Kadence Security Pro: WordPress Login and Vulnerability Controls

Kadence Security Pro helps manage WordPress login security, software vulnerabilities, and site activity. Its real-time dashboard brings together brute force attempts, banned users, active lockouts, scan results, and visitor security statistics.

Choose settings for the site and its users

Setup templates cover ecommerce, network, non-profit, blog, portfolio, and brochure sites. User groups let you apply various requirements to clients, clients, administrators, and other users. For example, you can require two-factor authentication for clients or set a password policy for customer accounts.

Two-factor authentication can require a code alongside a password. Users can get codes from apps such as Authy or Google Authenticator, email, or backup codes. Password requirements let you create and enforce an account password policy.

• reCAPTCHA: Helps deter bots attempting logins with compromised passwords, posting spam, or scraping content.
• Passwordless logins: Let users sign in with a click while maintaining two-factor authentication and strong password controls.
• Trusted Devices: Identifies approved devices, helps limit session hijacking, and can restrict Administrator privileges to trusted devices.
• Privilege Escalation: Provides a way to grant temporary administrator-level access.
• Magic Links: Let a user log in when their username is locked out by Local Brute Force Protection.

Find and address vulnerable software

The Pro Site Scanner checks WordPress core, extensions, and themes for known vulnerabilities and can run hourly. It also checks blocklist status through the Google Safe Browsing API and can alert you if malware is found. Patchstack integration delivers automated virtual patching for some vulnerabilities, including fixes that may be available before a extension or theme developer issues a patch.

Kadence Security uses the Patchstack Priority score to assess vulnerability risk based on the likelihood of exploitation and potential impact on the site. Version Management can automatically update WordPress, add-ons, and themes when configured. It also includes options for hardening a site running outdated software and scanning for old sites.

Review activity and apply site controls

User Logging entries security-related events such as logins and logouts, registrations, add-on and theme changes, and edits to posts and pages. File Change Detection logs changes to site files that may help identify malicious activity. Scan results and security events are also available from the dashboard.

• Database Backups: Creates scheduled, emailed WordPress database backups. These are not complete site backups.
• Enforce SSL: Forces site connections to use SSL/TLS.
• Geolocation: Connects Trusted Devices to an external location or mapping API.
• Other utilities: Include changing the login URL, reviewing file permissions, viewing or flushing server and wp-config.php security rules, changing WordPress salts, and identifying server IPs. Tools can also change the first user ID or database prefix, which may help against attacks that assume default values.

Setup and compatibility

Choose a site template, identify user groups, and configure login, vulnerability, logging, and backup settings. Review the dashboard for security activity and scan results. The plugin is tested against the latest stable WordPress release, and compatibility is guaranteed only with that release. Hosting must use Apache or LiteSpeed with mod_rewrite, or NGINX.

Before applying settings to an existing site, make a complete backup: Kadence Security can change the database and other site files. Its built-in backups cover the WordPress database only. Kadence Security helps address common attack methods, but it cannot prevent every possible attack.