Application security & performance · Protect & speed the sites
Application Security
Protection running inside WordPress itself: malware scanning, login hardening, and firewall rules applied at the application level. Distinct from Edge Security, which filters traffic before it reaches the server, and from Virtual Patching, which shields known plugin vulnerabilities without touching their code.
26 of 435 hosts reporting in this layer · layer reference →
1 
Patchstack 23 hosts · 88%
Patchstack 23 hosts · 88% 2 
Jetpack
· Automattic 2 hosts · 8%
Jetpack
· Automattic 2 hosts · 8% 3 In-house 1 host · 4%
4 
MalCare
· BlogVault 1 host · 4%
MalCare
· BlogVault 1 host · 4% 5 
Sucuri
· GoDaddy 1 host · 4%
Sucuri
· GoDaddy 1 host · 4% 6 
All-In-One WP Security
· UpdraftPlus no reports yet
All-In-One WP Security
· UpdraftPlus no reports yet 7 
Imunify Connect
· CloudLinux no reports yet
Imunify Connect
· CloudLinux no reports yet 8 
Loginizer
· Softaculous no reports yet
Loginizer
· Softaculous no reports yet 9 
Shield Security no reports yet
Shield Security no reports yet 10 
SiteLock
· Sectigo no reports yet
SiteLock
· Sectigo no reports yet 11 
Solid Security
· Nexcess no reports yet
Solid Security
· Nexcess no reports yet 12 
Wordfence
· Defiant no reports yet
Wordfence
· Defiant no reports yet 13 
WP Guardian
· WebPros no reports yet
WP Guardian
· WebPros no reports yet 14 WPScan
· Automattic no reports yet
WPScan
· Automattic no reports yet Each published host counts once in this layer. Share = percentage of the 26 hosts reporting here that run the product; bars are scaled to the layer leader. Self-reported and unaudited.