Sucuri

Are you looking for a Sucuri review to see if it’s the right WordPress security plugin for you?

Sucuri is a popular security platform that can scan your site for threats such as malware, suspicious redirects, and corrupted files. If you do get hacked, then the Sucuri team will even help recover your site at no additional cost.

In this Sucuri review, we’ll see whether it’s the right security plugin for your WordPress website.

What is Sucuri?

Sucuri is a popular security plugin that offers a cloud-based Web Application Firewall (WAF).

Once enabled, all traffic goes through Sucuri’s firewall before reaching your hosting server. This means it blocks malicious traffic before it even has a chance to reach your WordPress website.

It can also scan your blog, website, or online store for malicious code and security threats at regular intervals. If it does discover a problem, then it will notify you via channels such as email or Slack, so you can fix the problem before it affects your visitors or SEO.

Since Sucuri blocks malicious traffic, it can also reduce the strain on your server. As an added bonus, this can improve your website’s performance and even save you money on web hosting.

If you’re just getting started or have a limited budget, then you can download the free Sucuri Security plugin from the official WordPress website.

This plugin allows you to scan for malware, check whether your site is blacklisted by sites such as Google, and monitor the integrity of your site’s files.

However, if you want to use Sucuri’s WordPress firewall, then you’ll need to upgrade to a premium plan.

Sucuri Review: Is It the Right WordPress Security Plugin for You?

By choosing the right WordPress security plugin, you can protect your site against all kinds of hackers, malicious code, and other security threats. This will help keep your visitors and customers safe, while also protecting your WordPress SEO.

With that in mind, let’s see if Sucuri is the right security plugin for you.

1. Easy to Setup and Use

Sucuri is designed to be easy to use. To start, you can install and activate it just like any WordPress plugin.

Upon activation, simply head over to Sucuri Security » Dashboard to see if Sucuri has found any immediate issues with your WordPress code.

The default settings work well for most websites, so you can go ahead and activate them by selecting the ‘Hardening’ tab in the Sucuri dashboard.

These options will lock dow key areas that hackers often use in their attacks. With that said, just click ‘Apply Hardening’ for the different options you want to use.

In addition, Sucuri’s WAF is cloud-based so it doesn’t run on your server. This means you don’t need to worry about maintaining or updating the firewall.

Instead, you can simply add your API key and configure the DNS settings for your domain name.

With that done, the firewall will start catching malicious traffic before it even reaches your WordPress hosting server.

2. SSL Certificate

Sucuri automatically creates SSL certificates for your firewall server. This certificate is provided by Let’s Encrypt, and will be added to your domain as soon as you activate the WAF.

If you upgrade to a Professional or Business plan, then you’ll also have the option to upload a custom SSL certificate.

3. Malware Scanner

Malware and malicious code can go unnoticed for a long time, which increases your chances of getting blacklisted by big search engines like Google. If you run an online store or collect credit card payments online, then a hacked website can also put your customers at risk.

The good news is that Sucuri comes with a built-in security scanner that check your WordPress site for malware, malicious JavaScript and iframes, suspicious redirects, phishing pages, DDoS scripts, and more.

It will also look for Indicators of Compromise (IOC), and monitor any changes in your DNS records, SSL certificate, or security misconfigurations.

Behind the scenes, Sucuri uses the Sitecheck API to automatically check whether your site is blacklisted by popular services like Google, Norton, AVG, Phishtank, and Opera. To do this, it scans your site against multiple safe-browsing APIs.

Sucuri also automatically checks the integrity of your core WordPress files. If it identifies an issue, then you can either manually remove the malicious code, or replace it with the original file.

4. Server Side Scanning

Some hackers don’t want to infect your site with malware. Instead, they may want to perform actions such as adding banner ads to your posts or hijacking your affiliate links.

These subtle hacks are more difficult to notice, especially since you won’t get blacklisted for them. Thankfully, Sucuri offers a server side scanner that will go through every single file on your site, including non-WordPress files, to ensure there’s nothing suspicious on your server.

5. Web Application Firewall

Sucuri offers a cloud-based WAF that inspects all HTTP/HTTPS web traffic and then blocks suspicious traffic before it reaches your hosting server.

To use the firewall, simply change your DNS settings so your traffic goes through Sucuri’s servers. With that done, Sucuri’s WAF will start protecting your site from malicious requests, DDoS attacks, password guessing attempts, and other security threats.

6. SEO Spam Scanner

Keyword stuffing and link injections can hurt your SEO and may even cause you to get blacklisted by sites such as Google. Sucuri will scan your site for signs of SEO spam, so you can fix problems before getting an SEO penalty.

7. Machine Learning

Sucuri has a robust machine learning algorithm that’s designed to prevent false positives.

They also correlate attack data across their network to better understand malicious behavior and keep your WordPress blog or website secure.

8. Security Headers

HTTP security headers can protect your site against common security threats such as click-jacking, cross-site scripting, and brute force attacks.

With Sucuri, you can add HTTP security headers without writing any code or hiring a WordPress developer. In the plugin’s settings, simply configure the headers you want to use.

If you have a Professional or Business plan, then you also have options for HSTS and HSTS Full.

After configuring your settings, simply click ‘Save Changes’ and Sucuri will add your selected HTTP security headers in WordPress.

9. Geo Blocking

Sucuri can block all visitors coming from specific countries. This can be useful if most of your attacks come from the same location.

You might also use Sucuri’s geolocation targeting and blocking if you only market your site to particular locations. For example, if you only ship to the US, then you might consider blocking traffic that comes from other countries.

10. Bad Bot Blocking

When Sucuri detect a malicious bot or hacker tool trying to attack your site, it blocks that traffic automatically. This prevents hackers from finding your site using massive automated campaigns.

11. Blocklist Monitoring

Search engines are a major source of traffic for most websites. With that said, getting de-indexed from services like Google can take away most of your visitors.

If search engines detect malware, then they’ll typically blacklist and de-index your site in an attempt to keep their users safe. With that said, you’ll want to know if your site gets blacklisted, so you can take steps to fix the problem and get back in the index.

Sucuri automatically checks blacklist APIs used by big names such as Sucuri, Google, Norton, AVG, Phish Tank, and McAfee SiteAdvisor. If your site shows up on these APIs, then Sucuri will notify you automatically.

After you remove the malware, Sucuri can even get in touch with blacklisting agencies and ask them to review your site.

12. Protect Your Pages

Some pages may be more important or vulnerable than others. For example, you might want to lockdown your login page or pages that contain important forms, to help combat form spam.

With Sucuri, you can add passwords, CAPTCHA, and two-factor authentication to specific pages.

By default, Sucuri will also restrict access to the WordPress admin pages so only authorized IP’s can log in. This can protect the WordPress dashboard, even if a user’s account is compromised.

13. Uptime Monitoring

Downtime can affect your business, reputation, and user experience. If you sell digital downloads or physical products online, then you may even miss out on sales.

Frequent downtime can also affect your SEO, and hurt your search engine rankings.

Sucuri can notify you about any downtime using email, SMS, Slack, RSS feeds or generic webhooks. You can then fix the problem and get your site back online before you lose out on sales, traffic, and SEO.

14. Site Audit Log

Sucuri tracks everything that happens across your website. This includes file changes, new posts, new users, last logins, failed login attempts, and any changes made to your WordPress pages and posts.

This is particularly useful for identifying more subtle hacks, such as a third-party replacing your affiliate links or adding their own banners to your site.

15. Monitoring and Alerts

A security issue can hurt your reputation, conversion rates, reputation, and much more. With that said, if there’s a problem with your site then you’ll need to know about it as soon as possible.

Sucuri monitors your WordPress core files for any changes and will notify you if a malicious script gets added to your site. It also tracks your WordPress plugins, including any that have been installed, activated, or deactivated on your website.

In addition, Sucuri comes with a complete alert management system. Simply visit the Sucuri Security » Settings page and switch to the Alerts tab.

By default, Sucuri will notify your WordPress admin, but you can add more email addresses to the contact list.

You can also customize Sucuri’s security alerts. For example, you can choose the events you want to know about, and how many alerts you receive per hour. You can also customize the settings for brute force attacks, post types, and alert email subjects.

Pro Tip: After configuring your emails, you’ll want to make sure they arrive safely in your inbox and not in the spam folder. With that said, we recommend using an SMTP service provider and SMTP plugin to improve your email deliverability rates.

You can also choose to receive your alerts as SMS, Slack, RSS, or custom-post options.

16. Boosts Performance

Sucuri can improve your website’s performance in a few key ways. To start, Sucuri provides real-time protection against DDoS attacks by blocking suspicious activity before it reaches your website. This reduces the load on your server and improves your site’s speed.

It also provides a Content Delivery Network (CDN), which is a network of servers located around the globe. The CDN delivers cached static content from the server that’s geographically closest to the visitor, improving your page loading times.

For more on this topic, please take a look at our infographic on why you need a CDN for your WordPress blog.

Sucuri also comes with a built-in option to cache your content and enable gzip compression with a click of a button.

17. Protect Your Online Store

If you run an online store, then Sucuri can help keep your customers safe. To start, it can scan your site for common threats including Magecart, credit card skimmers, and redirects that take customers to fraudulent payment pages.

To achieve PCI compliance you’ll need to use a website application firewall to protect your servers, customers, and cardholder data. Since Sucuri is a Level 1 PCI compliant service provider, it can help you achieve compliance and keep your customers safe. 

Do you promote your products or services using online ads? Sites such as Google or Facebook may suspend your ads if they detect malware on your website. Sucuri can help prevent this by identifying and removing malicious code from your store, before your ads get suspended.

18. Hacked Website Clean Up

It’s not easy to clean up a hacked WordPress site. Malware can affect several files, inject links into your content, or even lock you out of the WordPress admin area.

Thankfully, as part of your Sucuri subscription you’ll also get access to a site clean up and malware removal service. If your site gets hacked, then Sucuri will remove that malware using a series of automation tools and scripts, plus manual reviews led by a trained team of analysts.

As part of this service, Sucuri will safely remove any malicious code from your file system and database, and restore your website. They’ll also remove any SEO spam keywords and link injections that are in danger of damaging your WordPress SEO.

If the hack has already taken your website offline, then Sucuri can clean the website files and database locally.

Some hackers also install backdoors on affected sites. If these backdoors are not properly fixed, then your website is at risk of getting hacked again.

With that said, Sucuri will also identify and fix any backdoors on your hacked WordPress website. In this way, they can protect your site from future attacks.

Each plan includes unlimited cleanups, at no additional cost. Simply open a support ticket and Sucuri will start analyzing and fixing your site.

During the clean up process, Sucrui will create secure backups before making any changes, and keep a complete record of these changes. They’ll also provide a complete report of their findings, so you’ll know exactly what steps they’ve taken to clean your site.

19. Community and Professional Support

Sucuri’s default settings should work well for most business websites, online stores, and personal blogs. That said, you can often simply activate the options you want to use, and Sucuri will protect your website from all kinds of security threats.

However, security is a huge topic that covers many different areas. With that in mind, you may need some extra help to keep your site safe.

Sucuri has a ton of online resources that you can access 24/7 including webinars, a technical hub, and step-by-step guides.

These guides cover a range of topics, such as how to disable XML-RPC in WordPress, and how to protect your WooCommerce website against hackers.

There’s also the Sucuri blog.

Here, you’ll find information on all kinds of subjects, such as how to protect the WordPress login URL and how to fix WordPress vulnerabilities.

If you prefer one-on-one support, then all the premium Sucuri plans include 24/7 support. Simply submit a ticket and a member of the Sucuri team will get back to you as soon as possible.

How we use it at WPBeginner

At WPBeginner, we use Sucuri as our CDN and WAF to protect our site against spammers and other security threats. This also significantly reduces our server load, as the Sucuri firewall blocks all bad requests before fetching cached content from our SiteGround server.

We also use the Sucuri scanner to monitor our website every 3 hours to ensure it’s clean of malware, malicious JavaScript, malicious iframes, suspicious redirects, spammy link injections, and more.

In fact, upon activation, Sucuri helped us block over 450,000 WordPress attacks in the first three months. This includes 29,676 DDoS attacks and 29,690 backdoor attacks.

Sucuri Pricing and Plans

If you’re just getting started and have a limited budget, then you can download the Sucuri plugin from the official WordPress repository. This free plugin can scan your WordPress website for security vulnerabilities, and notify you about any problems it discovers.

However, if you want access to more advanced features including a WAF, then you’ll need to upgrade to a paid plan.

There are 3 plans to choose from:

• Basic. For $199.99 per year, Sucuri will scan your site every 12 hours and check your SSL and DNS for changes every 24 hours. You’ll also get access to Sucuri’s WAF, Intrusion Detection System, DDoS attack mitigation, and brute force protection. With that said, Basic is a great plan for small business websites and bloggers who want to monitor their site, and may also require the occasional malware clean up.
• Pro. For $299.99 annually, Sucuri will scan your website for malware and other issues, once every 6 hours. You’ll also get support for your origin server SSL certificate. That said, Pro is a good option for small to medium businesses that want to transfer their SSL certificate with minimum downtime.
• Business. Priced at $499.99 per year, this plan gives you unlimited access to all of Sucuri’s features. It will also scan your site for malware, security anomalies, changes, and other security issues every 30 minutes. Since it offers frequent scans, Business is perfect for websites that handle sensitive data such as customer credit card details, or personally-identifiable information. This makes Business a great choice for online marketplaces, stores, and enterprise websites.

Conclusion: Is Sucuri the right WordPress security plugin for you?

After looking at the features, support options, and pricing plans, we’re confident that Sucuri is one of the best WordPress security plugins on the market.

They offer a basic Sucuri plugin plugin that can harden your WordPress security and scan your site for common threats. Since it’s free, it’s a good choice if you’re looking for free business tools.

However, if you upgrade to the paid plan then you’ll get a WAF that blocks malicious attacks and code before it even reaches your server. In addition, if something bad happens then you’ll have access to a team of security experts who can clean up your site, and get it back on track.

If you run a small business website or blog, then Basic is a great place to start. It has essential security features, comes with unlimited malware clean ups, and scans your site every 12 hours.

If you need more frequent scans, then Pro will scan your site for malware and other issues, once every 6 hours.

Finally, if you have a high traffic website, record lots of visitor information, or want to grow your business online while minimizing risk, then Sucuri Business scans your site every 30 minutes.

We hope this Sucuri review helped you decide whether it’s the right growth suite for you. You can also check out our guide on how to increase your blog traffic, or see our expert pick of the must have WordPress plugins for business websites.

If you liked this article, then please subscribe to our YouTube Channel for WordPress video tutorials. You can also find us on Twitter and Facebook.