What is iThemes Security ?
Kadence Security remains focused primarily on WordPress hardening and login protection. It can block repeated login attempts, enforce stronger passwords, add two-factor authentication, monitor file changes, scan for known vulnerabilities, and apply additional server and WordPress security rules.
The plugin provides useful protection, but enabling every available setting without understanding its effect can cause login problems, blocked users, REST API conflicts, or unexpected behavior on WooCommerce and membership websites. Create a complete backup and test important settings before applying them to a production website.
WHAT IS ITHEMES SECURITY?
iThemes Security is the former name of the WordPress security plugin now called Kadence Security. The same plugin was previously renamed Solid Security before moving under the Kadence brand. Its WordPress.org slug remains “better-wp-security,” which can make the naming history even more confusing.
The plugin is designed to reduce common WordPress security risks rather than serve as a complete malware-removal service. Its strongest features are centered around user authentication, brute-force protection, vulnerability monitoring, file-change detection, password policies, and WordPress hardening.
The free version includes local and network brute-force protection, two-factor authentication, password requirements, banned-user management, file-change detection, scheduled site scanning, database backups, and several advanced security tools.
Kadence Security Pro adds features such as trusted devices, passwordless login, reCAPTCHA, detailed user logging, privilege escalation, automated vulnerability patching through Patchstack, and additional vulnerability-management options.
The plugin is actively maintained. The current WordPress.org listing requires a modern WordPress and PHP environment, so administrators running older websites should check compatibility before updating or installing it.
OUR ITHEMES SECURITY REVIEW
Kadence Security is a good choice when the main objective is to strengthen WordPress login security and reduce common automated attacks. Its onboarding process is easier than configuring every security rule manually, and the ability to apply different policies to administrators, editors, customers, and other user groups is particularly useful.
However, security settings should not be enabled blindly. Features that hide the login URL, modify server rules, detect visitor IP addresses, or automatically lock users out can create problems when a website uses a reverse proxy, CDN, custom login flow, membership plugin, or WooCommerce account system.
The plugin also should not be treated as a replacement for complete backups, server-level protection, updates, monitoring, or professional malware cleanup. It is one layer of WordPress security, not a complete security strategy.
For standard business websites, the free version provides a useful starting point. Pro is more relevant for websites with multiple administrators, customer accounts, membership functionality, sensitive user data, or a greater need for activity logging and vulnerability protection.
iThemes Security Key Features
- Local brute-force protection and login-attempt limiting. Network brute-force protection based on reported malicious activity
- Two-factor authentication using authenticator apps, email, and backup codes. Password requirements for selected WordPress user groups
- File-change detection. Site scanning for known WordPress, plugin, and theme vulnerabilities
- Banned-user and user-agent management. Hide Login URL option
- The Pro version includes trusted-device recognition, passwordless login and Magic Links, user activity logging, and automated vulnerability patching through Patchstack.
iThemes Security Pros & Cons
Pros
- Strong selection of login and user-account security features. Vulnerability scanning covers WordPress core, plugins, and themes
- Two-factor authentication is included in the free version. Advanced tools are available for experienced WordPress administrators
- Different security requirements can be assigned to different user groups. Local and network brute-force protection help reduce automated login attacks
Cons
- Aggressive lockout settings can block legitimate users or administrators. The history of iThemes, SolidWP, and Kadence branding can confuse existing users
- Some settings modify server configuration or important WordPress behavior. Incorrect IP detection can cause lockouts on websites using Cloudflare or another proxy. It does not replace complete malware scanning, malware removal, or full-site backups. WooCommerce, membership, and custom-login websites require careful testing
iThemes Security Free vs Premium
The free version is sufficient for many small WordPress websites that need two-factor authentication, password policies, brute-force protection, vulnerability scanning, file-change detection, database backups, and basic security hardening.
Kadence Security Pro is better suited to business, ecommerce, membership, and multi-user websites. It adds features such as trusted devices, passwordless login, reCAPTCHA, detailed user logging, temporary privilege escalation, and automated vulnerability patching through Patchstack.
Pricing and plan names can change, so verify the current options on the official Kadence Security website rather than displaying a hard-coded price that may quickly become outdated.
Common iThemes Security Problems & Fixes
I was locked out of WordPress after enabling iThemes Security. How can I regain access?
First, try the unlock link included in the security notification email. If that does not work, connect through FTP or the hosting file manager and temporarily rename the plugin directory inside wp-content/plugins.
Depending on the installed version, the directory may still use an older name such as better-wp-security, solid-security, or solid-security-pro. Renaming the correct directory will deactivate the plugin and should allow you to access WordPress again.
After regaining access, restore the directory name, reactivate the plugin, review the lockout logs, confirm that the website detects visitor IP addresses correctly, and reduce overly aggressive lockout settings. Do not immediately enable the same configuration again without identifying what caused the lockout.
Why does iThemes Security keep locking out legitimate users?
This commonly happens when login-attempt limits are too strict, multiple users share an IP address, or the website is behind Cloudflare, a reverse proxy, or a hosting firewall and does not detect visitor IP addresses correctly.
Check the security logs to determine which rule triggered the lockout. Then verify the proxy and visitor IP configuration before allowlisting addresses or increasing the lockout threshold. Permanently allowlisting a dynamic personal IP address is usually not a reliable long-term solution.
Why does iThemes Security report vulnerabilities?
The Site Scanner compares installed WordPress core, plugin, and theme versions with known vulnerability information. A warning does not necessarily mean that the website has already been hacked. It means that a component may contain a publicly disclosed security issue.
Confirm the affected component and version, create a backup, and install the latest safe update. If no official update is available, temporarily disable or replace the affected plugin when practical. Pro users may have access to virtual patching for certain vulnerabilities through the Patchstack integration.
iThemes Security Customization
CAN I USE ITHEMES SECURITY WITH WOOCOMMERCE?
Yes, but WooCommerce websites require more careful configuration than ordinary brochure websites.
Test customer registration, My Account login, password resets, guest checkout, logged-in checkout, payment callbacks, REST API requests, and administrator access after configuring the plugin. Avoid enforcing administrator-level security requirements on customer accounts unless they are genuinely necessary.
Aggressive reCAPTCHA, password, lockout, and hidden-login settings can create unnecessary friction for customers or interfere with custom login and checkout functionality.
HOW TO CONFIGURE TWO-FACTOR AUTHENTICATION
Enable two-factor authentication and assign it first to administrator accounts. Allow each administrator to configure an authenticator application and save their backup codes in a secure location.
Test a complete logout and login before requiring two-factor authentication for every user. After confirming that it works correctly, apply appropriate requirements to editors or other privileged roles.
Requiring two-factor authentication for ordinary WooCommerce customers is not always necessary and may reduce usability. Security requirements should reflect the access and risk associated with each role.
Frequently Asked Questions about iThemes Security
Is iThemes Security now called Kadence Security?
Yes. iThemes Security was first renamed Solid Security and is now called Kadence Security. Existing users may still see older names in documentation, database options, plugin directory names, or previous support discussions.
Is iThemes Security free?
Yes. The plugin has a free version available through WordPress.org, with additional commercial features offered in its paid version.
Will Kadence Security completely protect a WordPress website?
No security plugin can prevent every attack. Kadence Security should be combined with current WordPress and plugin versions, secure hosting, strong administrator credentials, two-factor authentication, least-privilege user access, complete off-site backups, and regular monitoring.
Is iThemes Security better than Wordfence?
The plugins emphasize different areas. Kadence Security is particularly strong in login protection, user security policies, hardening, and vulnerability management. Wordfence is commonly selected when users specifically want an endpoint firewall and malware scanner.
Running multiple full security plugins together can create duplicated functionality, additional server load, conflicting lockouts, and confusing logs. Choose the plugin that best matches the website’s needs instead of enabling every overlapping feature.