Hot Shield blocks attacks before your other plugins even load, locks out password guessers and checks every file on your site.
No account needed. Nothing about your visitors leaves your site.
Each one catches what gets past the one before. All five are in the free plugin.
It loads before every other plugin, so an attack on a plugin's security hole is stopped before that plugin ever runs.
Attackers start by finding your usernames and pointing bots at your forms. Hot Shield gives them nothing.
Where attackers spend most of their time, and where most of them give up.
A stolen password is not enough. Free for every role, not only administrators.
If something did get in, you hear about it, with a plain explanation and the next step.
It looks like WordPress because it lives there. No new dashboard to learn, no account to make.
Green, amber or red, and the one thing to fix next.
Turn it on and it protects the site. Try the firewall in log-only mode first if you like.
"PHP file in uploads" instead of a threat code.
Each admin picks their own look, or lets it follow the computer.
Example scan with made-up file names.
The Ultimate plan adds a dashboard for all your sites and a monthly report you can send as your own.
Scans run on your own server. No account, no cloud scanner, no tracking. These are the only outside lookups, and none of them carry personal data.
Public prices for one site, per year, and the points buyers ask about most.
| Hot Shield | Wordfence | MalCare | Sucuri | |
|---|---|---|---|---|
| Paid plan, 1 site | $59 | $149 | $99 | $229 |
| Free version | Yes, no account needed | Yes | Yes | Yes |
| Two-factor login, free | Every role | Yes | Up to 2 admins | No |
| Where scans run | Your server | Your server | Their servers | Their servers |
| Malware results, free | All shown | All shown | Shown after you pay | Remote check only |
| Client reports under your brand | Included, 10 sites | Not listed | Not listed | Not listed |
From each company's public pricing page and plugin listing, checked November 2026. Prices change; check theirs before you decide.
Every plan includes the full free plugin. Pro adds the clean-up tools; the larger plans add the agency dashboard.
Hot Shield is a WordPress security plugin made by the BrewingHOT team. It puts five layers in front of a site: a firewall that runs before other plugins, an invisible bot check, login protection, two-factor login and a weekly scan of files, malware and the server. Everything runs on your own site.
Yes. The free version has all five layers for one site, with no account needed. Paid plans add Pro: a deep malware scan with one-click clean-up, daily scans, country blocking, automatic bans and Telegram alerts. Starter is $59 a year for 1 site or $119 for 5 sites; Ultimate adds the dashboard for all your sites and client reports under your name, $199 a year for 10 sites or $299 for 25.
The firewall check takes less than a millisecond per page. Scans run in the background once a week, or once a day with Pro.
Lockouts end on their own after 30 minutes by default, and only the IP is locked, never your username. You can add your office IP to a "never lock out" list, and renaming the plugin folder over FTP switches Hot Shield off.
Log in with one of your 8 backup codes, or ask another administrator to turn two-factor login off for your account.
Yes. Every scan looks at the PHP and database versions on the server and tells you if one no longer gets security fixes or has known holes, with a note to send your host. It also flags risky settings like error messages shown to visitors or a debug log in a public folder.
Yes. Choose Cloudflare as the source of visitor IPs, and Hot Shield only trusts that header when the request really comes from Cloudflare. Behind another proxy or CDN, choose the X-Forwarded-For header and list the proxy addresses, so every visitor keeps their own IP.
Yes. Checkout, the store API and the WooCommerce login form are covered and tested, including addresses that contain words like "select" or "union".
It only puts back official copies of WordPress and plugin files, and only moves loose files into quarantine, always with a backup first. Theme and custom plugin files are flagged for a hand fix instead, and anything in quarantine can be put back.
The BrewingHOT team, a web agency that looks after WordPress and Shopify sites.