SecuPress Pro

Security scans and scheduled tasks

SecuPress Pro combines a security audit with controls for accounts, site files and incoming traffic. Its scanner checks 35 security points in about five minutes, then gives the website a security grade and a report of issues to address. SecuPress can apply suitable fixes; you can choose many recommendations with a checkbox, and it asks for your decision when an action needs one. Export the analysis as a PDF to share with clients or colleagues.

Three separate scheduled tasks can execute a security scan, a database and file backup, or a malware scan. The scheduled scanner emails a report with actions to consider. Backups cover the database and files, which you can download.

Login and account controls

Configure protections for login attempts, user sessions and password practices:

• Limit failed login attempts and protect against password spraying.
• Ban login attempts that use non-existing usernames.
• Set a non-login time slot and control user sessions.
• Add two-factor authentication and protect security keys.
• Set password lifetimes, enforce strong passwords and forbid vague usernames such as www or admin.
• Move the WordPress login page with Move Login.

Malware, components and traffic

The malware scanner checks for bad files in FTP and the uploads folder, along with potential phishing attempts involving index.php loads. Plugin and theme checks look for vulnerable components and files altered to include malicious code. When a vulnerable plugin or theme is detected, SecuPress can email an alert and display a warning in WordPress. Its security alarms provide daily data about recently vulnerable plugins and themes.

Firewall features block malicious requests, bad user agents, disallowed request methods, suspicious URL contents and SQL injection scans. SecuPress can also block bad bots, suspicious IPs and traffic from a country by geolocation.

Backups, alerts and site administration

Email alerts report important security events. A daily report summarizes attempted attacks and activity blocked by SecuPress. Security logs record important events and 404 pages, and let administrators review banned IPs.

On a multisite network, activate SecuPress from the main network site to enable it for sub-websites. Compatibility is stated for WordPress caching and multilingual plugins, as well as hosts including o2switch, OVH, SiteGround, Bluehost, PlanetHoster, WP Engine and GoDaddy. SecuPress is not compatible with another security add-on, so remove other security plugins before activation.