Sucuri Security Plugin Setup for WordPress
Sucuri offers two products: the free Sucuri Security plugin (audit, scanning, hardening) and the paid Sucuri Firewall / CDN ($9.99/month) — WAF at DNS level. The plugin without Sucuri Firewall is a monitoring tool, not real-time protection.
Free Plugin: Capabilities
Security Activity Auditing — logs all administrative actions: logins, plugin changes, updates. Stores logs in database table and optionally sends to Sucuri API (protection against deletion if compromised).
File Integrity Monitoring — compares core files against official hashes. Detects modified and added files.
Remote Malware Scanning — external scanning via SiteCheck API: checks homepage for malware, blacklist status from Google, Bing, Norton.
Security Hardening — a set of one-click security measures.
Security Hardening
Sucuri → Settings → Hardening. Apply:
- ✓ Verify WordPress Version (reminds to update)
- ✓ Remove WordPress Version (removes version from head and RSS)
- ✓ Block PHP files in the uploads directory
- ✓ Block PHP files in the wp-content directory
- ✓ Block PHP files in the wp-includes directory
- ✓ Information Leakage (removes readme.html, license.txt)
PHP blocking in uploads creates .htaccess:
<Files "*.php">
Order Allow,Deny
Deny from all
</Files>
On Nginx, add the equivalent manually:
location ~* /(?:uploads|files)/.*\.php$ {
deny all;
}
Alerts Configuration
Sucuri → Settings → Alerts:
- Email for alerts: do not use [email protected] — if domain email is compromised, you lose notifications. Use external email.
- Alert on new user registration: ✓
- Alert on WordPress admin login: ✓ (only for small sites)
- Alert on failed login attempt: no (too many emails)
- Alert on plugin activated/deactivated: ✓
Post-Hack Actions
If a hack is detected: Sucuri → Post-Hack. Section contains:
- Update Secret Keys — generate new keys in wp-config.php, reset all sessions
- Reset User Password — reset passwords for all users
- Reset Installed Plugins — reinstall all plugins (from WordPress repository only)
- Available Free WordPress Transfers — emergency site migration
Sucuri WAF (Paid)
The paid WAF works differently: your domain's DNS points to Sucuri servers, all traffic goes through them. Sucuri filters malicious traffic before it reaches your server. The plugin is used for configuration and monitoring.
To enable: Sucuri → Firewall WAF → Add Site. Change domain NS/A records. Sucuri proxies traffic to origin server by IP (not by domain — whitelist only Sucuri IP).
Comparison with Wordfence
Sucuri WAF (paid) — network-level protection, reduces server load. Wordfence WAF — PHP-level protection, server still receives requests. For high-load sites, Sucuri WAF is more efficient. For budget sites, free Wordfence is sufficient.
Timeline
Installation and setup of free Sucuri plugin with hardening — 1–2 hours. Enabling Sucuri WAF with DNS change — 2–3 hours (plus up to 24 hours for DNS propagation).