Lock out password guessers
Repeated failed sign-ins lock the address out, and you can block repeat offenders for good. reCAPTCHA, a hidden login address and IP lists come built in.
MaxMindSecurity Pro for WordPress
Block break-ins, bots and malware with one WordPress security plugin.
MaxMindSecurity Pro adds a firewall, two-factor authentication, WooCommerce checkout protection and a malware scan to your site in one install. Support comes by email from the team that builds it. The current release is version 6.5, published 2 October 2026.
Why sites get hacked
Close the four doors attackers try first.
Attackers rarely need skill to break into a WordPress site. They need a reused password, an outdated plugin or a checkout nobody watches. OWASP calls the password route credential stuffing: lists of leaked passwords tried against your sign-in page until one works.
- Guessed or stolen passwords. Automatic lockouts and two-factor authentication stop the sign-in.
- Malicious requests. The firewall drops injection and scripting attacks before WordPress handles them.
- Card-testing bots. Checkout checks and rate limits block fake orders.
- Hidden backdoors. The scan verifies every WordPress core file against the official copy.
The scan reports what it finds and changes nothing, so if it turns up malware you cannot clear yourself, our WordPress malware removal service does the cleanup. Running more than WordPress? See how we handle website security.
What you get
Six protections, each with its own switch.
Every feature ships in the one plugin, and you turn each on or off in its settings.
Make a stolen password useless
Add a second step at sign-in: an authenticator app or an emailed code. One-time backup codes and optional trusted devices keep it quick for your team.
Stop attacks before WordPress sees them
The firewall blocks SQL injection, cross-site scripting and path traversal requests, and logs each block with the visitor address and what triggered it.
Keep bots out of your checkout
Honeypot, timing and browser checks filter fake orders on the classic checkout and the Checkout block. Rate limits catch card testing and coupon guessing.
Find backdoors and tampered files
The scan checks plugins, themes, uploads and the site root for code patterns used by malware, verifies core files against WordPress.org and flags outdated, unmaintained or withdrawn plugins. It reports what it finds and never deletes.
Know who changed what, and when
A searchable log records sign-ins, plugin and theme changes, content edits and firewall events. Email alerts flag administrator sign-ins, and a daily or weekly report sums it up.
Simple pricing
Protect your site for $39.99 a month.
One plan gives one website every feature. Add a dedicated specialist for hands-on protection.
$39.99
per month
Every protection for one WordPress site
Firewall, two-factor authentication, checkout protection, malware scan, audit log and automatic updates.
$499.99
per month, per site
A specialist who looks after your site
Hands-on protection for one site, with the scope agreed in writing before work starts.
Hardening
Shut the entry points most sites leave open.
WordPress.org publishes a hardening guide for doing this by hand. The plugin applies these settings for you, and you control each one.
- Switches off XML-RPC and closes the REST API to user enumeration
- Adds X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy headers to your pages
- Withholds application passwords from accounts that need two-factor authentication
- Disables the built-in theme and plugin file editor
- Detects changes to WordPress core files
- Offers automatic updates for core, plugins and themes
Your subscription
Get every security fix automatically.
Your subscription keeps your site on the current version and gives you a team to email when something looks wrong.
- A licence for the number of websites you choose
- Plugin updates through the normal WordPress update screen, each download verified against a checksum
- Security fixes as soon as we release them
- A dashboard for your licences, invoices and downloads
- Email support from the team that builds the plugin
Getting started
Go from request to protected in four steps.
You migrate nothing and keep your hosting.
-
01
Send your request
Tell us which site you want to protect and how many you run. It takes about a minute and needs no payment.
-
02
Get your plan in writing
We reply by email with the plan that fits and the price, so you have both in writing before you pay.
-
03
Install and activate
You receive the plugin and a licence key. Install it like any other plugin, enter the key and your protection is on.
-
04
Stay up to date
Updates arrive through your normal WordPress update screen while your subscription is active.
Questions
Get straight answers before you install.
Will it slow my website down?
It is built not to: the firewall and login checks are short pattern matches that run before WordPress builds the page. The malware scan is the heavy part, and it runs only when you start it or on the weekly schedule you switch on, in short steps and never during a visitor's page view.
Does it work with WooCommerce?
Yes, it protects the classic checkout, the pay-for-order page and the Checkout block. Signed-in customers with a previous order skip the checks by default, so repeat shoppers are not challenged.
Does it work behind Cloudflare?
Yes, the plugin reads the real visitor address from Cloudflare and other trusted proxies. It ignores forwarding headers from anywhere else, so attackers cannot use them to dodge a block.
Does it replace my host's security or my backups?
No, the plugin protects WordPress itself, not your server or your backups. Hosting access, server configuration and tested backups still matter.
See our server security serviceCan I use it on client websites?
Yes, each plan covers a set number of websites. You can release a licence from one site and use it on another.
What happens if my subscription ends?
The plugin stays installed, but its protection switches off until you renew. Your settings and logs stay in place.
Request a subscription
Tell us which site you want to protect.
Send the details below and we reply with your plan and price in writing.
- Your request goes to the team that builds and supports the plugin.
- This form takes no payment and commits you to nothing.
- We use your details only to answer this request.
Existing customers manage licences in the WordPress dashboard. Browse our security guides or write to care@maxmindsecurity.com.