SecuPress Pro for scheduled WordPress security

SecuPress Pro brings security scans and site controls into one WordPress extension. Its scheduled tasks can execute scans, backups and malware checks, helping administrators keep a regular routine when they cannot start weekly scans manually.

What the security audit checks

The scanner reviews 35 security points in about five minutes, then delivers a security grade and report. It can fix suitable issues. Many recommendations can be selected with a checkbox; when an action requires an administrator's decision, SecuPress asks before proceeding. Export the analysis as a PDF to share with clients or colleagues.

Which tasks can run on a schedule?

SecuPress has three separate scheduled tasks:

• A security scanner that checks the website and emails a report with actions to consider.
• A backup task covering the database and documents, which you can download.
• A malware scan that checks the site at regular intervals.

How does it protect accounts and login pages?

Login controls limit bad login attempts, help protect against password spraying, and ban attempts using usernames that do not exist. Administrators can set a non-login time slot, control visitor sessions, add two-factor authentication, set password lifetimes, and require strong passwords. SecuPress can also forbid vague usernames such as www or admin, protect security keys, and move the WordPress login page with its Move Login feature.

How are add-ons, themes and malware checked?

Plugin and theme checks look for vulnerable components and files tampered with to include malicious code. When a vulnerable extension or theme is detected, SecuPress can send an email alert and display a WordPress warning. Security alarms hosted on SecuPress servers provide daily information about recently vulnerable extensions and themes.

The malware scanner looks for bad files in FTP and the uploads folder, as well as potential phishing attempts involving index.php loads. The security audit reviews security points and reports recommended actions, while the malware scan searches for malicious files and potential phishing attempts involving index.php loads.

What controls apply to traffic and site data?

Firewall functions block malicious incoming requests, bad user agents, disallowed request methods and URLs with bad content. They also help keep SQL injection scanners and brute-force attempts out. Administrators can block visits from bad bots and suspicious IPs, or block a country by geolocation.

SecuPress can reinforce WordPress core settings, secure the configuration file by setting appropriate parameters, and block bad requests to XML-RPC or REST API endpoints. Other controls include Robots Blackhole for bad bots, anti-hotlink protection, seven anti-disclose modules for PHP and WordPress information, and password protection for profile and SecuPress settings pages.

On production websites, SecuPress can limit plugin activation, deactivation, installation and removal, and lock down plugin and theme uploads through ZIP files.

What alerts and records are available?

Email alerts report important security events. A daily report summarizes attempted attacks and activity blocked by SecuPress. The plugin also logs important security events and 404 pages triggered by visitors or bots, and lets administrators manage banned IPs.

SecuPress includes an anti-spam system that runs in the background when activated.

What should administrators know before setup?

Remove other security plugins before activating SecuPress. The source states that it is not compatible with another security plugin because overlapping rules can conflict. SecuPress can be activated for all subsites from the main multisite network site.

Compatibility is listed for WordPress caching and multilingual plugins, and for Apache, Nginx and IIS7. Named hosting examples include o2switch, OVH, SiteGround, Bluehost, PlanetHoster, WP Engine and GoDaddy.

Install SecuPress through the WordPress plugins screen or upload its files to /wp-content/plugins/secupress, then activate it and configure settings in the SecuPress settings screen. Start with the scanner, review its grade and recommendations, and configure the login, firewall, alert, malware scan and scheduled task controls for the site.