Scanning and integrity
Watches installed software and the files on disk for known threats and unexpected change.
- Vulnerability scanning against two databases
- File-integrity baseline
- Malware scanning with quarantine
- Core and plugin checksum checks
Active defence for every WordPress site.
Scanning, firewall, login defence, hardening and a tamper-evident audit log, together in one plugin. Free on WordPress.org, with paid tiers for sites that need more.
09:41:12Login blockedRepeated failures from one address
09:41:12Address blockedAdded to the firewall for 24 hours
09:57:03Scan completeNo unexpected file changes
10:02:47Setting changedTwo-factor enforced for admins
10:02:47Operator approvedPIN and second factor confirmed
Every layer of WordPress security, in one plugin
Sensible defaults out of the box, and a hardened mode you can switch on in one click.
Firewall
Stops bad traffic before it reaches WordPress, with a managed rule set on Business and above.
- IP allow and block lists
- Country and region rules
- Threat-intelligence feeds
- Bot verification
Login and identity
Layered controls so credential stuffing, brute force and replay do not get through.
- Two-factor sign-in, including security keys
- Lockouts and login URL masking
- Breached-password checks
- Live session viewer with revoke
Hardening
A live checklist of WordPress hardening practice, with one-click fixes from Solo upwards.
- More than 20 recommendations
- Security headers
- Configuration file watcher
- Upload folder protection
Backup and recovery
A known-good restore point and the paper trail to prove what happened.
- Encrypted database backups
- Offsite destinations
- Personal data export
- Compliance report packs
Monitoring and audit
Every admin action and defensive event is written to a tamper-evident log.
- Tamper-evident audit log
- Anomaly detection
- Uptime monitoring
- Forensic incident reports
A stolen admin password is not enough to cover the tracks
The operator gate sits above the WordPress admin. Switching Defender off, deleting scan results or touching the audit log takes the operator PIN and a dedicated second factor, so a stolen admin password is not enough.
- Operator PIN and dedicated two-factor
- Throttling on sensitive operator actions
- Every operator action written to the audit log
- Turn Defender off
- Operator PIN and second factor
- Delete scan results
- Operator PIN and second factor
- Change the audit log
- Not possible, entries are chained
Plans and pricing
Already have Ghostables for WordPress? Your licence includes Defender. These prices are for Defender on its own.
Free
£0for ever
From WordPress.org. One site, community support.
- Vulnerability and malware scanning
- File-integrity baseline
- Two-factor sign-in
- Tamper-evident audit log, kept 30 days
Solo
£59per year
Or £6 a month. One site, email support.
- Everything in Free
- Protected by Ghostables trust mark
- Firewall rules and login defence
- Encrypted backups and uptime monitoring
Business
£179per year
Or £19 a month. Five sites, priority support.
- Everything in Solo
- Managed firewall rule set
- Two-factor enforced for admins
- Offsite backups and incident reports
Enterprise
£549per year
Or £59 a month. Unlimited sites, SLA support.
- Everything in Business
- Signed-plugin allowlist
- One-click site lockdown
- Public ledger audit anchoring, rolling out
Paid tiers include automatic updates and a full refund within 14 days of your first purchase. Prices exclude VAT, which is calculated at checkout.
Compare tiers
| Feature | Free | Solo | Business | Enterprise |
|---|---|---|---|---|
| Threat detection | ||||
| Vulnerability scanning, first database | Included | Included | Included | Included |
| Vulnerability scanning, second database | Not included | Included | Included | Included |
| File-integrity baseline | Included | Included | Included | Included |
| Pattern malware scanner | Included | Included | Included | Included |
| Signature malware engine and quarantine | Not included | Included | Included | Included |
| Custom detection rules | Not included | Not included | Not included | Included |
| Perimeter | ||||
| IP allow and block lists | Not included | Included | Included | Included |
| Country and region blocking | Not included | Included | Included | Included |
| Threat-intelligence sync | Not included | Not included | Included | Included |
| Managed firewall rule set | Not included | Not included | Included | Included |
| Cross-site threat network | Not included | Not included | Not included | Included |
| Account security | ||||
| Two-factor sign-in | Included | Included | Included | Included |
| Login lockouts and URL masking | Not included | Included | Included | Included |
| Two-factor enforced for admins | Not included | Not included | Included | Included |
| Breached-password check | Not included | Included | Included | Included |
| Hardening and recovery | ||||
| Hardening recommendations | Included | Included | Included | Included |
| One-click fixes | Not included | Included | Included | Included |
| Encrypted database backups | Not included | Included | Included | Included |
| Offsite backup destinations | Not included | Not included | Included | Included |
| Personal data export | Included | Included | Included | Included |
| Monitoring and audit | ||||
| Tamper-evident audit log | Included | Included | Included | Included |
| Anomaly detection | Included | Included | Included | Included |
| Uptime monitoring | Not included | Included | Included | Included |
| Weekly digest and incident reports | Not included | Not included | Included | Included |
| Public ledger audit anchoring (rolling out) | Not included | Not included | Not included | Included |
| Operator controls | ||||
| Operator PIN and dedicated two-factor | Included | Included | Included | Included |
| Protected by Ghostables trust mark | Not included | Included | Included | Included |
| White-label trust mark | Not included | Not included | Included | Included |
| Signed-plugin allowlist and lockdown | Not included | Not included | Not included | Included |
| Coverage | ||||
| Sites | 1 | 1 | 5 | Unlimited |
| Support | Community | Priority email | SLA | |
Questions
Do I need Defender if I already have Ghostables for WordPress?
You already have it. Install Defender on the same site and it picks up your Ghostables for WordPress licence and runs at the matching tier. The standalone prices on this page are for sites that only want the security plugin.
Is the free tier genuinely useful?
Yes. It includes vulnerability scanning, file-integrity baselines, malware scanning, the hardening checklist, two-factor sign-in and the audit log. The trust mark is reserved for paid tiers, because a mark anyone can claim for free would mean nothing.
Will Defender break my site?
Defender has a lite mode that runs scanning only, so you can switch modules on one at a time on a fragile site. The hardening checklist tells you what each fix changes before you apply it, every action can be reversed, and you can pause Defender with one click.
What is the operator gate?
An extra layer above the WordPress admin. Even if an admin account is compromised, the attacker cannot switch Defender off, delete scan results or alter the audit log without the operator PIN and a separate second factor.
What happens if my subscription lapses?
Defender steps down to the free tier rather than going offline. Your audit history and scan baselines stay intact.
Can I get a refund?
Yes. We refund a first purchase in full within 14 days, no questions asked. Renewals are not normally refundable, so cancel from your dashboard before your renewal date.
Start free. Upgrade when you need more
If you already own Ghostables for WordPress, install Defender and it activates against your existing licence.