iThemes Solid Security Pro
Antivirus scan
Powered by ClamAV
✅ Verified clean
This product file has passed our security filters.
Want to run a fresh ClamAV scan right now? Takes a few seconds and shows scanner version, signature DB and live result.
This can take 5 to 30 seconds.
Clean file Threat detected
No threats detected in this file.
- File
- Size
- Scanned
- ClamAV
- Signature database
⚡ Powered by ClamAV
Scan could not be completed
Report product
If you detected an issue (broken file, malware, inappropriate content, etc.) let us know and we'll review it ASAP.
Sign in to report
About iThemes Solid Security Pro
Admin permissions are granted for an afternoon and stay for years
The designer who touched up the front page, whoever helped with a migration, the agency that built the shop two years ago. Each was given an administrator account for a specific job, and almost nobody goes back afterwards to take it away.
Each of those accounts is a full key to the site, with whatever password its owner chose. The risk is not only in whoever attacks from outside, but in how many master keys are handed out without anyone remembering where they are.
Solid Security Pro, formerly iThemes Security Pro, stops brute force and watches for vulnerabilities, as expected. What sets it apart are its tools to govern those accounts.
The pieces of Solid Security Pro
- Scanner for known vulnerabilities in core, plugins and themes, with a Google Safe Browsing check and malware alerts. In Pro, every hour.
- Virtual patching with Patchstack for some vulnerabilities before you have had a chance to update.
- Brute force protection, local and network-wide, plus permanent banning of repeat offenders.
- Two-factor authentication with Authy, Google Authenticator, email or backup codes, and a password policy.
- Passwordless login with one click, and magic links to get in if your username was locked out.
- Version management to auto-update WordPress, plugins and themes.
- File change detection and a log of logins, registrations, plugin and theme changes and edits.
Granting access without giving the site away
Privilege escalation. It gives a user administrator-level access temporarily. The collaborator stays on minimal permissions and goes up only when there is work to do.
Trusted devices. It identifies the computers you and your users use in order to block session hijacking, and lets you limit administrator privileges to those devices.
Per-user security. A screen brings together your users' security practices, so you can see which accounts still need strengthening.
Before any of that, it is worth deleting or downgrading the administrator accounts with no pending work. No tool makes that decision for you.
How far Solid Security goes
It does not stop every attack. It stops many common methods, and virtual patching covers some vulnerabilities, not all. Updating is still necessary.
It reaches deep into the site. It makes significant changes to the database and files: make a full backup before turning features on.
Part of its protection comes from outside. Virtual patching comes from Patchstack, and network protection relies on close to one million sites using the plugin.
Getting Solid Security running: requirements and first steps
Apache or LiteSpeed with mod_rewrite, or NGINX. Recent versions require WordPress 6.5 and PHP 7.4 or later, and it is tested against the latest stable WordPress release.
- Make a full backup.
- Activate the plugin and review your users: downgrade anyone who no longer needs to be an administrator.
- Turn on two-factor authentication, starting with the accounts that have the most permissions.
- Run the scanner and set up trusted devices and privilege escalation.
Other security pieces in the catalogue
With the same all-in-one approach, Security Ninja PRO combines a cloud firewall, login protection, a scanner and an activity log. Hide My WP Ghost changes the WordPress, plugin and theme paths.
To fine-tune what each role sees, User Role Editor Pro lets you, among other things, block admin menu items per role. With many sites on MainWP, MainWP iThemes Security Extension applies Solid Security settings, releases lockouts and checks security status from that dashboard.
Questions about Solid Security Pro
Is it the same as iThemes Security Pro?
Yes. In version 9.0 it was renamed Solid Security, and in 10.0 it took on the Kadence brand.
What does Pro add over the free version?
Virtual patching, trusted devices, privilege escalation, passwordless login, user logging, version management, reCAPTCHA and hourly scans instead of four a day.
Can I give a developer temporary access?
Yes, with privilege escalation, without their account being an administrator forever.
What happens if I get locked out myself?
Magic links let you get in even when brute force protection has locked out your username.
Does it work with NGINX?
Yes. It requires Apache or LiteSpeed with mod_rewrite, or NGINX.
Topics
Version history
-
v
9.0.10 Current 17 Oct 2026
-
v
9.0.8 1 Oct 2026
-
v
9.0.7 18 Sep 2026
-
v
9.0.5 5 Aug 2026
-
v
8.7.2 30 Mar 2026
Customer reviews
Sign in to leave a review. Only people who have the product can review it.
No reviews for this product yet.
Frequently asked questions
-
GPL (General Public License) is the license under which WordPress and most premium plugins/themes are distributed. It grants you the right to use, modify and redistribute the software in as many projects as you want, with no domain restrictions.
-
Yes. With membership you get automatic updates via our GPLClub Updater plugin (installed on your WP, detects new versions and applies them). With individual purchase, you get one year of manual updates from your account.
-
Depends on the plan. Monthly: 3 domains. Semi-annual: 7. Annual and Lifetime: 15. Individual purchase: 1 domain.
-
GPLClub offers its own support for installation, configuration and compatibility. For direct support from the original author (feature requests, product-specific bugs), a license purchased from the author is required.
