Free protects a site.
Pro runs an operation.

Plans

Pro is licensed per site with an offline grace window, so a temporary network failure never downgrades a site mid-incident. A license activates and deactivates from the dashboard, so moving a license between sites does not need a support ticket. Agency plans cover 5, 10 or 25 sites under one license.

The gap Pro closes

Almost every WordPress compromise happens in a window nobody was watching. A CVE is published on a Tuesday. Mass exploitation starts within days. The vendor patch lands a week later. Your site is exposed for that entire stretch — not because you did anything wrong, but because the attack moved faster than a human maintenance cycle.

Everything Pro adds is aimed at that window: reacting without you, and seeing across many sites at once.

Real-time threat intelligence

The free plugin ships a strong bundled signature set that updates with each release. Pro connects to a live advisory feed instead:

• Hourly WAF signature updates — new attack patterns reach your firewall without waiting for a plugin release.
• CVE-matched virtual patching — your installed plugin and theme inventory is matched against published advisories, and targeted rules are offered for what is actually on your site rather than everything in the database.
• Patch-gap intelligence — flags the worst case: a plugin with a public CVE and no vendor fix yet. That is the window where a virtual patch is the only thing standing between the advisory and your site.
• Automatic fixes for vulnerable plugins — when a plugin you run has a published vulnerability and WordPress.org has the version that fixes it, the plugin is updated within the hour, even if you keep automatic updates off. WordPress’s own updater does the work and rolls the update back if it breaks the site. Your other plugins keep your own update choice.

Under Attack Mode

When a site is actively under attack, nobody makes good configuration decisions. Under Attack Mode is one switch that applies the whole emergency posture at once:

• A browser check for anonymous visitors — a one-second check, once an hour, that scripts without a real browser cannot pass. Signed-in users, feeds, sitemaps and verified search engines skip it. Or let Cloudflare do it: the mode can switch your zone to Cloudflare’s “I’m Under Attack” level and put the old level back afterwards.
• The shop keeps selling — comments, pingbacks, XML-RPC and anonymous REST API writes are switched off, but WooCommerce checkout and payment providers’ callbacks (webhook, IPN and notify routes) are never refused, so a paid order cannot stay stuck as pending.
• One failed sign-in locks sign-in from that address for an hour. It does not ban the address from the site, so a customer who mistypes a password can still browse and buy.
• Only administrators stay signed in; posts from other accounts are kept as drafts
• Every protection is its own switch, so you keep what your site needs during an incident
• Automatic expiry — it turns itself off after the window you set

That last point matters more than it sounds. Emergency modes without expiry get left on, quietly degrading the site for real visitors long after the attack has stopped.

If you’ve been hacked

Much of today’s WordPress malware leaves no file behind. It sits in the database — a script tag in a post, a widget or a page builder’s data, PHP in a snippet plugin, a changed site address, a hidden administrator — and is printed into every page. Pro looks for it where it lives and where it ends up:

• Deep database scan — posts, page-builder data, widgets, options, categories and snippet plugins, checked for outside scripts, obfuscated JavaScript, redirects and dangerous PHP, plus site-address hijacks, open admin registration and administrators hidden from the Users screen. Each finding can be removed in place and put back.
• What visitors actually get — your pages are loaded as a desktop visitor, a mobile visitor and a visitor from Google search; any outside script WordPress did not load itself is reported with where it is stored, and scripts shown only to some visitors are flagged as cloaking.
• Reports from visitors’ browsers — with the Content Security Policy on, an unknown script source raises an alert within the hour.
• Guided recovery — contain (forensic backup, Under Attack Mode), investigate (files, database, pages, accounts and recent changes in one report), clean, lock down (new security keys, everyone else signed out, new passwords, two-factor required), then verify and keep a printable incident report.

Scan automation & auto-quarantine

Free includes a weekly automatic baseline scan — every site gets scheduled scanning, not just paying ones. Pro tightens the loop:

• Daily or twice-daily scans with emailed results, cutting the worst-case detection gap from a week to hours.
• Auto-quarantine — an infected file is isolated the moment it is found, rather than sitting live until you next log in. Quarantine moves the file to a protected store, so a false positive is one click from reversal.

Uptime & site monitoring

A site can be down, expired or defaced without a single attack reaching the firewall. Pro watches it from the outside:

• Outside-in uptime — the Loyal Security service checks your home page every 5 minutes and emails you after three failed checks in a row, and again when it recovers. The Uptime screen shows the outside view and 30-day uptime next to the site’s own check.
• Certificate and domain — reminders 30 and 14 days before the HTTPS certificate or the domain registration expires, and an alert the moment the certificate stops being trusted.
• Defacement and injected spam — a daily outside check of the home page for defacement, injected spam, new outside scripts (how card skimmers get in), spam shown only to search engines and the “Japanese keyword” hack.

Firewall rule builder

Block a kind of request — for example SQL injection in one parameter of one plugin — or put a path behind a login, from plain choices instead of regular expressions.

• Each rule is tested with the firewall’s own engine before it is saved.
• A rule that would also catch everyday requests (home page, login, dashboard, REST API) is refused unless you confirm it, so a typo cannot lock you out.
• A rule tied to a plugin retires itself once that plugin is updated past the version you gave.

Sentinel AI triage

Reviewing security events is where most people give up: a hundred firewall blocks, and no obvious way to tell the background noise from the one actor doing reconnaissance. Sentinel builds a case for a suspicious actor — correlating their firewall matches, login attempts and audit trail into an evidence bundle — and returns a threat verdict with a recommended action.

• Opt-in and consent-gated. Off by default.
• Redacted evidence. Bundles never contain full request bodies, and no personal data beyond what is already in your own audit log.
• Local fallback. With Sentinel disabled, triage still runs against conservative local rules. The dashboard does not become useless because you declined to share data.
• Checks every 5 minutes, not instantly. Sentinel runs on a schedule, not on the request path — it correlates a pattern of behaviour rather than reacting to any single request, and never adds latency to a live page load.
• Autonomous, but on a leash. A recommended ban, rate limit or virtual patch can apply automatically, but every action is reversible, capped at 25 per hour, and a full site lockdown always waits for you to approve it — the one thing Sentinel will suggest but never do on its own.
• It learns from your corrections. Marking a verdict wrong feeds back into future triage on your site.
• It keeps its own house tidy. A case the AI dismissed absorbs that actor’s next signals for a day instead of opening a new case each time, and cases are cleared on a schedule: dismissed after 7 days, acted on after 30, with a row cap on finished cases. The Sentinel screen shows how much the table holds.
• Bot-signature suggestions. Once it has seen enough traffic from a signature, Sentinel suggests trusting or blocking it in the Bot Management review queue — it will never suggest touching an already-trusted crawler like Googlebot.

Every Pro plan includes 300 Sentinel AI credits a month — enough to cover typical usage on a normally-trafficked site. Agency plans include 750, 1,500 or 3,750 a month, shared across their sites. Running hot or handling a sustained attack burns through them faster; top-up packs ($9 for 800 credits, $29 for 3,000, $79 for 10,000) cover the rest of a billing period. See the privacy disclosure for exactly what a bundle contains.

Cloud reputation

A file or address that is new to your site may be well known elsewhere. Reputation lookups check hashes and indicators against a shared network of verdicts, with local caching so repeated checks cost nothing. Only hashes and indicators are sent — never file contents.

Login protection

• Emailed sign-in codes — a login from a country the account has not used in 90 days waits for a one-time code sent to the account’s email, so a stolen password alone is not enough. Accounts with two-factor authentication, passkey sign-ins and API logins skip it.
• Impossible travel — a login from a place the account could not physically have reached since its previous one is a stolen-password signal no password check catches. By default it waits for the emailed code; or Pro signs that account out everywhere and emails you.
• IP reputation — networks on public blocklists such as Spamhaus DROP are blocked before they reach your login form, so credential-stuffing infrastructure never gets a guess.
• Country escalation — when a burst of failed logins comes from one country, sign-ins from there need the emailed code for a few hours (or are blocked, if you choose). Accounts that regularly sign in from that country are not asked, and a country an administrator has signed in from in the last 90 days is never escalated, so it cannot lock you out.

Reporting & compliance

• Scheduled email digests so the security posture reaches a stakeholder who will never open the dashboard.
• Print-ready security reports — posture, findings and attack statistics, ready to save as a PDF from the browser.
• Compliance checker mapping active controls to common framework expectations, so “show me your controls” is an export rather than a week of screenshots.
• Tamper-evident audit log — new entries are fingerprinted into a hash chain and the fingerprints are recorded with Loyal Security, where they cannot be changed. A daily check reports any entry edited or deleted afterwards. Off until you turn it on.

WooCommerce delta backup

A nightly full backup means a store can lose a day of orders. Delta backup captures order and customer records between full backups, so a restore does not silently discard transactions that arrived after the last snapshot — the failure mode that turns a recoverable incident into refunds and support tickets.

Running security for other people's sites?

If you manage a portfolio of client sites — a freelancer, a small dev shop, an agency — the Agency plans are built for that job: one license for 5, 10 or 25 sites, and Loyal Hub, one dashboard instead of thirty.

Loyal Hub

Loyal Hub shows every connected site in one place — versions, waiting updates, open findings and backups — and acts on them in bulk: refresh, scan, back up, update a plugin, theme or WordPress minor release, switch Under Attack Mode on or off, or apply a hardening step.

• Signed on your device. Each batch of actions is signed with your passkey. The Hub carries it and cannot create one itself.
• Checked by every site. Sites verify each signature against keys you confirmed by email, ask the Hub for work every five minutes (nothing is pushed to them), and run only a short, fixed list of actions — the ones the site’s owner has switched on. Every action and refusal is logged on the site.
• Updates the safe way. A site installs a plugin, theme or WordPress update only when WordPress.org offers exactly the version you signed for (WordPress itself: minor releases only), through WordPress’s own background updater, which rolls it back if it breaks the site.
• Fleet reports and an assistant. Reports across all your sites, and an opt-in AI assistant that answers questions about them using the plan’s AI credits.

Also included

• White label — present the dashboard under your own brand to clients: the admin menu, the admin bar, and every email or Slack alert it sends, not just the page you're looking at.
• Security roles — give staff access to security tooling without making them WordPress administrators, which is itself a hardening win.
• Client-ready reports — a print-ready report for each site, saved as a PDF from the browser: environment, findings, attack stats. Something concrete to send at the end of the month, not just an invoice.
• Multisite network support — if your sites already live on one WordPress Multisite network, the network admin gets one overview of every site's security status. A different thing from Loyal Hub above: this requires one physical network, Loyal Hub doesn't.

What's normally paid — and isn't here

“Our free version is complete” is something every security plugin says, so there is no reason to take our word for it. The useful version of that claim is specific: here is where each capability usually sits in this market, and where it sits for us.

The middle column describes general convention across WordPress security plugins, not any particular product. Judge it against whatever you are running today.

So what does Pro actually gate?

Being straight about this is the point. Pro does not hold back protection and sell it back to you. What it adds is automation and a live service:

• Things that run without you — daily scans, auto-quarantine, automatic fixes for vulnerable plugins, off-site backup copies, Under Attack Mode.
• Things that need our infrastructure — the hourly threat-intel feed, outside-in uptime and site monitoring, cloud reputation, Sentinel AI analysis. These are a running service with a running cost, which is what a subscription genuinely pays for.
• Things only multi-site operators need — white label, security roles, multisite, compliance export, and Loyal Hub on the Agency plans.

If you log in regularly and run your own scans, the free tier may be all you ever need. We would rather say that than sell you something you will not use.

Full comparison

Questions