VMP Security is a WordPress security plugin built to protect self-hosted WordPress sites from hacks, malware, and known vulnerabilities. The free core plugin, distributed on WordPress.org, includes a firewall, malware scanning, two-factor login security, a user dashboard, live traffic updates, a whois lookup tool, diagnostics, and IP/country blocking. The paid Premium plan ($149/year) adds real-time firewall rules and malware signatures (versus the free tier's 30-day-delayed rule updates), a full audit log, priority support, unlimited license activations, and advanced analytics/reporting. VMP Security also runs a Portal product for managing and monitoring multiple connected WordPress sites from one dashboard, publishes a public vulnerability database covering WordPress core, plugins, and themes with CVE tracking, and operates a vulnerability disclosure and bug bounty program for security researchers. The company states its plugin is designed not to slow sites down or affect SEO, and it offers both a public support forum for free users and priority email support (with weekday SLA) for Premium and Portal customers.
Key Features
Real-time WordPress firewall — A 750+ rule firewall blocks malicious requests before they reach a protected WordPress site; Premium upgrades from 30-day-delayed rules to real-time rule updates.
Malware scanning — 9 malware scanners check WordPress sites against known malware signatures, with real-time signature updates on the Premium plan versus a 30-day delay on Free.
Two-factor login security — Built-in 2FA login protection secures the WordPress admin login against brute-force and credential attacks.
IP and country blocking — Block traffic by IP address or by country; Premium adds country-level blocking on top of the free plan's custom IP blocking.
Audit log — Tracks security-relevant activity on protected sites; the Free plan retains 50 days of history, Premium retains a full/complete audit log.
Scheduled security scans — Automated, unlimited scheduled scans check WordPress sites for malware and vulnerabilities on both Free and Premium plans.
Plugin/theme vulnerability monitoring — Cross-references installed WordPress plugins and themes against VMP Security's public vulnerability database to flag known-vulnerable versions.
VMP Security Portal — A separate multi-site dashboard for connecting and managing multiple WordPress sites from one place, with configuration templates, centralized scan findings, and alert routing to email, SMS, or Slack/Discord.
Pros & Cons
Pros
Free core plugin with real firewall, malware scanning, and 2FA login security, distributed on WordPress.org
Premium tier is affordably priced at $149/year and adds real-time (not delayed) firewall and malware signature updates
Public vulnerability database and CVE disclosure/bug bounty program add transparency beyond a typical plugin
Portal dashboard lets you manage and monitor multiple connected WordPress sites from a single view
Cons
Free tier's firewall rules and malware signatures are delayed by 30 days versus Premium's real-time updates
Only one paid plan tier, so there is no mid-tier option between Free and the $149/year Premium plan
Limited to WordPress sites — not usable for other CMS or non-WordPress web stacks