WordPress malware scanners compared: Wordfence, Sucuri, MalCare, Solid Security, Jetpack Protect and Security Guard

WordPress malware scanners compared on their own pages differ most in three ways: where the scan runs, whether a firewall comes with it, and whether anyone cleans up for you. Wordfence and Defender scan on your server and include a firewall. Sucuri, MalCare and Jetpack Scan run the scan on their own servers, and Security Guard scans on your server, names fake CAPTCHA and blockchain loaders, and has no firewall.

Checked 20 October 2026. Features and prices come from each vendor’s own page or WordPress.org listing, listed in the sources under the table. “Not stated” means the pages we read don’t say, not that the feature is missing. We make Security Guard, so weigh our row accordingly and check the others yourself.

Which one fits?

It depends on the job you need done, because a firewall, a scanner and a cleanup service are three different things.

• You want attacks blocked before they reach WordPress: you need a firewall. Wordfence, MalCare, Defender, AIOS, Jetpack Scan and Kadence Security Pro include one, and Sucuri sells a cloud firewall on its paid Platform.
• You think the site is already infected and want someone else to clean it: Sucuri’s Platform includes unlimited manual cleanups, Wordfence Care and Response include hands-on cleanup, and MalCare Repair cleans automatically.
• Visitors see a fake “Verify you are human” box, or you want to know exactly which file and line changed: a scanner that names those patterns and keeps a baseline fits. Moatline and our Security Guard both name ClickFix and blockchain loaders.

Most sites end up with a firewall plus a scanner. Security Guard is the scanner half of that pair.

How do the scanners compare, row by row?

The table lists the cheapest plan that includes a malware scan, for one site. The vendor pages each row came from are listed under it.

Sources. Every competitor fact in the table and on this page comes from the vendor’s own page or WordPress.org listing, checked 20 October 2026.

• Wordfence: pricing page and WordPress.org listing (version 9.0.2), including its changelog.
• Sucuri: Platform signup page and WordPress.org listing (version 2.8.1).
• MalCare: pricing page and WordPress.org listing (version 6.76).
• Jetpack: Jetpack Scan page and Jetpack Protect listing (version 6.1.0).
• Defender: WPMU DEV product page and WordPress.org listing (version 6.3.0).
• AIOS: pricing page and WordPress.org listing (version 5.4.10).
• Kadence Security: WordPress.org listing (version 10.0.6) and Liquid Web pricing.
• Moatline: WordPress.org listing (version 1.2.0) and Pro page.
• Patchstack: pricing page.

Is a malware scanner the same as a firewall?

No. A firewall inspects requests as they arrive and blocks the ones that look like attacks, while a scanner reads the files and database that are already on the site and tells you what looks wrong.

You want both, because they fail in different ways. A firewall can’t see a backdoor that went in through a stolen administrator password, since that login looks like a normal one. A scanner can’t stop the next request. GoDaddy’s security team reported on 17 October 2024 that one fake-plugin campaign got in by logging in with stolen credentials. It “is not related to any known vulnerabilities in the WordPress ecosystem.”

Security Guard is not a firewall. It has no request filtering, no IP blocklist and no login limits, so it pairs with one. Patchstack is the opposite case: its pricing page (checked 20 October 2026) says it “does not scan your files like a malware scanner”.

Where does each scan run, and does it upload my files?

Wordfence, Defender, Moatline and Security Guard scan on your own server. Sucuri, MalCare and Jetpack run the scan on their own servers, according to their own pages.

MalCare’s pricing page says “The scan runs on our servers, so your site doesn’t slow down.” Jetpack’s Scan page says “Scanning takes place on our servers”. Sucuri’s free plugin calls its check “Remote Malware Scanning” with “our remote scanner” on its WordPress.org listing. All three were read on 20 October 2026.

Security Guard sends no site files anywhere. It fetches the core checksums from api.wordpress.org, and your licence key and site address go to our licence server. The scan reads 120 files per request, so a large site scans in many short steps instead of one long one.

Which ones clean malware for you, and is that safe?

Sucuri’s Platform, Wordfence Care and Response, MalCare Repair, Jetpack Scan and Moatline Pro offer some form of cleanup, and they mean different things by it.

Sucuri and Wordfence use people. Sucuri’s signup page promises “Unlimited manual cleanups included on every plan”. Wordfence’s pricing page says that with Care ($590 a year) or Response ($1,250 a year) “our team will work with you to clean and restore your site”. MalCare Repair ($299 a year), Jetpack Scan and Moatline Pro use automated one-click removal. Defender repairs core files only.

Automatic cleanup is safe when the tool replaces a file with a clean copy from WordPress.org. It is riskier when it edits a theme file or a database row, because malware often sits inside code you also need. Take a backup first either way.

Security Guard doesn’t clean. It never deletes or edits a file it flags, and shows you the file and line, the post, the option or the user, so you or your developer decide what to remove. If you want the cleanup done for you, a human service fits better than our plugin.

Which ones look for fake CAPTCHA and blockchain loaders?

Of the products in the table, only Moatline and Security Guard name ClickFix and EtherHiding on the pages we read. The others may still catch these scripts with general signatures. Their pages just don’t say so.

ClickFix is the fake “Verify you are human” box that copies a command to the visitor’s clipboard and asks them to run it. Microsoft described it on 21 August 2025 as a way to “trick users into running malicious commands on their devices”. EtherHiding is the loader behind many of these boxes: Google’s threat team counted about 14,000 web pages with that kind of injected script as of June 2025, placed in plugin files, theme files or the database.

Security Guard looks for the blockchain RPC call (eth_call), the clipboard-plus-command pattern, fake verify prompts, web shells and obfuscated script. It checks plugin, theme, must-use plugin and uploads files, plus posts, post meta and options in the database. Our guide to the fake Cloudflare CAPTCHA on WordPress shows where the loader hides and how to find it by hand.

Signatures only catch what they describe. A loader written next month may not match until we add it, which is why Security Guard also keeps a baseline: a file that changed since you saved it shows up even when no signature fires.

Can a scanner stop an injected script reaching visitors?

A scanner on its own can’t, but Security Guard adds two layers that act on the page itself while you clean up: a script filter and a Content-Security-Policy.

The filter, Remove injected scripts under Settings, Security Guard, Protection, strips inline scripts that match its malware signatures before the page leaves the server. On 20 October 2026 we planted an EtherHiding-style loader and a ClickFix clipboard script on our test site. With the filter on, both came out of the page and each left a High line in the event log. The theme’s own scripts stayed.

The Content-Security-Policy tells the browser which hosts page scripts may call. In Enforce mode the connect-src rule allows only your own site and the hosts you list, and per the W3C CSP draft (16 September 2026) other calls “return network errors”. That is what stops a blockchain loader fetching its payload. Start in Report only, read the violations in the Event log tab, then switch to Enforce.

Only one plugin should send a Content-Security-Policy header, because the browser applies every policy it receives, so a script has to pass each one. Sucuri’s free plugin can also send one: its listing (checked 20 October 2026) points to a Headers Management page and supports “Report-Only” for now. None of the other pages we read name a CSP setting. If you already send a CSP from Sucuri, your host or a CDN, set Security Guard’s CSP mode to Off.

What do the free versions leave out?

Every free tier here scans something, but each stops at a different point.

• Wordfence Free: firewall rules and malware signatures arrive 30 days after Premium gets them, per its pricing page.
• MalCare Free: weekly scans. “Free finds malware but doesn’t remove it,” says its pricing page.
• Jetpack Protect: the free plugin runs vulnerability scans, not a malware scan, per its listing. Malware scanning comes with the paid Jetpack Scan.
• AIOS Free: a firewall and file change scanner, with malware scanning marked Premium on its listing.
• Sucuri plugin: remote scans and hardening, with the firewall sold separately per its listing.
• Moatline Free: the scan is free and weekly. Daily scans and one-click removal are Pro, per moatline.io.

Security Guard has no free version. If a free scan is all you need, Wordfence Free or the Defender free plugin are where we would start.

What does each cost per year?

For one site with a malware scan, prices run from $39 (Moatline Pro) to $229 (Sucuri Basic Platform), with Security Guard at $49.

These are the cheapest listed plans with a malware scan, checked 20 October 2026.

• Moatline Pro: $39
• Security Guard: $49
• Defender Pro Basic: $50
• Jetpack Scan: $59.40 the first year, then $119.40
• AIOS Premium Personal: $89 for up to 2 sites ($44.50 the first year)
• MalCare Protect: $99 (cleanup needs Repair at $299)
• Wordfence Premium: $149
• Sucuri Basic Platform: $229, with cleanups included

Kadence Security has no price of its own that we could find, and its pages describe no file malware scan. Liquid Web lists it inside a $350 bundle for one site.

Security Guard is $49 a year for 1 site, $89 for 5 sites and $149 for unlimited sites. Every feature works on every plan.

Can I run Security Guard next to Wordfence or Solid Security?

Yes, that is the setup it is built for: the firewall plugin blocks requests, and Security Guard reads the files, watches the baseline and filters the page.

Two things to set when you pair them. Let only one plugin send a Content-Security-Policy header. And if both plugins scan files on a schedule, set the scans at different times so they don’t run together on a small server. Our Security Guard user guide lists each setting and its default.

Where doesn’t Security Guard fit?

It is the wrong pick if you want one plugin that does everything, or someone to clean the site for you.

• No firewall, no login limits and no two-factor sign-in.
• No automatic cleanup. It reports, you remove.
• Signature-based with a baseline, and no live threat feed.
• Blocking PHP in uploads works through .htaccess on Apache and LiteSpeed. On Nginx you add your own rule.
• We have not tested it on multisite yet.
• It lists the administrators WordPress reports, so an account hidden by a pre_user_query filter won’t show in that list. Our guide to checking if a WordPress site is hacked gives the database query that finds them.

Which one should I pick for my site?

Pick by the problem in front of you, not by the longest feature list.

• You have nothing yet and no budget: Wordfence Free gives a firewall and a scan on your server.
• The site is infected and you want it handled: a human service such as Sucuri’s Platform or Wordfence Care.
• Visitors report a fake verify box, or you want to see every changed file: Security Guard next to your firewall, with the CSP in Report only for the first week.
• You want a ClickFix-aware scanner with one-click removal and no firewall need: Moatline Pro does that, and it is $10 a year cheaper than us.

If you go with Security Guard, the product page shows each tab, and the user guide walks through the first scan and baseline.