A comprehensive guide to explain the Sucuri add-on

The Sucuri plugin comes as one of the most important plugins for WordPress, to protect the site from malware, hackers, and various attacks, as it creates multiple layers to protect your site from security threats, as well as protecting it from hackers and malware.

Sucuri also offers a cloudproxy firewall, through which all visits to your site pass before reaching the server, thus blocking all attacks or any hacking attempt before they reach your site and preventing all fake visits, and thus these factors combine to increase the security and protection of your site from all risks.

In this comprehensive guide, learn about the Sucuri plugin, how to install it on your site, how it works, and what are its features?

Why choose Sucuri, and how effective it is in protecting your site?

First, let us get to know the company that developed the add-on, which is Sucuri, a company famous for providing security and protection services for websites and large and small companies around the world.

The company offers many special products and programs, including website anti-virus programs and firewalls, and services that help you:

Remove malware and malicious files
Access the hacked website if it is locked
Protection from hacking and hacking attacks

Sucuri also offers a unique product for WordPress website owners, which is the Sucuri plugin , which helps you prevent your site from being hacked, and provides tools to constantly monitor and scan your site and close any security vulnerabilities.

The extension offers many features, such as:

Activity log, where all security-related activities on your site are recorded, for example (logins or failed login attempts)
Options to specify how notifications will be delivered
Actions that must be taken if the site is hacked
Tips and alerts to increase the security of your site, and identify weak points on the site
Blacklist monitoring, to make sure your site is not blocked due to security issues
Scan your site for malware
Automatically detect any changes to your site’s files

How to install the Sucuri add-on

To install the Sucuri plugin on your WordPress site, you must go from within your site’s WordPress control panel to Plugins << Add New, then type the name of the plugin in the search box and click install now.

After downloading the add-on, you need to activate it, and it is ready for use

Sucuri settings and features

After installing and activating the Sucuri add-on, we will have 4 options to control Sucuri features and settings within the add-on control panel as follows:

Dashboard
Firewall
Last Logins
Setting

1- Control Panel – Dashboard

After installing the add-on, a malware scan will run on your site automatically, and the main control panel will also display many information and alerts related to the protection and security of your site, including:

1.1- WordPress Integrity

Sucuri examines the WordPress installation process for your site and searches the core WordPress files, comparing your files with the files in the latest version, and then displays a list of different files that indicate any changes or a hack.

You will be alerted if core WordPress files are modified, as this indicates a hack or problem with one of the files.

1.2- Site survey

The site is scanned for any malicious programs or codes, spam, or any other inappropriate matters. If you want a more accurate, deeper, and more comprehensive survey, you can subscribe and register for the paid version of Sucuri .

1.3- BlackList

The site is scanned to ensure that a trusted site has not been blocked and blacklisted by mistake

1.4- Warnings and tips to protect the site

Sucuri sends you alerts and recommendations for more protection and security for your site, based on what it finds on your site. For example, removing unused add-ons or extensions or disabling file editing “DISALLOW_FILE_EDIT”, as this helps prevent an attacker from changing your files.

You can activate and generate an API, so that you can connect to the server, so if an attacker somehow compromises your site and removes site monitoring logs etc, it can be recovered from the server.

2- Firewall

Sucuri provides you with a firewall, which protects and monitors your site from attacks or malware as well as blocks SQL injection attempts, various attacks, and many other threats against your site.

The firewall repels hacking attacks through some security processes as follows:

Preventing hacking operations, by knowing and discovering hacking methods and methods and stopping them
Work to correct loopholes or weaknesses found in templates or add-ons
Block brute force attack , where the firewall blocks anyone from accessing the wp-admin page or login page
DDoS Attack Mitigation Detects and blocks all types of DDoS attacks
Improve performance, as it provides temporary storage to increase page speed

2.1- Firewall settings

You must subscribe and register with Sucuri , in order to obtain an API key, in order to connect to the firewall service and activate it.

2.2- Firewall audit logs

The firewall records every request that is part of the attack on the site and separates them from real requests. From here you can analyze data and records and take appropriate actions. For example, you can block IP addresses, URL paths, etc.

2.3- IP Address Access

From here, you can select or add IP addresses to the blacklist, thus preventing them from accessing your site

2.4- Clear cache

Sucuri Firewall offers many multiple options to configure the cache, you can either enable full cache (which is the default setting), or you can set the cache level to minimum or you can simply disable it etc.

The firewall also has special caching rules for images, CSS, PDF, TXT, JavaScript, and media files. So you need to clear the cache of these files by clearing your site’s firewall cache.

3- Login processes – Last Logins

The extension here shows you a set of options, where you can find out:

All successful user logins
All successful logins are for those with an account with admin responsibilities
All users who are currently logged in
Login failures are controlled to protect the site.

4- Settings – Settings

There are many settings that you can control in the Settings tab to enhance the security of your site, whether general settings, scanner settings, alerts, or other settings.

4.1- General Setting

In the first tab for general settings, you will find some of the necessary settings for the add-on as follows:

API Key : You can obtain an API key from Sucuri in order to store and collect your location data with the company, and thus you can prevent attackers from deleting audit records that can help you investigate and recover after a hack.

Data Storage, the place where security logs, data, etc. are stored.

Log Exporter , This option allows you to export WordPress audit logs to a local log file that can be read by a SIEM or any log analysis software.

A reverse proxy is a type of proxy server that usually resides behind a firewall and routes client requests to the appropriate back-end server.

IP Address Discoverer: This IP address finder uses DNS lookups to discover if a website is behind a Sucuri firewall.

Timezone Override , this option specifies the time zone that will be used to print dates, times, etc.

Import & Export Settings, enables you to copy, use and retrieve JSON-encrypted data in another location.

Reset Security Logs, Hardening and Settings: If you want to go back to square one and delete all security logs and settings.

4.2- Scanner

The scanner scans your site for malware, malware, site errors, and security issues. There are many options including:

Scheduled Task : The add-on scans your site on a scheduled and continuous basis in search of changes, malware, etc. Scheduled tasks are rules registered in the database; They are used to automatically perform actions at a specific time.
You should be aware that changing it will affect the resource consumption of the server and thus affect the performance of your site. You must have some experience when working on it.

WordPress Integrity Diff Utility: Where you can compare the actual content of the files installed on your site and the original files provided by WordPress, to see if any changes have occurred in your files from hacking, problems, or other things.

Ignore Files and Folders: You can select which files or folders you want to be ignored or not erased.

4.3- Hardening

The Sucuri add-on offers many options and preventive measures to enhance the security of your site, including:

Verify WordPress Version , where you can check the version of WordPress for your site, and not update it and tamper with it
Verify PHP version , check the PHP version.
Block PHP Files in Uploads Directory , block PHP files.
Disable Plugin and Theme Editor , block access to templates and plugins to prevent access by users or hackers.
Whitelist Blocked PHP , add blocked PHP files to the whitelist.

4.4- Post-Hack

If your site is hacked, the Sucuri add-on provides you with a set of options and immediate actions to stop the damage and protect your site, including:

Update Secret Keys, enables you to regenerate new secret keys.
Reset User Password , enables you to reset user passwords.
Reset Installed Plugins , enables you to reset installed plugins.
Plugin and Theme Updates , enables you to update installed plugins and themes.

4.5- Alerts – Alert

The plugin automatically sends email alerts to the primary administrator account (i.e. the same account created during WordPress installation), where you will automatically receive all daily scan reports in your inbox.

There are a large number of options provided by the add-on, including:

Alerts Recipients, where you can choose and add the account you want.
Trusted IP Addresses: You can specify IP addresses so that the extension stops sending security alerts about them.
Alert Subject, email alert format.
Alerts Per Hour, i.e. setting the maximum number of email alerts per hour.
Password Guessing Brute Force Attack, which limits the number of failed login attempts per hour.
Security Alerts, you have a list from which you can choose what you consider to be a security threat.

questions and answers

How much does Sucuri cost?

The plugin provides a completely free version that you can activate and download through the WordPress store , and there are paid plans that you can get with higher options as follows:

The Basic plan comes at $199.99, for one site with the most basic security and protection options.
The Professional plan comes at $299.99, for one site with the most basic security and protection options as well as SSL support
. The Business plan comes at $499.99, for one site and has a faster response time and more scans.

Through the official website of the add-on, you can view all of the add-on plans

Which is better: Sucuri or Wordfence?

Wordfence and Sucuri are international companies specialized in protecting and securing websites. They offer plugins for WordPress and have many free security features.

But basically, the Sucuri add-on was designed in order to support the company’s various plans and provide the add-on to it. The add-on is characterized by having a distinctive optical scanner, but as for the firewall, you will need to upgrade to be able to obtain it. Also this scanner is remote while Wordfence’s scanner is server side.

So the Sucuri scan is not 100% accurate compared to the Wordfence scan. Also, Wordfence offers the firewall with the free plan, so the free plan from Wordfence may have higher features than the free plan from Sucuri, but the features of each of them differ with the paid plan.

Which is better: Sucuri or iThemes Security?

Sucuri is one of the strong security companies that offers many strong security features, but you need to pay to get a higher level of protection, for example, to pay for a firewall.

The main difference between the two add-ons is that iThemes is unable to scan for and remove malware while Sucuri requires you to pay more to get the features.

Conclusion

The Sucuri plugin is considered one of the leading plugins in providing services to protect and enhance the security of your WordPress site. Therefore, if you are thinking about paying money in exchange for higher security for your site and protecting it from malware, attacks, etc., the Sucuri plugin will be an excellent choice for you