Kadence Security – Password, Two Factor Authentication, and Brute Force Protection

85 Quality Score

Active Installs

26/30

With roughly 700,000 active installs, the plugin sits in the upper tier of WordPress security tools, though it trails Wordfence (5,000,000) and Really Simple Security (3,000,000).

Update Freshness

25/25

An update timestamped 2026-05-28 and tested against WordPress 7.0 indicates active, current development with no signs of abandonment.

User Rating

14/15

A 92/100 rating across 3,987 reviews is a strong signal of user satisfaction and consistency over time.

Support Health

5/15

Only 9 of 24 support threads (37.5%) are resolved, which is the weakest area of the profile and worth noting if you rely on forum help for troubleshooting.

WP Compatibility

15/15

Tested up to WordPress 7.0, requiring WordPress 6.5 and PHP 7.4, the plugin is compatible with current and recent core versions.

Scores higher than 96% of indexed plugins

About

Harden your site security with Login Security, Two-Factor Authentication (2FA), Vulnerability Scanner, Firewall, and more. Formerly iThemes Security.

Active Installs 700k+

Rating ★★★★½ 4.6/5

Last Updated 2026-09-16 5:55pm GMT

Requires WordPress 6.5+

Tested Up To 7.1.1

Requires PHP 7.4+

Security History

19 known vulnerabilities, all patched

7 High 11 Medium 1 Low

Most recent: June 20, 2024

View details ▸

Solid Security <= 9.3.1 - IP Address Spoofing to Denial of Service Medium

June 20, 2024 Patched in ["9.3.2"] CVE-2022-44593

Solid Security Basic <= 9.0.0 - Unauthenticated Login Page Disclosure Medium

October 31, 2023 Patched in ["9.0.1"]

iThemes Security <= 8.1.4 - Open Redirection via redirect_to_https Medium

March 27, 2023 Patched in ["8.1.5"] CVE-2023-28786

iThemes Security < 7.9.1 and iThemes Security Pro < 6.8.4 - Hidden Login Bypass Medium

April 22, 2021 Patched in ["7.9.1"]

iThemes Security <= 7.6.1 - Broken Password Mechanism High

January 6, 2021 Patched in ["7.7.0"] CVE-2020-36176

iThemes Security <= 7.0.2 - Authenticated SQL Injection High

June 25, 2018 Patched in ["7.0.3"] CVE-2018-12636

iThemes Security <= 6.9.0 - Cross-Site Scripting High

March 5, 2018 Patched in ["6.9.1"] CVE-2018-7433

iThemes Security <= 5.6.1 - Stored Cross-Site Scripting Medium

October 6, 2016 Patched in ["5.6.2"]

iThemes Security <= 5.6.1 - Sensitive Information Exposure via Diff Response Medium

September 27, 2016 Patched in ["5.6.2"]

iThemes Security <= 5.3.5 - Missing Capabilities Check High

April 25, 2016 Patched in ["5.3.6"]

iThemes Security < 5.3.1 - Insecure Backup/Logfile Generation Medium

April 21, 2016 Patched in ["5.3.1"]

iThemes Security < 5.3.5 - Authenticated Cross-Site Scripting Low

April 5, 2016 Patched in ["5.3.5"]

iThemes Security <= 4.6.12 - Stored Cross-Site Scripting Medium

April 14, 2015 Patched in ["4.6.13"]

Better WP Security <= 3.5.3 - Stored Cross-Site Scripting High

August 1, 2014 Patched in ["3.5.4"]

iThemes Security < 3.6.4 - Stored Cross-Site Scripting High

August 1, 2014 Patched in ["3.6.4"]

Better WP Security <= 3.6.3 - Stored Cross-Site Scripting Medium

August 1, 2014 Patched in ["3.6.4"]

iThemes Security < 3.4.4 - Cross-Site Scripting Medium

August 20, 2012 Patched in ["3.4.4"]

iThemes Security < 3.2.5 - Cross-Site Scripting High

May 11, 2012 Patched in ["3.2.5"] CVE-2012-4263

Better WP Security <= 3.2.4 - Multiple Cross-Site Scripting Medium

May 11, 2012 Patched in ["3.2.5"] CVE-2012-4264

What It Does

Kadence Security bundles brute-force login protection, two-factor authentication, a vulnerability scanner, and a firewall into a single dashboard for hardening a WordPress site. It applies configurable rules to block suspicious traffic, force strong passwords, and add 2FA to user logins. The plugin is the successor to the long-running iThemes Security plugin and retains its reputation as a general-purpose security suite.

Who It's For

This plugin is a strong fit for small business owners, e-commerce sites, and membership platforms that need layered login security without paying for an enterprise tool. It also suits multi-author blogs, non-profits with donor data, and professional service sites that handle sensitive client information and want 2FA enforced across staff accounts.

Who Should Skip It

If you are already running a managed WordPress host that includes firewall, malware scanning, and login protection at the server level, this plugin will mostly duplicate work. Hobby bloggers with no user accounts and no commerce features will find most modules unnecessary.

The Bottom Line

Kadence Security delivers a well-maintained, broadly trusted security suite with strong ratings and current compatibility, making it a sensible default for sites that need 2FA, brute-force protection, and vulnerability scanning in one package. The one real concern is the low support resolution rate, so buyers who depend on fast help tickets may want to factor that in. Overall quality score of 85.6/100 places it just behind Wordfence and Really Simple Security as a top-tier option.

Pick Wordfence if you want a full malware scanner with a deep signature database and a tightly integrated endpoint firewall, which Kadence Security does not focus on.

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) 99/100

Pick Really Simple Security if your priority is fast, lightweight hardening (especially SSL and headers) rather than the wider feature suite Kadence offers.

Jetpack – WP Security, Backup, Speed, & Growth 93/100

Pick Jetpack if you want security bundled with backups, performance, and growth tools under one Automattic-supported subscription.

All-In-One Security (AIOS) – Security and Firewall 91/100

Pick AIOS if you want a comparable feature set without a paid tier and prefer a free, open security toolkit.