Kadence Security Pro

Kadence Security Pro brings WordPress login controls, vulnerability monitoring, and user activity into a real-time dashboard. Review brute force attacks, banned customers, active lockouts, scan results, and user security statistics in one place. The add-on helps address common attack methods, but it cannot prevent every possible attack.

Set security requirements for your website and users

During setup, pick a template for an ecommerce, network, non-profit, blog, portfolio, or brochure site. You can also define user groups, then apply different requirements to clients, clients, administrators, and other users. For example, you can require two-factor authentication for client accounts or set password rules for customers.

Protect logins and account access

Two-factor authentication can require a code alongside a password. Users can receive codes through apps such as Authy or Google Authenticator, email, or backup codes. Password Requirements let you make and enforce a policy for user accounts.

• Brute Force Protection and banned users: Local and network protection identify common login attacks and can block users. Magic Links provide a way to log in when a username is locked out by Local Brute Force Protection.
• reCAPTCHA: Helps deter bots that attempt logins with compromised passwords, post spam, or scrape content.
• Passwordless Logins: Offers click-based sign-in while retaining two-factor authentication and password controls.
• Trusted Devices: Identifies approved devices, helps limit session hijacking, and can restrict Administrator privileges to trusted devices.
• Privilege Escalation: Provides a way to grant temporary administrator-level access.

Scan for vulnerabilities and manage software versions

The Site Scanner checks WordPress core, plugins, and themes for known vulnerabilities. Kadence Security Pro scans hourly. Scans can also check Google Safe Browsing blocklist status and alert you if malware is reported. Patchstack integration applies virtual patches for some vulnerabilities, including cases where a plugin or theme developer has not yet released a patch.

The Patchstack Priority score helps you assess findings by considering the likelihood of exploitation and the potential impact on your site. Version Management can update WordPress, plugins, and themes when configured. It also includes settings for hardening a site that runs outdated software and scanning for old websites.

Review activity and use security utilities

User Logging records events in WordPress security logs, including logins and logouts, registrations, plugin and theme changes, and changes to posts and pages. The dashboard brings activity and scan information together for review.

• Enforce SSL: Forces website connections to use SSL/TLS.
• Database Backups: Creates scheduled or emailed WordPress database backups. These are not complete site backups.
• Geolocation: Connects Trusted Devices with an external location or mapping API.

Additional tools can identify server IPs, change the first WordPress user ID or database prefix, check file permissions, view or flush server configuration and wp-config.php rules, change WordPress salts, and change the login URL.

Installation notes

Kadence Security requires Apache or LiteSpeed with mod_rewrite, or NGINX. On an existing site, make a complete backup before applying security options because the plugin can change the database and site documents. Its database backup feature does not replace a complete site backup.

Choose the site template, identify key user groups, and configure login protection, vulnerability scanning, activity logging, and backups during setup. Review the dashboard to follow security activity and scan results.