Kadence Security Pro: WordPress Login and Vulnerability Controls

Kadence Security Pro brings login controls, vulnerability monitoring, and activity entries into a real-time WordPress security dashboard. Review brute force attacks, banned visitors, active lockouts, scan results, and user security statistics there. These utilities address common attack methods, but cannot prevent every possible attack.

Choose options for the website and its users

During setup, select a template for an ecommerce, network, non-profit, blog, portfolio, or brochure site. User groups let you set different requirements for clients, clients, administrators, and other users. For example, you can require two-factor authentication for clients or apply password rules to customer accounts.

Manage logins and account access

Two-factor authentication can require a security code alongside a password. Users can get codes through apps such as Authy or Google Authenticator, email, or backup codes. Password requirements let you make and enforce an account password policy.

• reCAPTCHA: Helps deter bots that try compromised passwords, post spam, or scrape content.
• Passwordless logins: Let users sign in with a click while retaining two-factor authentication and strong password controls.
• Trusted Devices: Identify approved devices, help limit session hijacking, and restrict Administrator privileges to trusted devices.
• Magic Links: Let users log in while their username is locked by Local Brute Force Protection.
• Privilege Escalation: Grant temporary administrator-level access.

Find and manage vulnerabilities

The Site Scanner checks WordPress core, extensions, and themes for known vulnerabilities. Pro scans hourly. Patchstack integration can apply virtual patches for some vulnerabilities before a developer or vendor issues a patch. Version Management can automatically apply an available patch for vulnerable software detected by a scan.

Version Management can also automatically update WordPress, plugins, and themes when configured. It includes settings for hardening a site running outdated software and scanning for old sites. The Patchstack Priority score estimates risk by considering the likelihood of exploitation and the potential impact on the site.

Review activity and use security tools

User Logging records WordPress activity such as logins and logouts, registrations, extension and theme changes, and edits to posts and pages. File Change Detection logs changes to site documents. Local and Network Brute Force Protection, lockouts, and banned-user controls help address repeated login attempts.

• Enforce SSL: Forces website connections to use SSL/TLS.
• Database Backups: Create and email WordPress database backups on a schedule. These do not include the complete site.
• Geolocation: Connect Trusted Devices to an external location or mapping API.

For an existing site, make a complete backup before applying extension capabilities that change the database or site files. The plugin is tested and guaranteed to work only with the latest stable WordPress version. It requires an Apache or LiteSpeed server with mod_rewrite, or an NGINX server.