Solid Security is the plugin most WordPress site owners are actually running, even if they do not know it. A lot of them installed iThemes Security years ago, watched it change names in 2023, and never looked at it again. It is still there. It still works. And the free tier is still one of the better pieces of security software on wordpress.org, with one very specific blind spot that you should know about before you decide whether it is enough on its own.
The verdict, upfront
Solid Security Basic is the right choice as a hardening and authentication layer on a WordPress site that does not need a malware scanner. It does security headers, 2FA, Trusted Devices, Magic Links, brute-force blocking, and file-change detection better than anything else in the free tier. Wordfence Free still wins on malware scanning and on-server firewalling, and the two plugins are closer to complementary than competitive.
Solid Security Pro at $99 per year per site is the right choice when you want Patchstack-powered vulnerability protection bundled with the rest of the Solid feature set, and you do not want to pay Wordfence Premium’s $149. It is the wrong choice if your threat model includes actual malware detection or post-incident cleanup. That is not what this plugin is built for, and treating it like it is has caused more than one WordPress site to get compromised while its owner thought Solid Security was watching.
What Solid Security actually is
Solid Security is a pure WordPress plugin. It has no cloud WAF, no endpoint agent, no off-server scanner. Everything it does runs inside your WordPress install, mostly through PHP hooks and some .htaccess or Nginx config rules it writes on setup. The only cloud services it talks to are a Patchstack-backed vulnerability database on the paid tier, a shared network brute-force blocklist of roughly a million sites, and Google Safe Browsing for blocklist checks.
What it gives you is four things bundled into one plugin:
- A hardening layer: security headers, SSL enforcement, file-permission fixes, XML-RPC and REST API controls, “Server Tweaks” that write safe defaults into your server config.
- A login and authentication layer: two-factor authentication, Magic Links for passwordless login, Trusted Devices for session-hijack detection, brute-force lockouts with a shared network blocklist, passkeys on Pro.
- A change-detection layer: file change monitoring, user activity logging, audit log of actions taken by admins.
- A vulnerability scanner on the paid tier, powered by Patchstack’s CVE database, which matches your installed plugins and themes against known disclosed vulnerabilities and writes virtual-patch firewall rules.
It does not include a traditional malware scanner. It does not scan file contents for backdoors, it does not match files against known malicious signatures, and it does not look at content payloads or outbound traffic for indicators of compromise. This is the single most important thing to understand about the plugin.
The iThemes rename, which still confuses people
If you are searching for “iThemes Security review” and landing here, you are in the right place. Solid Security is iThemes Security with a different name. The plugin was renamed in April 2023 as part of a broader rebrand that moved iThemes under the StellarWP umbrella. The WordPress.org plugin slug is still better-wp-security, the codebase is the same evolution it has always been, and users who installed iThemes Security five years ago are running Solid Security today without having done anything.
The rename itself went fine. The broader StellarWP product reshuffle generated a run of one-star reviews on wordpress.org from users who felt the UI overhaul in version 9.0 broke their muscle memory, and a separate complaint cluster around licensing changes when the product moved onto the StellarWP Central billing system. Two years on, those complaints have mostly faded. The product today is stable, the renaming is done, and most of the search queries still going to “iThemes Security” return this plugin.
Solid Security pricing in 2026
Solid Security’s pricing page has been rearranged more than once since the rebrand, and affiliate blogs are two rename cycles behind. Here is what is on the official pricing page at the time of writing:
Solid Security Basic is free on wordpress.org. It includes hardening, 2FA, local and network brute-force protection, file change detection, security headers, SSL enforcement, a vulnerability scan that runs four times a day, and the onboarding wizard with six site templates.
Solid Security Pro starts at $99 per year for a single site. Pro adds Magic Links, Trusted Devices, passwordless logins, passkeys, Patchstack-powered vulnerability scanning with virtual patches, hourly scans, user groups for granular per-role policy, and a few smaller items.
Multi-site Pro pricing scales with site count (5, 10, 25, 50, and custom), but the exact numbers on third-party comparison pages conflict with each other. If you are buying multi-site, get the live quote from solidwp.com rather than trusting a two-year-old affiliate article.
Solid Suite is a bundle that starts at $199 per year for a single site. It includes Solid Security Pro, Solid Backups NextGen, Solid Central Pro, Solid Academy, Solid Performance Basic, and Solid Mail Basic. Advertised as 25% savings over buying the components separately. For an agency that is already paying for backups and central management across a portfolio of client sites, the Suite is usually the right math.
Compared to Wordfence: Solid Security Pro at $99 undercuts Wordfence Premium at $149 by $50. If you are buying a single-site license and you want Patchstack’s vulnerability database over Wordfence’s Threat Defense Feed, Solid is cheaper. You are trading Wordfence’s malware scanner for Solid’s security-headers module and better 2FA methods. Whether that is the right trade depends on the site.
What Solid Security does well
Three things stand out once you have run the plugin on a real install for a few weeks.
Security headers, which most WordPress sites are missing
Solid Security includes a Security Headers module that writes HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and a configurable Content-Security-Policy into your response headers. This is a meaningful default to enable, and almost no WordPress site sets these headers by hand. Wordfence does not have a dedicated security headers module. Most hosting providers do not either. A free plugin that gets these right with sane defaults on the first install is a genuine win for sites that have never had a security review.
Run your site through securityheaders.com before and after enabling Solid Security. On a default WordPress install you are likely at a D or F grade. With Solid Security’s headers module on sensible settings you are usually at B or A. That is a real improvement for zero configuration cost.
Two-factor authentication done properly
Solid Security’s 2FA implementation supports TOTP apps (Authy, Google Authenticator, any standard app), email tokens, and backup codes on the free tier. You can scope 2FA by user role so that admins and editors are required to use it while subscribers are not. You can pair 2FA with Trusted Devices on Pro, which means a returning user on a known device does not need to complete the second factor every session.
Sucuri’s own plugin does not add 2FA to WordPress logins. Wordfence’s 2FA is fine but less polished. Solid Security’s is the most flexible free-tier 2FA in the category.
Magic Links and Trusted Devices on Pro
Magic Links let legitimate users bypass a brute-force lockout by requesting a one-time login email. This is the right answer to the “admin locked themselves out, site is behind a WAF, now what” problem that comes up on every security plugin. It is a feature Pro-only, and it is one of the better reasons to upgrade.
Trusted Devices is session-hijack protection. A successful login fingerprints the browser, IP range, and geolocation. If that same logged-in session then shows up from a different fingerprint, Solid Security can restrict admin capabilities on the unknown session or force re-authentication. It is not foolproof against determined attackers who can spoof fingerprints, but it catches the common case of a stolen session cookie being replayed from a different client. Wordfence does not have a direct equivalent.
What Solid Security does not do
The gap list is as important as the feature list.
No native malware scanner. Solid Security’s “Site Scan” is a vulnerability scanner and a blocklist check, not a malware scanner. It checks your installed plugins and themes against Patchstack’s CVE database, and it checks your site against Google Safe Browsing. It does not open your files and look for backdoors, shell uploads, or injected JavaScript. If a file is 2MB of base64-encoded PHP malware sitting in your uploads directory, Solid Security’s scan returns clean.
This is the defining limitation of the plugin. If you care about malware detection, you are running Wordfence (file-based local scanner) or MalCare (cloud-based scanner with one-click cleanup) on top of Solid Security, not instead of it. Read our Wordfence review and MalCare review for the plugins that are actually built for that job.
No cloud WAF. Solid Security’s firewall is PHP-layer and .htaccess-layer. Traffic arrives at your origin, hits your web server, and gets filtered there. That is fine at low volume and bad under attack load. For edge filtering you run Cloudflare, Sucuri, or Patchstack‘s Cloudflare-backed firewall, not Solid Security alone.
No human cleanup service. If your site gets compromised, Solid Security’s role ends at “we did not prevent this.” There is no ticket queue of cleanup analysts, no bundled remediation, no SLA. Cleanup is your problem, or someone else’s (our malware removal procedure is the fallback we use).
Limited real-time visibility. Wordfence Live Traffic shows you request-by-request what is happening on your site. Solid Security has an audit log and a lockout log, but no real-time request stream. For debugging an active incident this matters.
The scanner gap, in more detail
Several third-party comparisons (mostly authored by competitors and worth noting the source bias) have tested Solid Security’s scanner against deliberately injected malware. The consistent finding is that it does not detect content-level infections. A PHP backdoor placed in the uploads directory, an obfuscated shell in a theme file, or a cryptomining payload injected into a plugin all read as clean in Solid Security’s scans because Solid’s scanner is not looking at file contents. It is looking at installed-software versions and URL blocklist status.
This is not a bug. It is by design. Solid Security is a preventive plugin, not a detective one. The architecture decision was to trust Patchstack’s vulnerability intelligence to catch exploitable plugin versions before they are compromised, and to rely on Google Safe Browsing to flag sites that have been blocklisted after the fact. Between those two you miss most of the window where a site is compromised but not yet blocklisted.
The practical consequence is that on a site running only Solid Security, the first signal of a malware infection is often Google flagging the site as deceptive several days after the compromise, or a visitor email. That is later than any WordPress operator wants to find out.
Solid Security Basic versus Wordfence Free
This is the comparison most people are making when they land on the free tiers of both plugins. The honest answer is that they are different products.
Wordfence Free includes the Wordfence malware scanner (file-based, deep), a local WAF running in PHP with rule delay of 30 days behind Premium, 2FA, brute-force protection, and Live Traffic. It is stronger on detection and on-server filtering. It does not have a security headers module or Magic Links.
Solid Security Basic includes security headers, 2FA with more methods, Trusted Devices (limited), Magic Links are Pro-only, network brute-force protection with a shared blocklist, file change detection, and an onboarding wizard with six site templates. It is stronger on hardening and authentication. It has no malware scanner and no WAF.
The sensible setup for a site that is not paying for anything is to run both. They do not meaningfully overlap, and Solid Security’s 2FA and security headers fill gaps in Wordfence’s feature set while Wordfence’s scanner and WAF fill the gaps in Solid’s. The only caveat is that both plugins do brute-force lockouts, and running both means tuning one of them to stop to avoid duplicate emails. Pick Solid Security as the primary lockout handler because its network blocklist is useful and its Magic Links give you a fallback for locked-out admins. Let Wordfence handle everything else.
Solid Security Pro versus Wordfence Premium
At the paid tiers the comparison is closer and the right answer depends on what you value.
Solid Security Pro at $99 gives you Patchstack-powered vulnerability scanning, virtual patches for plugin and theme CVEs, hourly scans, Magic Links, Trusted Devices with session-hijack detection, passwordless logins, passkeys, and granular user groups. Patchstack’s vulnerability database is arguably the best in the WordPress ecosystem for plugin and theme CVEs. Solid Pro inherits that.
Wordfence Premium at $149 gives you real-time WAF rule updates (rather than 30-day delay), real-time IP and malware signature feeds, country blocking, a deeper malware scanner, and Wordfence’s Threat Defense Feed, which is their own CVE research operation.
The split is: Solid Pro is stronger on authentication hardening and on Patchstack’s CVE intelligence. Wordfence Premium is stronger on scanner depth and on-server WAF rules. If you run a site with a lot of plugins and you care about plugin-level virtual patching, Solid Pro at $99 is the better value. If you run a site where “someone uploaded malware last week” is a realistic concern, Wordfence Premium at $149 is worth the extra $50.
The bug that keeps showing up in recent reviews
Between late 2025 and early 2026 there are multiple one-star reviews on wordpress.org reporting that Solid Security’s server-config-rule engine blanked out .htaccess and wp-config.php files on specific hosting configurations, taking sites down. Three different users, three different hosts, same symptom. The pattern is consistent enough to take seriously.
This does not happen to most users. It appears to be a race condition or a write-permission edge case that triggers on particular shared-hosting stacks when Solid Security rewrites server config files in the background. On a managed WordPress host or a self-managed VPS it has not surfaced in our testing.
The practical mitigation: before you enable Solid Security on a site you care about, take a backup. Before you turn on Server Tweaks, Enforce SSL, and anything else that writes to .htaccess or wp-config.php, take another backup. If the blanking bug hits you, the fix is to restore the backup, which is cheap if you have one and expensive if you do not. This is standard practice for any plugin that modifies server config, and Solid Security is the one where we have seen enough recent reports to call it out specifically.
The StellarWP question
Solid Security is owned by StellarWP, which is Liquid Web’s WordPress plugin holding company. StellarWP also owns The Events Calendar, GiveWP, LearnDash, Kadence, Restrict Content Pro, and several WooCommerce plugins. The parent company is established, the funding is stable, the product is not going anywhere.
The real-world implications of that ownership for you are small. The Solid Suite bundle is the clearest sign of cross-promotion: if you buy Solid Security Pro, you get marketing for Solid Backups, Solid Central, and the rest of the SolidWP lineup. This is not pushy but it is there. The second implication is that Solid Security’s Pro tier leans on Patchstack (a separate Estonian company, not owned by StellarWP) for the vulnerability database. If Patchstack ever changes its partner terms, Solid Pro’s core value proposition would need to be rebuilt. That is a supply-chain risk, not a crisis, but it is worth knowing when you are comparing Solid Pro against running Patchstack directly.
Under Liquid Web ownership Solid Security has become less scrappy and more corporate. The release cadence is steady, the version numbers tick up, the UI was redesigned in React in version 9.0, and the product has stopped making aggressive leaps and started making incremental refinements. If you are looking for something that will still be here in five years, the StellarWP ownership is a feature. If you are looking for a plugin that ships two big features every quarter, look elsewhere.
Who Solid Security is actually for
Four profiles where Solid Security makes sense as the primary choice.
Operators who want strong hardening defaults without configuring them by hand. The Security Headers module alone is worth installing for. Add 2FA done well, file-change detection, and network brute-force protection, and you have a reasonable hardening layer on a site that has never had one.
Agencies who are already in the StellarWP ecosystem. If you are running Solid Backups, The Events Calendar, or Kadence on client sites, adding Solid Security Pro via the Solid Suite bundle is a simpler billing story than splitting between StellarWP and Wordfence. The bundle pricing is real savings for multi-product customers.
Sites that need Patchstack-style plugin CVE coverage without running Patchstack directly. Solid Security Pro inherits Patchstack’s vulnerability database at the Solid Pro price point, which is lower than paying Patchstack standalone. This is a real positioning win, especially for sites with a lot of plugins where plugin-level virtual patching is the primary concern.
Users replacing iThemes Security. If you are already running the old plugin, the upgrade path is “keep it and let it auto-update.” There is no re-evaluation to do.
If those profiles do not fit, run Solid Security Basic alongside Wordfence Free for the best free-tier combined stack, or skip straight to Wordfence Premium if you want a single primary vendor and malware detection is part of what you are buying.
Bottom line
Solid Security is a hardening-first plugin that does a few things better than anyone else in the free tier (security headers, 2FA methods, session-hijack detection on Pro), is priced fairly at $99 per year for the Pro tier, and has one major blind spot: it does not do malware detection in any meaningful sense. If you understand that going in, the plugin is worth having. If you install it thinking it is an end-to-end security solution, you are going to find out it is not the hard way.
Pair Solid Security Basic with Wordfence Free on a budget, or run Solid Security Pro alongside Cloudflare at the edge and a cleanup plan like MalCare if a site gets hit. Start with the 15-minute WordPress security checklist for the hardening that should be in place on any site regardless of plugin choice.
Install Solid Security Basic (free) from wordpress.org, or upgrade to Solid Security Pro ($99/yr) for Patchstack vulnerability scanning and Magic Links. See how it stacks up against the other four plugins in our best WordPress security plugins roundup.
Frequently asked questions
Is Solid Security the same as iThemes Security?
Yes. iThemes Security was renamed to Solid Security in April 2023 as part of a rebrand under the StellarWP umbrella. The codebase is the same evolution, the WordPress.org plugin slug is still better-wp-security, and users who had iThemes Security installed got Solid Security automatically via updates. If you are searching for “iThemes Security review,” this is it.
Does Solid Security scan for malware?
Not in the way you probably mean. Solid Security’s Site Scan is a vulnerability scanner and a Google Safe Browsing check, not a file-content malware scanner. It checks your installed plugins and themes against Patchstack’s CVE database, and it checks your URL against Google’s blocklist. It does not open files and look for backdoors, shells, or injected code. If you need file-level malware scanning, run Wordfence or MalCare on top of Solid Security.
Is Solid Security Basic enough on its own?
For a low-risk site with a small plugin surface and careful operators, possibly. For a commercial site, not alone. Solid Security Basic is a strong hardening layer, but it has no malware scanner, no cloud WAF, and no cleanup service. Pair it with Wordfence Free on a budget, or with Cloudflare plus MalCare on a paid stack.
Solid Security Pro or Wordfence Premium?
Solid Pro ($99) is stronger on authentication hardening (Magic Links, Trusted Devices, passkeys) and Patchstack-powered plugin CVE coverage. Wordfence Premium ($149) is stronger on malware scanning and on-server WAF rule updates. Solid Pro is the better value if plugin-level vulnerability protection matters most. Wordfence Premium is the better value if malware detection matters most.
Does Solid Security slow down my WordPress site?
At default settings, no measurable impact in our testing. With every module enabled (file change detection on full scan, strict security headers, SSL enforcement, hourly scans), you will see measurable overhead on shared hosting. Tune to what you actually need. File change detection is the most expensive module.
Is the htaccess blanking bug something to worry about?
On most hosts, no. Recent one-star reviews on wordpress.org report Solid Security blanking .htaccess or wp-config.php under specific shared-hosting configurations, taking sites down. The symptom appears rare but real. Take a full backup before enabling Solid Security’s Server Tweaks, Enforce SSL, or any module that writes to server config files. Standard practice regardless.
Can I run Solid Security and Wordfence together?
Yes, and on the free tier it is a reasonable setup. They do not meaningfully overlap: Solid Security handles hardening, 2FA, and headers; Wordfence handles malware scanning, WAF, and Live Traffic. Turn off one of the two brute-force lockout engines (Solid’s is better because of the network blocklist) to avoid duplicate emails. At the paid tiers the feature overlap grows, so pick one.
Does Solid Security have a cleanup service if my site is hacked?
No. Solid Security does not offer malware remediation or incident response. If your site is compromised you need a separate cleanup path: MalCare’s one-click cleanup, Sucuri’s human analysts, Wordfence Care or Response, or manual cleanup. Solid Security’s role ends at prevention.
