SiftWP and Solid Security compared
| SiftWP | Solid Security (iThemes Security) | |
|---|---|---|
| Core job | Finding and fixing a compromise | Hardening a site so it is harder to compromise |
| How it connects | A dedicated SSH key. No plugin. | A WordPress plugin |
| Login protection | Not included | Two-factor authentication and brute-force protection, according to SolidWP |
| File changes | A weekly comparison of core files and a review of new and changed files | File-change detection on the free and Pro versions, according to its plugin listing |
| Malware scanning | A weekly scan of files and the database | Not a malware scanner, according to reviewers. Its scheduled scan checks known vulnerabilities and blacklist status. |
| Known plugin flaws | Flags outdated core and plugins | A site scan for known vulnerabilities. Pro adds virtual patching for some of them through Patchstack, according to SolidWP. |
| After a finding | Safe fixes applied and files quarantined. Risky changes wait for your approval. | Blocks and locks out bad logins. It does not clean an existing infection. |
| Pricing | $9, $29 or $49 per site per month, with 100 free credits to start | A free Basic version and a paid Pro version. Confirm current prices on SolidWP's site. |
Two sides of an incident
Solid Security works mostly before something goes wrong. It makes logins harder to attack and blocks repeated guesses. SiftWP works mostly after: it checks whether anything has already changed on the server and deals with it. A site needs both kinds of protection, and they are rarely the same tool.
You may also know this plugin as iThemes Security, or, before that, Better WP Security. It is the same product under three names.
Where Solid Security is stronger
- Login hardening. Two-factor authentication and brute-force protection are its core strength. SiftWP has neither.
- Prevention for known flaws. In Pro, virtual patching through Patchstack can block exploitation of some known plugin vulnerabilities before you update.
- A free version. Basic costs nothing and covers the main hardening features.
- More frequent checks. Its site scan can run several times a day, according to its plugin listing. SiftWP scans weekly.
Where SiftWP is stronger
- Finding what is already there. Malware, backdoors, a new administrator, a changed database row and tampered core files are what SiftWP looks for.
- Cleanup. Safe fixes are applied automatically, files are quarantined and never deleted, and anything risky waits for your approval.
- No plugin. Nothing new inside WordPress to update or to be attacked.
Using both
This is the pairing that makes the most sense. Solid Security hardens logins and blocks known flaws. SiftWP checks every week that nothing slipped through. SiftWP installs nothing in WordPress, so the two do not conflict.
If your site is already hacked, start with cleanup. Our guide to fixing a hacked WordPress site covers the first steps. Hardening comes after the site is clean.
Which one fits your site?
Choose Solid Security (iThemes Security) if...
- You want two-factor authentication and brute-force protection on your logins
- You want known plugin flaws patched virtually before you can update (Pro)
- You already have malware detection and cleanup covered elsewhere
Choose SiftWP if...
- You need a weekly scan for malware, backdoors and tampered core files
- You want an agent to investigate findings and fix the safe ones
- You would rather not add another plugin for something SSH access can do