here is where a Malware solution like MalCare Security Service comes in. It does regular automated security scans of your website and notifies you if there is any sort of Malicious content on your website. ### Isn’t WordPress secure enough? WordPress core is safe, but the CMS does not work in isolation. Security plugins and themes are part of its ecosystem. Several studies on hacked sites show that plugins and themes are responsible for a majority of such compromises. MalCare Security Service is an easy and effective way of securing websites and keeping them safe from hack attempts. Look at this **[full feature list](http://bit.ly/2RJyRjV)**. ### Why will an SSL certificate not suffice? An SSL certificate is used only to encrypt a connection between the browser and server to safely transmit sensitive information. However, MalCare Security Service goes beyond and actually protects the database where this information is stored, scans your website files using 100+ intelligent signals automatically, and applications protect from data breaches and the spreading of viruses/malware. These functionalities are not provided by an SSL certificate. ### How is MalCare Security Service the best for agencies or developers? We’re the best because of three features: 1. We have developer-friendly plans that are easy on the wallet. If you’re a developer or an agency that hosts about 10 websites, the chances are that enterprise-level security packages would be too expensive for you. If you’ve got anything more than seven sites, take a look at our unlimited plans. 2. Our auto-clean feature makes sure that you can scan, and clean your sites by yourself, so you don’t waste precious time. 3. MalCare’s regular security scans alert you whenever it identifies hacks, so your sites are always secure. ### How does MalCare Security handle WordPress Multisite installs? We completely understand the concern and complexities surrounding WordPress Multisite installs. We treat each WordPress install as a license. It means that if you have a network of websites on a single WordPress installation, we treat that as a single license. ### Will MalCare Security Service slow down my website? MalCare runs on its own servers. We take great care to ensure that we do not add load to your site. We do all the hard work of security scanning, cleaning, and protecting, on our servers and this is our USP. ### Where are my FTP details processed? FTP details input into MalCare is processed on our servers. We need your FTP credentials to access your website’s files and folders. We feel that FTP transfer is the safest way to transfer data to and from a site. However, they are treated like payment details (i.e. they’re not stored on our servers). Once we’ve processed them, they’re deleted from our servers. ### Where can I find the MalCare Terms of Use and Privacy Policy? These are available on our website: [Terms of Service](https://www.malcare.com/tos/) and [Privacy Policy](https://www.malcare.com/privacy/) ## Reviews ![](https://secure.gravatar.com/avatar/ded595e4a2e3e9aedd342d5872328daa6b07aceb4aa97fc409c542ea5c4990b3? s=60&d=retro&r=g) ### 󠀁[Above and beyond](https://wordpress.org/support/topic/above-and-beyond-41/)󠁿 [GreatDad](https://profiles.wordpress.org/greatdad/) March 19, 2026 1 reply I am over the moon with my experience with Malcare. Not only did their free online tool fine malware where others didn’t, they fixed it immediately and then went on to surprise and delight me by helping me undo the damage. Customer service (Kousik) was empathetic and very responsive. I love their dashboard which gives me a look at how frequently these brute force attacks are happening. It’s scary. If you’re investing at all in your site and exposure, buy their plan so you don’t wake up one day and find malicious code has been messing around with your content for years. ![](https://secure.gravatar.com/avatar/6d67b47d8a19b0c96b237b97773d83582fbf9d074eb1529d4dc084c8a9a656ae? s=60&d=retro&r=g) ### 󠀁[Great plugin and support](https://wordpress.org/support/topic/great-plugin-and-support-1917/)󠁿 [alexio](https://profiles.wordpress.org/alexio/) March 18, 2026 1 reply Great plugin, lightweight and protects the sites. Support is amazing, fast replies and care to help. ![](https://secure.gravatar.com/avatar/5fb8e665509352780a7e93d3751832d8229cb536a92d642fe50b516cc2550d54? s=60&d=retro&r=g) ### 󠀁[HUMAN SUPPORT TOP SECURITY](https://wordpress.org/support/topic/human-support-top-security/)󠁿 [amootimustafa](https://profiles.wordpress.org/amootimustafa/) March 9, 2026 1 reply I got a fake recaptcha script on my site , i tried all ways to locate it but all in vain.Then i found malcare, there scanner helped me realised that my site had far more issues than just an enqueued script, It had hidden plugins i couldnt see on the dashboard and over 3000 files were corrupted.The heads up alone was a reliever as it helped me fire fight everything with direction.Next time I will definitely add the security Pricing on my clients quote and will make sure i have the Malcare Premium.With the way they follow up on tickets, I believe the Premium is worth paying for and have a piece of mind ![](https://secure.gravatar.com/avatar/ae7113b37249fde2d406f2e86abbe797a3aadde6de575ee0d6a5f2758d53900f? s=60&d=retro&r=g) ### 󠀁[The security plugin I actually trust on client sites](https://wordpress.org/support/topic/the-security-plugin-i-actually-trust-on-client-sites/)󠁿 [benady](https://profiles.wordpress.org/benady/) February 24, 2026 1 reply Been managing WordPress sites for agencies and clients for years. MalCare is the one security plugin I keep coming back to. The free version delivers real value – automatic daily scans, firewall protection, and brute force prevention without touching your server resources. That alone puts it ahead of most alternatives. What really stands out is the support team. Fast, professional, and they actually solve problems instead of sending you to a documentation article. If you manage multiple WordPress sites, the centralized dashboard is worth it on its own. Clean interface. No false alarms. Does what it promises. 5 stars, no hesitation. ![](https://secure.gravatar.com/avatar/394763ed4ef9c6c2670696356bbbb060ab442d4a244e934732eb46020b7683f7? s=60&d=retro&r=g) ### 󠀁[Nothing But Solid Service](https://wordpress.org/support/topic/nothing-but-solid-service/)󠁿 [tsugmaster](https://profiles.wordpress.org/tsugmaster/) February 18, 2026 1 reply Seems to be a lot of strong opinions on here but my experience has been nothing but top notch. Yes, you have to pay for it. Anything good is worth paying for. Each time I’ve had an issue, the software has assisted me with recovery. It’s made restoring simple when needed, and their customer service has always been great to me; especially when it comes to a few things over my head. Appreciate the assistance, Malcare. Thank you! ![](https://secure.gravatar.com/avatar/f05740b859480cd2586f0e57c0b973596dd72650c0351d5675373e10fd4bb7ce? s=60&d=retro&r=g) ### 󠀁[Excellent Service](https://wordpress.org/support/topic/excellent-service-381/)󠁿 [mrwebmarketing](https://profiles.wordpress.org/mrwebmarketing/) February 18, 2026 1 reply Are always there within 5 minutes to help in any way. Well worth the paid plan too. [ Read all 521 reviews ](https://wordpress.org/support/plugin/malcare-security/reviews/) ## Contributors & Developers “MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall” is open source software. The following people have contributed to this plugin. Contributors * [ malcare ](https://profiles.wordpress.org/malcare/) * [ akshatc ](https://profiles.wordpress.org/akshatc/) [Translate “MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall” into your language.](https://translate.wordpress.org/projects/wp-plugins/malcare-security) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/malcare-security/), check out the [SVN repository](https://plugins.svn.wordpress.org/malcare-security/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/malcare-security/) by [RSS](https://plugins.trac.wordpress.org/log/malcare-security/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 6.39 * Tweak: Code Restructuring * New: Added Connection key support #### 6.36 * New: Added deactivation feedback form to collect user feedback when deactivating the plugin * Tweak: Improvements in Auto-login and File System * Tweak: Code Restructuring #### 6.02 * Tweak: Improved Authentication #### 5.93 * Tweak: Improvements in bulk upgrade #### 5.92 * Tweak: Improvements in fetching File Stats #### 5.91 * Tweak: Code Restructuring #### 5.88 * Fix: Resolved compatibility issues with WordPress versions below 6.2. * Tweak: Added support for PHP 8.4 #### 5.85 * New: Added Gravity Forms support in Form Testing. * Tweak: Code Restructuring #### 5.81 * Tweak: Enhanced Form Monitoring * Tweak: Improved Error Handling #### 5.77 * New: Introduced WP Login Whitelabel * Tweak: Enhanced Two-Factor Authentication #### 5.73 * Tweak: Improved handling for Two-Factor Authentication #### 5.72 * New: Introduced Two-Factor Authentication * Tweak: Enhanced PHP Error Monitoring feature #### 5.68 * Tweak: DB Version Update #### 5.67 * Fix: Firewall uninstallation issue when using WP-CLI #### 5.65 * New: Introduced Domain Monitoring feature * New: Introduced PHP Error Monitoring feature * Tweak: Implemented Captcha bypass support for Forminator and Gravity Forms * Tweak: Enhanced Firewall #### 5.56 * Better handling for Activate Redirect #### 5.55 * Updating classes in PHP Files #### 5.54 * Adding SVG files. #### 5.53 * UI Improvements. * Enhanced Firewall for greater robustness. * Manage Improvements. #### 5.47 * Bug fix: Fetch Elementor DB details #### 5.45 * Added Elementor DB Update Support #### 5.42 * Enhanced Firewall * Added Maintenance Mode Support * Enhanced Whitelabel Functionality #### 5.41 * Enhanced Firewall * Improved Authentication * Improved WooCommerce DB Update Support #### 5.38 * Added WooCommerce 8.2.1 Real-Time-Backup support. * Enhanced Firewall for greater robustness * Enhanced WAF #### 5.25 * Bug fix get_admin_url #### 5.24 * WooCommerce DB Update Support * SHA256 Support * Stream Improvements #### 5.22 * Code Improvements * Reduced Memory Footprint #### 5.16 * Security Improvement: Upgraded Authentication #### 5.09 * Manage Improvements #### 5.05 * Code Improvements for PHP 8.2 compatibility * Firewall Enhancements * Manage Improvements #### 4.97 * Firewall Improvements * Whitelabel improvements #### 4.87 * Plugin Update Improvements * Theme Update Improvements #### 4.86 * Whitelabel Improvements * Activity log Improvements for Core update #### 4.84 * Bug fix: Handling WooCommerce update order hook #### 4.83 * Geo-blocking with advanced firewall * Activity log improvements and bug fixes * Woocommerce custom table support for real-time backups #### 4.82 * Firewall Improvements * Real-time Improvements * Improving coding standards * Code Improvements * Updated bootstrap #### 4.78 * Improvements in identifying plugin and theme updates. #### 4.77 * Improved the landing pages. * Enhanced future vulnerability protection * IP Blocking Improvements * Improved firewall configuration for migrations #### 4.76 * Improvements in fetching file stats #### 4.75 * Added the MalCare badge image #### 4.74 * Enhanced handling of plugin services * Added functionality for realtime sync * Removed deprecated hook * Improvements in identifying plugin updates. #### 4.72 * Sync Improvements #### 4.69 * Improved network call efficiency for site info callbacks. #### 4.68 * Removing use of constants for arrays for PHP 5.4 support. #### 4.67 * Robust firewall-config checks #### 4.66 * Post type fetch improvement. * Handing wing version for ipstore wing. #### 4.65 * Making Login Protection more configurable. * Robust handling of requests params. * Callback wing versioning. #### 4.63 * Updated the logos #### 4.62 * MultiTable Sync in single callback functionality added. * Streamlined overall UI * Firewall Logging Improvements * Improved host info #### 4.61 * Firewall Logging Improvements #### 4.59 * Improved host info * Re-enabled plugin deactivation functionality from wp-admin for botprotection sites #### 4.58 * Better Handling of error message from Server on signup * Fixed firewall caching issue * Minor bug fixes #### 4.57 * Fixed services data fetch bug #### 4.56 * Handling Activity Log corner case error #### 4.55 * Activity Log for Woocommerce events * Minor Improvements in Firewall * Minor Improvements #### 4.54 * Added Support For Multi Table Callbacks * Added Firewall Rule Evaluator * Added Activity Logs feature * Minor Improvements #### 4.53 * New UI for registration page * Bug Fixes #### 4.52 * Bug Fixes #### 4.51 * Removed files and db access check * On uninstall remove prepend configuration * minor bug fixes #### 4.4 * Disabling deactivate for botprotection accounts * Disconnect functionality through wpcli with params account_gid and account_type * Removed manual signup logic #### 4.33 * Hiding bot protection dashboard from wp-admin #### 4.32 * updating plugin name for cloudways server #### 4.31 * Fetching Mysql Version * Robust data fetch APIs * Core plugin changes * Sanitizing incoming params * changed bvoverride cw name to manualsignup * plugin uninstall bug fix #### 4.27 * Improved CSS * Wpcli V2 code * account disconnect option * plugin deactivate bug fix #### 4.23 * Override bot protect over protect #### 4.22 * Sending plugname in request to backend servers #### 4.21 * Adding default parameter for MCWPAdmin constructor #### 4.2 * Robust write callbacks * Improved and Robust prepend in Firewall Support * Without FTP cleanup and restore support #### 3.8 * Updated MalCare landing page front-end #### 3.7 * Removing deprecated get_magic_quotes_gpc function * Improving Firewall Logging #### 3.6 * WPCli to server request path updated * Authentication header added in wpcli request param #### 3.5 * Firewall in prepend mode * Robust Firewall and Login protection #### 3.4 * Plugin branding fixes #### 3.2 * Updating account authentication struture #### 3.1 * Adding params validation * Adding support for custom user tables #### 2.1 * Restructuring classes #### 1.91 * Request profling and logging #### 1.89 * Firewall improvements #### 1.88 * Callback improvements * Adding delete transient callback #### 1.87 * Checking Whitelisted IP’s first #### 1.86 * Updating tested upto 5.1 #### 1.84 * Disable form on submit #### 1.83 * Setting blocked page to be non-cacheable #### 1.82 * Updating tested upto 5.0 #### 1.81 * Adding Geoblocking functionality #### 1.77 * Adding function_exists for getmyuid and get_current_user functions #### 1.76 * Removing create_funtion for PHP 7.2 compatibility #### 1.73 * Ability to show captcha for all login blocked #### 1.72 * Adding Misc Callback #### 1.71 * Adding logout functionality in the plugin #### 1.69 * Adding support for chunked base64 encoding #### 1.68 * Updating upload rows #### 1.66 * Updating TOS and privacy policies #### 1.64 * Bug fixes for lp and fw #### 1.62 * SSL support in plugin for API calls * Adding support for plugin branding #### 1.51 * First Release ## Meta * Version **6.39** * Last updated **3 weeks ago** * Active installations **200,000+** * WordPress version ** 4.0 or higher ** * Tested up to **6.9.4** * PHP version ** 7.0 or higher ** * Tags * [firewall](https://wordpress.org/plugins/tags/firewall/)[malware removal](https://wordpress.org/plugins/tags/malware-removal/) [malware scanner](https://wordpress.org/plugins/tags/malware-scanner/)[vulnerabilities](https://wordpress.org/plugins/tags/vulnerabilities/) [wordpress security](https://wordpress.org/plugins/tags/wordpress-security/) * [Advanced View](https://wordpress.org/plugins/malcare-security/advanced/) ## Ratings 4.3 out of 5 stars. * [ 422 5-star reviews ](https://wordpress.org/support/plugin/malcare-security/reviews/?filter=5) * [ 10 4-star reviews ](https://wordpress.org/support/plugin/malcare-security/reviews/?filter=4) * [ 5 3-star reviews ](https://wordpress.org/support/plugin/malcare-security/reviews/?filter=3) * [ 10 2-star reviews ](https://wordpress.org/support/plugin/malcare-security/reviews/?filter=2) * [ 73 1-star reviews ](https://wordpress.org/support/plugin/malcare-security/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/malcare-security/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/malcare-security/reviews/) ## Contributors * [ malcare ](https://profiles.wordpress.org/malcare/) * [ akshatc ](https://profiles.wordpress.org/akshatc/) ## Support Issues resolved in last two months: 1 out of 1 [View support forum](https://wordpress.org/support/plugin/malcare-security/) ## Donate Would you like to support the advancement of this plugin? [ Donate to this plugin ](https://www.malcare.com)