Kadence Security
by Kadence WP
Login hardening, two-factor auth, and brute-force protection — the plugin formerly known as iThemes Security, then Solid Security.
- Last release
- May 28, 2026 v10.0.2
- WP.org rating
- 4.6
One of the longest-running WordPress security plugins, and the most renamed: it launched as Better WP Security, became iThemes Security, was rebranded Solid Security in 2023, and in May 2026 Liquid Web folded it into the Kadence brand as Kadence Security. Its strength has always been access control rather than firewalling — two-factor authentication, brute-force and login protection, password policies, user-security checks, and site-hardening toggles. The free tier covers that access-security baseline well. The catch is the paid tier: Pro features (scheduled malware scanning, trusted devices, advanced 2FA) now come only through the Kadence Pro bundle, which also includes the Kadence theme and blocks — so you pay for an ecosystem, not a standalone security license. Owned by Liquid Web / StellarWP.
Pros
- Best-in-class login and access security in the free tier — 2FA, brute-force protection, password policies
- Very long track record and a large, well-established install base
- Simpler and lighter than full firewall suites if access control is your main concern
- Actively maintained under the Kadence/Liquid Web umbrella
Cons
- Focused on access control, not a full WAF or malware-blocking firewall
- Pro is now bundle-only via Kadence Pro (with the theme and blocks) — pricier and less focused than the former standalone Solid Security Pro
- Three renames in five years (iThemes → Solid → Kadence) has caused real brand confusion
- If you do not use the Kadence theme, the Pro bundle is largely shelfware for a security buyer
Pick Kadence Security (free) when your priority is locking down logins and access — 2FA, brute-force protection, and password policy — on a self-managed site, and you are happy to pair it with a separate firewall or CDN. It is the cleanest free access-security layer of the majors.
Avoid the Pro bundle unless you already want the Kadence theme and blocks — as a pure security purchase it is poor value. And if you need an actual firewall or malware blocking, choose Wordfence, AIOS, or Sucuri instead, since access control is only one layer.
Frequently asked questions
- Is Kadence Security the same as iThemes Security or Solid Security?
- Yes — it is the same plugin, renamed. It began as Better WP Security, became iThemes Security, was rebranded Solid Security in 2023, and in May 2026 Liquid Web moved it under the Kadence brand as Kadence Security. Existing installs updated in place; the WordPress.org slug (better-wp-security) is unchanged.
- Is Kadence Security free?
- The core plugin is free and covers the access-security essentials: two-factor authentication, brute-force protection, login and password hardening, and user-security checks. Pro features such as scheduled malware scanning and trusted devices are now delivered through the paid Kadence Pro bundle rather than a standalone security license.
- Does Kadence Security include a firewall?
- Its focus is access control — logins, 2FA, brute-force, and hardening — rather than a full web application firewall. For WAF-style traffic filtering and malware blocking you would pair it with, or choose instead, a firewall-first plugin like Wordfence or All-In-One Security, or an edge WAF like Sucuri or Cloudflare.
- Is the Kadence Pro bundle worth it just for security?
- Usually not on its own. The bundle wraps the security Pro features together with the Kadence theme and Kadence Blocks Pro, so it is good value only if you also use that theme ecosystem. If you just want security Pro features, a firewall-first plugin with its own paid tier is a more focused spend.
| Product | Category | Price | Lighthouse |
|---|---|---|---|
 Kadence Security this | Security | Free, Pro from $299 | — |
| | Security | Free, Pro from $149 | 88 |
| | Security | Free, Pro from $70 | — |
-
Sucuri Security
Free auditing, malware scanning, and hardening — paired with a paid cloud WAF that filters traffic before it reaches WordPress.
-
Akismet
Comment spam protection. Free for personal use, paid for commercial. Default-installed on most WordPress sites.
-
AI Engine
Most-featured AI plugin for WordPress. Chatbots, content generation, image generation, MCP server endpoints, multi-provider.
-
All-in-One WP Migration
One-click full-site export and import in the browser. The simplest way to move a WordPress site — installed on 5M+.
Performance testing
Lighthouse scoring methodology lands soon. Until then, treat the score as provisional.
Vulnerability tracking
Open and recently closed CVE counts pulled from Patchstack and Wordfence Intelligence on every build. Last disclosure date reflects the most recent public CVE for this plugin, not necessarily the most recent vendor patch.