Plugin
Updated
iThemes Security Pro
iThemes Solid Security Pro is a WordPress security plugin by iThemes. It hardens logins with strong password rules, two-factor authentication and passkeys, blocks brute force attempts, and scans your plugins and themes for known vulnerabilities so you can patch them quickly.
- Version
- 9.0.8
- Released
- Sep 30, 2026
- Developer
- iThemes
- Type
- WordPress plugin
- Licence
- GPL
- Included in
- Every plan, or $4.79 a year on its own
- Topics
- Security Plugins
What’s new in iThemes Security Pro 9.0.8
Version 9.0.8 · Sep 30, 2026
Latest
- FixedResolved 404 errors when loading settings for features.
What it does
Most WordPress break-ins start with a weak password, a repeated login attack or an outdated plugin with a known hole. This plugin targets each of those. You can require strong passwords, two-factor authentication or passkeys for users, ban IP addresses that hammer the login page, and run scheduled scans that flag vulnerable software. Through its Patchstack integration, it can apply virtual patches when a fix for a plugin or theme has not been released yet.
Day to day, a real-time security dashboard shows activity on the site, and alerts can be set up for different users. Trusted Devices lets familiar devices log in normally while sending notices about logins from unknown ones. Activity logs record what users do, and WP-CLI commands let developers manage security from the command line. It suits blogs, online stores and business sites where several people log in and access needs careful control.
Best for
- Business sites with several users logging in
- Online stores that need tighter login protection
- Agencies managing security across client WordPress sites
Features
Login security requirements
Set rules that require strong passwords, two-factor authentication or passkeys for users, cutting the risk that weak credentials let someone into your dashboard.
Brute force protection
Local and network-based IP banning blocks repeated malicious login attempts. The network draws on shared threat data from over 1 million sites, and you can customize the rules.
Passkeys and biometric login
Users can sign in with passkeys that work with Face ID, Touch ID and Windows Hello, in major browsers such as Chrome and Safari.
Patchstack vulnerability scanning
Schedule automatic scans that detect vulnerable plugins and themes, then apply virtual patches through the Patchstack integration when a fixed update is not yet available.
Real-time security dashboard
Watch site security activity on a customizable dashboard, with alerts that can be tailored for different users and stakeholders who need to stay informed.
Trusted devices
Approve familiar devices for login and get notified when someone signs in from an unrecognized device, which helps guard against session hijacking.
Temporary privilege escalation
Give an outside developer or technician temporary admin access without creating a new account, and control how long that access lasts and what it covers.
Activity logs and WP-CLI
Keep detailed logs of user actions and manage security settings from the command line with WP-CLI. Security updates for plugins and themes can install automatically after a delay you choose.
iThemes Security Pro older versions
- 9.0.7Sep 181 fix
- 9.0.5Aug 52 fixes
- 9.0.4Jun 121 improvement, 1 fix
- 8.7.2Mar 29
- 8.7.0Feb 20
- 8.6.5Jan 28
- 8.6.4Nov 28, 2025
- 8.6.3Nov 5, 2025
- 8.6.1Oct 27, 2025
- 8.6.0Sep 18, 2025
Members and buyers of this product can download older versions.
37 older versions in all. If you need one that is not listed, ask support.
Questions about iThemes Security Pro
Does it support two-factor authentication and passkeys?
Yes. You can require two-factor authentication or passkeys for users. Passkeys support biometric logins with Face ID, Touch ID and Windows Hello, and work in major browsers including Chrome and Safari.
How does it deal with vulnerable plugins and themes?
It runs scheduled scans to find vulnerable software on your site. Through its Patchstack integration it can apply virtual patches when an update is not out yet, and it can automatically install plugin and theme updates that fix security issues after a delay you set.
Can I give a developer admin access for a short time?
Yes. The temporary privilege escalation feature grants an external developer or technician admin access without creating a new user account. You decide how long the access lasts and which permissions it includes.
Can I see what users are doing on my site?
The plugin keeps detailed logs of user actions and shows security activity on a real-time dashboard. You can also set alerts for different users, including notices about logins from unrecognized devices.
Is iThemes Security Pro free?
The code of iThemes Security Pro is licensed under the GPL, so anyone may use, change and share it. GPL Feast is a paid service: a plan or a single purchase gives you the download and automatic updates. The developer's own support, licence key and online services are not included.
Which version of iThemes Security Pro is this?
Version 9.0.8, released Sep 30, 2026. New versions appear here when the developer publishes them, and members get them as automatic updates.
How do I update iThemes Security Pro?
Install the free GPL Feast Updater on your site and connect it with your API key. It installs new versions of iThemes Security Pro automatically and keeps a backup, so you can roll back.
You might also like
