Pricing
WordPress security plugin pricing that never creeps up.
Start free on every site. Add Pro where you want automation and deeper controls. Go Agency when you look after client sites. One yearly price, the same at every renewal.
- 14-day money-back guarantee on your first purchase
- Same price at every renewal
- Cancel any time
Free forever
$0
Unlimited sites. No key, no sign-up.
- Custom login URL and two-factor
- Brute force lockouts
- Firewall bans and allow list
- Hardening and core headers
- Malware and core file scans
- Verified backups and one-click restore
Pro
For the sites that matter most
Everything in Free, plus automation, deeper controls and alerts. Ideal for a business site or a small portfolio.
Pro
Most popular1 site
$95/ year
Automation, alerts and deep controls for the site that matters most.
Contact SalesPro adds
- CAPTCHA and session controls
- Two-factor by role
- Scheduled scans and outdated plugin checks
- Quarantine and core file restore
- File change monitoring
- Firewall rules and country blocking
- 404 probe auto-bans
- CSP builder and HSTS
- User security console
- Full alerts and digests
- 90-day activity log and export
- Automatic security key rotation
Agency
Every client site, one licence
Everything in Pro on every site, plus white label emails. The more sites, the less each one costs. See why agencies choose Stack Guard.
Agency 25
Best value25 sites
$245/ year
$9.80 per site
Pro on 25 client sites, plus white label.
Contact SalesAgency 50
50 sites
$395/ year
$7.90 per site
For growing agencies with up to 50 client sites.
Contact SalesAgency Unlimited
Unlimited sites, fair use
$795/ year
Fair use
Every client site you manage, fair use.
Contact SalesAgency Unlimited is for sites you build or look after for your own clients. Hosting companies and resellers, please talk to us.
After you buy
Secure checkout by Stripe. We never see your card details.
- 1Your key arrives by emailUsually within minutes of checkout.
- 2Paste it into Stack GuardOn the License tab of the plugin you already run.
- 3Pro switches onNo reinstall. Your Free settings carry straight over.
One price, always
Renewals cost the same as the first year. No launch discount that disappears, no renewal hike.
Per-site price falls at every step
Each bigger plan costs less per site, so growing never punishes you.
Free stays free
Free sites get updates without a key or sign-up, and core protection is never time limited.
No lock-out on downgrade
If a licence lapses, Pro features switch off cleanly, your settings are kept, and sign-in protection keeps working.
Compare plans
What every Stack Guard plan includes
Every feature, side by side. Agency includes everything in Pro.
| Feature | Free | Pro | Agency |
|---|---|---|---|
| Login Protection | |||
| Custom sign-in address that hides wp-login.php | |||
| Choose what blocked visitors see: a 404, your home page, a page you pick or a redirect | |||
| Access token and a hidden honeypot field that trips bots | |||
| One generic error for wrong usernames and wrong passwords | |||
| CAPTCHA on sign-in, registration, password reset and comments (Cloudflare Turnstile, reCAPTCHA v2 or v3) | |||
| Idle sign-out and your own Remember Me length | |||
| Magic-link unban so a locked-out person can free themselves by email | |||
| Two-Factor Authentication | |||
| Authenticator app (TOTP) and email code methods | |||
| Backup codes and admin reset | |||
| Require two-factor for administrators | |||
| Secrets encrypted with AES-256-GCM | |||
| Email magic link sign-in method | |||
| Require two-factor by role or for named users | |||
| Brute Force Protection | |||
| Per-IP lockouts with sensible defaults | |||
| Lockout email to one address | |||
| Choose how long attempt records are kept | |||
| Per-username lockouts | |||
| Flexible windows and lockout lengths, including for administrators | |||
| Your own lockout message | |||
| Failed sign-in alert threshold | |||
| Firewall | |||
| Manual IP and range bans | |||
| IP allow list | |||
| Trusted proxy and Cloudflare support for the real visitor address | |||
| Custom firewall rules with hit counts | |||
| Country blocking as a block list or allow list, with a country lookup tool | |||
| User agent bans | |||
| Automatic bans for visitors probing for weak spots (404 detection) | |||
| Hardening | |||
| Disable XML-RPC, pingbacks and trackbacks | |||
| Disable the theme and plugin code editors | |||
| Block user enumeration and hide the WordPress version | |||
| Disable comments site wide | |||
| Security key (salt) rotation by hand, with reminders | |||
| Disable application passwords | |||
| Automatic scheduled security key rotation | |||
| Delete all comments in one step | |||
| Passwords | |||
| Minimum length, character rules and passphrase length | |||
| Breached-password check that never sends the password | |||
| Password expiry | |||
| Block passwords built from the person's own name or email | |||
| Expiry exemptions by role and a reminder before expiry | |||
| Forced password reset for all users or chosen users, with email | |||
| Security Headers | |||
| X-Frame-Options, Referrer-Policy, Permissions-Policy and cross-domain policy | |||
| Content Security Policy builder with presets, nonce, report-only mode and a violation log | |||
| HSTS with max age, subdomains and preload | |||
| Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy | |||
| Malware Scanning | |||
| Manual scans with a full report | |||
| Malware signatures and core file integrity check | |||
| Ignore or review each finding | |||
| Scheduled scans | |||
| A check that flags plugins and themes several versions behind | |||
| Quarantine and restore, and core file restore from WordPress.org | |||
| File Change Monitoring | |||
| Baseline of every file's fingerprint | |||
| Scheduled scans with email alerts | |||
| Folders you choose to skip | |||
| Activity Log | |||
| Core events, kept for 7 days | |||
| View in the admin | |||
| Kept for 90 days, with the full event catalogue | |||
| Plugin and theme change logging | |||
| Search, time range and event type filters, and CSV export | |||
| Alerts and Digests | |||
| Lockout alerts | |||
| The full alert catalogue | |||
| Hourly batches, daily and weekly digests | |||
| Quiet hours, rate limits and templates | |||
| Your name, logo and footer on every email | |||
| Backups and Restore | |||
| Manual full or database-only backups | |||
| Verified before they count: every entry, every SQL statement and row count, checksums per part | |||
| One-click restore, staged and checked before anything live changes | |||
| Keep or Roll Back for 7 days after a restore | |||
| Restore from uploaded backup files | |||
| A test restore of the database after every backup | |||
| Google Drive backups and restore from Drive (Pro) | |||
| Schedules, retention and backup alerts (Pro) | |||
| Monthly automatic test restores (Pro) | |||
| Use your own Google credentials (Agency) | |||
| Dashboard and Security Score | |||
| Security score from 14 checks | |||
| Admin bar indicator and dashboard widget | |||
| Plain-language docs for every feature, inside the plugin | |||
| Settings export and import, reset to defaults | |||
| Quick actions from the dashboard | |||
| Pro checks counted in the score | |||
| User Security Console | |||
| Choose which roles and users can open Stack Guard | |||
| Profiles for every user with sessions you can end one at a time or all at once | |||
| Per-user require two-factor | |||
| Dormant administrator flags after 90 days without a sign-in | |||
| Compatibility Check | |||
| Checks for proxies and CDNs, caching, other security plugins, page builders, server type, email delivery and scheduled tasks | |||
| Versions overview for WordPress, plugins, themes and PHP support dates | |||
| System information | |||
| Reads your Cloudflare settings with a read-only token: SSL mode, HSTS, cache rules and firewall rules | |||
| White Label | |||
| Admin canvas pattern and colors | |||
| Optional "protected by Stack Guard" badge for your site | |||
| Badge with your own wording and no link | |||
| Plugin name, company, website and logo on every email | |||
| Branded sign-in page (Agency) | |||
| Client-ready security reports (Agency) | |||
Questions
WordPress security plugin pricing questions
How much does a WordPress security plugin cost?
Premium WordPress security plugins usually cost about $100 to $150 a year for one site. Stack Guard Pro is $95 a year for one site and $145 for five, and Agency plans bring the price down to $5.95 per site a year at 100 sites. Stack Guard Free costs nothing and has no time limit.
Does the price go up when I renew?
No. Renewals cost exactly what the first year cost. There is no introductory discount that disappears and no renewal increase.
Is it billed monthly or yearly?
Paid plans are billed once a year, in US dollars, through Stripe. Your licence renews automatically each year until you cancel.
Can I move my licence to a different site?
Yes. A licence covers a number of sites at a time, not specific sites forever. Deactivate it on one site and activate it on another, from your account or by asking us.
What counts as a site?
One site is one domain. On WordPress Multisite, each subsite counts as a site.
Do you offer refunds?
Yes. Your first purchase of Pro or Agency comes with a 14-day money-back guarantee: email us within 14 days and we refund it in full. Renewals are not refunded, but you can cancel any time and keep your plan until the end of the year you paid for.
What happens if I stop paying?
Pro and Agency features switch off cleanly and your settings are kept. Login protection, two-factor authentication and everything in Free keep working, so a lapsed licence never locks anyone out.
Can I upgrade from Pro to an Agency plan later?
Yes. Email us and we will move you to the plan you need.
Try it free on your own site first.
Install Stack Guard Free today. Upgrade from inside the plugin whenever you are ready.