All-in-one security that won't lock you out of your own admin.
Login hardening, 2FA, file integrity, endpoint WAF, audit log. Every blocking feature has a documented rescue path so you cannot get stuck. Run new defaults in soft mode for 14 days, promote to enforce when you trust them.
Cloud-driven defenses, advanced auth, and forensics - without the lockout risk.
Cloud-pushed WAF rules
Daily-updated firewall patterns from cross-site attack telemetry, layered on top of free's bundled OWASP-style rule set. No same-day delay.
CVE detection
Match every installed plugin and theme against the live vulnerability feed. Get alerted the moment a CVE lands that affects your stack, with the fixed version and severity inline.
Magic-link login & per-role MFA
Passwordless login via emailed one-time link. Force 2FA enrollment for specific roles (e.g. administrators, editors) before they can use wp-admin.
Lockdown & forensics
One-click emergency lockdown kills sessions, blocks file writes, and shows a maintenance page. Tamper-evident audit log + one-click forensic ZIP for incident response.
IP reputation & country / ASN block
Cloud-fed list of known-bad IPs is checked on every request. Block by country (ISO-3166-1) or autonomous system, with an allowlist that never gets your own session caught up.
Alerts where you actually look
Slack, Discord, Microsoft Teams, PagerDuty (Events API v2), Twilio SMS, and a generic HMAC-signed webhook. Severity threshold per channel - no Slack spam from low-priority noise.
Live attack map
Real-time world map of where attacks are coming from. Free plots by country; Pro adds city-level accuracy, live polling, and animated attack trails.
Custom WAF rules + templates
Cloudflare-style rule editor with curated templates. Free ships 3 templates and a 1-rule cap. Pro unlocks 30+ templates, unlimited rules, geo / ASN / rate-limit conditions.
Scheduled lockdown
Restrict wp-admin to a recurring time window. Free supports one daily window; Pro adds per-weekday rules, multiple windows, and holiday overrides. Authenticated sessions always exempt.
Deep IP investigation
Click any attacker IP for WHOIS, reverse DNS, AbuseIPDB confidence score, Tor exit check, DNSBL listings, behavioral classification, and neighbour-subnet activity.
One-click abuse reports
Send a pre-filled abuse report to the offending IP's hosting provider. WHOIS contact, attack stats, and recent events auto-populated. Pro can batch and follow up.
See what each major feature actually looks like.
Free vs Pro broken down per feature. Where free gives you a real working version, Pro extends it with cloud data and richer surfaces.
See exactly where attacks are coming from, as they happen.
Every blocked request and lockout is plotted on a world map, grouped by country and sized by attack volume. Pulsing dots draw your eye to the active hotspots. Click any pulse to jump straight into the IP detail page.
- ● Free: country-level pins via bundled IP/country table, 1h / 24h / 7d windows, snapshot refresh.
- ● Pro: city-level precision from licensed feed, 60-second live polling, animated attack trails, ASN/country breakouts.
Cloudflare-style rules, without the Cloudflare price tag.
Build IF/THEN rules across IP, user-agent, URI, method, referer, and (Pro) country / ASN / rate-limit. Start from a curated template or write from scratch. Every rule runs before the bundled WAF, so an Allow rule can short-circuit false positives.
- ● Free: 1-rule cap, 3 templates, full condition library for IP / URI / method / referer / UA.
- ● Pro: unlimited rules, 30+ templates, geo + ASN + rate-limit + JS-challenge actions.
Test a rule against your last 10 real attacks before you save it.
Click "Test" on the rule editor and MossHill replays the most recent 10 blocked requests against your unsaved condition. Green border = would match. Grey = wouldn't. No more false-positive surprises after deploying a rule.
- ● Free + Pro: tester works against any rule, draft or saved. Pro can also replay the last 1000 events.
91.218.114.4 POST /wp-login.php
MATCH
185.234.219.18 POST /wp-login.php
MATCH
8.8.8.8 GET /xmlrpc.php
skip
194.5.81.122 POST /wp-login.php
MATCH
66.249.66.1 GET /wp-admin/
skip
141.98.10.97 POST /wp-login.php
MATCH
Everything we can learn about an attacker, in one screen.
Click any IP and MossHill pulls WHOIS, reverse DNS, AbuseIPDB confidence, Tor exit status, DNSBL listings (Spamhaus, Barracuda, SORBS), datacenter detection, behavioral classification, and /24 subnet neighbours. One-click block, abuse-report, or unlock right from the same page.
- ● Free: WHOIS, reverse DNS, behavioral classifier, /24 neighbours, opt-in DNSBL / Tor / AbuseIPDB (BYO key).
- ● Pro: country + ASN org + city precision from the cloud feed, no API keys required.
Close wp-admin after hours. Open it again at 9am.
Drastically reduce your attack surface by restricting wp-admin and wp-login.php to the hours your team is actually working. The site front-end stays live; only the admin doors close. Authenticated admin sessions and the activator IP are always exempt, and a 7-day soft-mode period logs would-have-blocked requests so you can verify the schedule is sane before promoting to enforce.
- ● Free: one daily window (cross-midnight supported), 7-day soft-mode period, audit log of attempted access.
- ● Pro: multiple windows, per-weekday rules ("block weekends only"), holiday overrides.
| Plugin | Last updated | Risk |
|---|---|---|
| WooCommerce | 3 days ago | Low |
| Yoast SEO | 1 week ago | Low |
| Contact Form Wizard | 8 months ago | Medium |
| Old Gallery Lite | 3 years ago | Abandoned |
| Cheap-SEO-Booster CVE-2025-1234 | 2 years ago | High |
Know which of your plugins is the next breach waiting to happen.
Every installed plugin and theme gets a risk tier (Low / Medium / High / Abandoned / Unknown) based on WP.org freshness, version age, "tested up to" status, install size, and active install count. Indicators show up in the official plugins screen too — no need to leave the page you're already on.
- ● Free: heuristics-based risk tiers via WP.org metadata, 24h cache, plugin-row badges.
- ● Pro: CVE detection against live vulnerability feed, severity scoring, "this plugin is part of an active campaign" alerts.
Send a polished abuse report to the offending IP's hosting provider — in one click.
MossHill runs a raw WHOIS lookup (port 43, no API key) against the attacking IP, extracts the abuse contact email, and pre-fills a complete report with your site URL, attack stats, and the most recent events from your audit log. Edit if you want; send when ready. Every send is logged.
- ● Free: WHOIS lookup, auto-populated subject + body, sends via your site's wp_mail.
- ● Pro: bulk reports across multiple IPs, response tracking, custom templates per provider.
[email protected]The IP address 91.218.114.4 has launched 427 failed login attempts against my WordPress site at https://example.com over the past 7 days...
Most recent events (UTC):
2026-05-11 04:12:33 auth.login_failed (admin)
2026-05-11 04:12:35 auth.login_failed (administrator)
...
Five live feeds, one license. No same-day delay.
Pro gets five separately-cached cloud feeds, refreshed via WP-Cron: daily-updated WAF patterns, IP reputation list (300k+ known-bad IPs), CVE detection against your installed stack, city-precision GeoIP, and malware signatures (kept out of free because YARA-style patterns trip Plugin Check and AV scanners).
- ● Each feed runs out-of-process; failures are silent and your site keeps working on stale data.
- ● License key is checked on the feed endpoint, not in your request path. Zero added latency.
Magic-link login. Per-role MFA enforcement. Trusted devices.
Skip the password — let your team sign in with a one-time emailed link that expires in 15 minutes. Force 2FA enrollment for specific roles (admin, editor) before they can use wp-admin. Remember trusted devices so the second factor isn't asked on every login from the same laptop.
- ● Magic-link rescue (free) is a separate, ops-only flow — not the daily-login experience.
- ● Trusted devices: 30-day cookie, revocable from your profile screen. Per-device labels.
91.218.114.4 · RussiaGet alerted where your team actually pays attention.
Route security events to Slack, Discord, Microsoft Teams, PagerDuty (Events API v2), Twilio SMS, or a generic HMAC-signed webhook. Set severity thresholds per channel so low-priority noise doesn't reach pager, but the 3am brute-force does. Each alert has inline action buttons — block, report abuse, or view detail without leaving the channel.
- ● Webhook signatures use HMAC-SHA256 so you can verify origin.
- ● Per-channel rate limiting prevents alert storms on noisy incidents.
Compare what's in each version.
| Feature | Free | Pro |
|---|---|---|
| Login rate-limiting + lockouts | ✓ | ✓ |
| Honeypot + math captcha on login form | ✓ | ✓ |
| Strong password policy (Pwned Passwords) | ✓ | ✓ |
| Login URL rename | ✓ | ✓ |
| TOTP two-factor authentication | ✓ | ✓ |
| File integrity monitoring (chunked scan) | ✓ | ✓ |
| Endpoint WAF (28+ bundled OWASP-style rules) | ✓ | ✓ |
| Audit log + health dashboard | ✓ | ✓ |
| 10 documented lockout-rescue paths | ✓ | ✓ |
| Custom WAF rules (Cloudflare-style editor) | 1 rule | Unlimited |
| WAF rule templates | 3 | 30+ |
| Test rules against last 10 attacks | ✓ | ✓ |
| Scheduled lockdown (recurring time windows) | 1 daily | Per-day + holidays |
| Plugins & themes risk scoring | ✓ | ✓ |
| Live attack map | Country | City + live |
| One-click hosting-abuse reports (WHOIS-based) | ✓ | ✓ |
| Deep IP investigation (WHOIS / DNSBL / Tor) | ✓ | ✓ |
| AbuseIPDB integration | BYO key | Built-in |
| Cloud-pushed WAF rules (daily updates) | - | ✓ |
| CVE detection for installed plugins / themes | - | ✓ |
| IP reputation feed | - | ✓ |
| Country & ASN blocking (with GeoIP) | - | ✓ |
| Cloud malware signature scanner | - | ✓ |
| Magic-link passwordless login | - | ✓ |
| Per-role MFA enforcement | - | ✓ |
| Trusted devices | - | ✓ |
| Emergency lockdown + maintenance page | - | ✓ |
| Tamper-evident audit log (hash-chained) | - | ✓ |
| SIEM streaming + forensic export bundle | - | ✓ |
| Slack / Discord / Teams / PagerDuty / SMS | - | ✓ |
| White-label branding | - | ✓ |
| Email support | - | ✓ |
One-time payment. No subscriptions.
Pick the license that fits. Every tier includes all Pro features and email support.
3 Sites
Personal projects & small businesses
10 Sites
Freelancers & growing agencies
Unlimited Sites
Large agencies & unlimited scale
Frequently asked questions.
What if MossHill Security locks me out of my own site?
Will MossHill Security slow down my site?
Does MossHill Security play nicely with Wordfence, Sucuri, Solid Security, etc.?
What's actually in the free version vs Pro?
Do you bundle malware signatures in the free plugin?
What's the difference between the free and Pro attack map?
How does the rule tester not break my site if I make a mistake?
Is this a subscription?
Do you offer refunds?
Looking for documentation?
Get started quickly with our comprehensive guides and tutorials.
View Documentation