Patchstack – WordPress & Plugins Security vs SAR One Click Security

Patchstack is a powerful tool that helps identify security vulnerabilities within your websites’ plugins, themes, and WordPress core. It is powered by the WordPress ecosystem’s most active community of ethical hackers. Patchstack is trusted by leading WordPress experts such as Pagely, Cloudways, GridPane, Plesk, and others! Patchstack is a security plugin for WordPress that finds WP core, plugin and theme vulnerabilities in your websites. The free version includes up to 48-hour early warning for new vulnerabilities found by our security research community. It also allows you to automatically update vulnerable software, manage updates remotely, and get snapshot reports on your sites’ security status. The paid version includes automatic vulnerability protection. Patchstack deploys highly targeted rules on a per-site basis, only when a specific vulnerability is detected on a site. This prevents vulnerable components from being exploited without modifying website code, or impacting site performance or functionality. Patchstack’s paid version includes access to 12,000+ individual protection rules (vPatches). Patchstack paid version also includes other preventive security features, such as 2 factor authentication, WordPress specific hardening rules, a Community IP blocklist for malicious IP addresses, advanced security settings, and custom protection rules. Post-hack cleanups vs attack prevention in WordPress security Unlike the standard approach to WordPress security (malware scanning and infection cleanups), Patchstack is focused on preventing infections in the first place. Thanks to its big WordPress security research community and partnerships with nearly one thousand plugin vendors and developers, Patchstack is regularly among the first to identify new vulnerabilities. Who is Patchstack’s WordPress security plugin for? Patchstack’s vulnerability management works extremely well for: Agencies with WordPress care/maintenance plans for their customers’ websites WooCommerce websites to protect their revenue and customers from attacks Hosting companies that want to deliver highly targeted vulnerability protection easily and at scale Website owners You don’t have to be highly technical to use it. Install the plugin, connect it with the Patchstack App, and stay safe! What features are included in the Patchstack Personal (Free) plan? Patchstack’s Personal plan is a free security service for WordPress that lets you find and manage vulnerabilities in your websites. It includes access to a central security dashboard via the Patchstack web App for more visibility and control over your sites’ security: Be the first to know about new vulnerabilities. Receive notifications if any installed plugins or themes have security issues. Detect the latest security vulnerabilities in WordPress plugins. Detect the latest security vulnerabilities in WordPress themes. Detect the latest security vulnerabilities in WordPress core. Receive real-time alerts via email if any security vulnerabilities are found. Manage core, plugin and theme updates from a single dashboard. [Optional] Enable automatic updates for vulnerable plugins only. Generate snapshot reports about the security status of your website. What features do Patchstack paid subscriptions have? Patchstack’s paid subscriptions include automatic protection for WordPress vulnerabilities, as well as other protection modules. Virtual patching to prevent vulnerable components from being exploited Advanced hardening module for added WordPress security Remote hardening settings (including .httacess, login protection and reCAPTCHA) Community IP Blocklist of known attacker IP addresses All of these features are included in the Developer and Enterprise plans. Additionally, Developer and Enterprise plan users have access to custom protection rule creation, periodical security reports and report scheduling. Personal (Free) plan users can enable these features on a per-site basis for $5 / site per month. Important Resources Patchstack website Help Center Changelog Patchstack Vulnerability Database See what our customers say about our paid plans: “An excellent and valuable service that’s backed by a company that contributes a significant number of resources and money directly back to the WordPress ecosystem.” – John Blackbourn “Patchstack is like CrowdStrike, but for websites!” – Ryan McCue, HumanMade “The service here is superb! And they are always right on it with the best solution to solve the problem or question at hand. The tool itself speaks for itself. I am very satisfied with this project and the service they offer.” – Daniel Canup “This is a security plugin everyone needs to install. The Patchstack team are incredible at what they do. We have been using them for years and have not been disappointed!” – @craniumstudio “We’ve been with Patchstack for a LONG time (even before they were Patchstack). It has always done its job seamlessly and without fail. Ongoing innovation and updates to the Patchstack product mean this plugin is a winner. 5 stars all the way.” – @guapx (*Comparisons are made by evaluating paid versions.) Sucuri vs. Patchstack Wordfence vs. Patchstack Malcare vs. Patchstack Sitelock vs. Patchstack

There’s a lot of WordPress security plugins with many many options and pages to setup. And that is fine if you know what to do. But most of the times, you don’t need so much or simply you’re not sure about what to set or not. This plugin adds some extra security to your WordPress with only one click. No options page, just activate it! Features Like many other security plugins SAR One Click Security adds well known .htaccess rules, but only the ones probed to be safe to use in almost any type of site (including WooCommerce stores), to protect your WordPress from common attacks. This allows you to have a safer WordPress without worries about what protection you should be using. Turn off ServerSignature directive, that may leak information about your web server. Turn off directory listing, avoiding bad configured hostings to leak your files. Blocks public access (from web) to following files that may leak information about your WordPress install: .htaccess, license.txt, readme.html, wp-config.php, wp-config-sample.php, install.php Blocks access to wp-login.php to dummy bots trying to register in WordPress sites that have registration disabled. Blocks requests looking for timthumb.php, reducing server load caused by bots trying to find it. (*) Blocks TRACE and TRACK request methods, preventing XST attacks. Blocks direct posting to wp-comments-post.php (most spammers do this) and access with blank User Agent, reducing spam comments a lot and also server load. Blocks direct access to PHP files in wp-content directory (this includes subdirectories like plugins or themes). Protecting you from a huge number of 0day exploits. Blocks direct POST to wp-login.php and access with blank User Agent, preventing most brute-force attacks and reducing server load. Blocks access to .txt files under any plugin/theme directory to prevent scans for installed plugins/themes. Blocks any query string trying to get a copy of the wp-config.php file. Blocks gf_page=upload query string argument, this was deprecated in Gravity Forms on May 2015, if your copy of Gravity Forms still uses it, update now! Removes version information from page headers. This includes not only the page header (html or xhtml) but also feed headers (rss, rss2, atom, rdf) and opml comments. Only the version number is removed, not the entire generator information. (*) If your theme uses TimThumb, you can disable that blocking rule, check FAQ before installing the plugin to see how. Requirements WordPress 3.9.2 or higher. (Works with WordPress network/multisite installation). Apache 2.4.x web server It has been tested in many servers including large providers like HostGator, Godaddy and 1&1 with optimal results, and it will work fine in any decent hosting service (that allows you to set options from .htaccess files). Anyway, if you get any problem after activating the plugin, check FAQ for instructions on how to manually uninstall it. If you’re not sure of which server is your hosting company using or if they allow to use custom .htaccess rules, I would recommend you to contact with your host support before installing the plugin. Usage To apply above mentioned security rules simply install and activate the plugin, no options page, no user setup! If you need to remove the security rules for some reason, simply deactivate the plugin. If you want to add them again, activate the plugin again, that easy 😉 And remember, if your theme uses TimThumb, check FAQ before installing the plugin.