Segurium

Most WordPress security plugins scan the site, name the infected files, and then ask for money to clean them. Segurium does the cleanup. It finds the infected files, removes the malicious code, and puts the original file back, keeping a reversible AES-256-GCM encrypted copy on the server first. The free tier covers up to 3 cloud cleanups per rolling 30 days.

It is built for a site that is already hacked: Google flagged it, the host suspended the account, or visitors get redirected to spam. Segurium detects what those attacks leave behind, including injected redirects, Japanese SEO spam, pharma spam, uploaded shells and backdoors. A file of yours that an attacker injected code into gets repaired, so your content stays. A file that is nothing but malware, such as an uploaded shell, is emptied instead.

Files are hashed on the server and checked against a continuously updated cloud verdict database, so most files are classified by hash alone. The scan stays fast and the plugin stays small, which matters on shared hosting. When a hash is not yet known, that file's bytes are uploaded for deeper analysis, with your consent.

Every install, free and paid alike, also includes: integrity scanning that restores WordPress core, plugin and theme files an attack rewrote; real-time and upload scanning that blocks infected uploads before they land on disk; bulk Fix All remediation; scheduled scans with email alerts; two-factor authentication with TOTP apps, email fallback, backup codes and per-role enforcement; brute-force protection for wp-login.php and XML-RPC; an IP, CIDR and country firewall; geo-blocking with a confirm-or-revert safety net so you cannot lock yourself out; security headers and cookie hardening; an A+ to F self-check grade with one-click fixes; and a migration importer that reads your existing Wordfence, All-In-One Security and Solid Security settings.

The plugin is licensed GPL-2.0-or-later and its source is public. Cleanups run in Segurium's Cloud Threat Inspection service and count against a per-installation quota. The paid tier raises that quota; the plugin code, the detection, and every feature listed above are identical on both tiers.