Plugin
Updated
WP Cerber Security
WP Cerber Security by Cerber Tech Inc is a WordPress security plugin that guards your site against hacker attacks, spam bots and malware. It combines a firewall, login protection, form anti-spam and a malware scanner in one plugin.
- Version
- 9.10
- Released
- Oct 14, 2026
- Developer
- Cerber Tech Inc
- Type
- WordPress plugin
- Licence
- GPL
- Included in
- Every plan, or $10.39 a year on its own
- Topics
- Security Plugins
What’s new in WP Cerber Security 9.10
Version 9.10
Latest
- SecurityTwo-factor authentication is now protected against PIN distributed brute-force attacks with per-account rate limiting. Each account can receive at most 5 new 2FA challenges per rolling hour and 10 per rolling 24 hours.
- SecurityWhen an account exceeds a 2FA challenge limit, WP Cerber blocks new sign-ins to that account for 24 hours and notifies the account owner of a possible password compromise.
- SecurityHostnames obtained through reverse DNS lookups are now treated as untrusted data and escaped every time they are displayed in the admin area.
- SecurityFixed a REST API user enumeration bypass. With "Block access to users' data via REST API" enabled, visitors blocked from the standard users route could still get the user list by changing the letter case or adding a trailing backslash or newline.
- FixedA `rest_route` query parameter passed as an array, such as `?rest_route[]=x`, caused an uncaught `TypeError` (HTTP 500) in `CRB_Request::get_rest_api_path()`. WP Cerber now leaves such requests to WordPress, as on a site without WP Cerber.
- FixedThe "BLOCKED" and "PROHIBITED" user status labels and the red highlighting of usernames were missing on the WordPress "Users" admin page after a change in the WordPress Users table markup. They are displayed again.
- FixedThe GDPR personal data export now reports Activity log read errors. Previously, a database error could make the export state that no activity was logged or end the export early.
- FixedThe GDPR personal data erasure no longer confirms that data was erased when a database error prevents WP Cerber from verifying that Activity log records were removed.
What it does
A WordPress site faces a steady stream of automated traffic: bots guessing passwords, spam hitting contact forms, and scripts probing for weak spots. This plugin inspects incoming requests for malicious patterns and blocks them before they reach your data. It limits brute force attempts on login, registration and REST API endpoints, and it filters form submissions with heuristic and content-based checks plus a real-time IP database. You can also set country-based rules that restrict access or form submissions by location.
Beyond blocking attacks, it helps you spot and fix problems. The malware scanner and integrity checker look through WordPress core files, themes and plugins for malware and suspicious changes, and can remove threats automatically. If original WordPress files are modified, you can restore them. An activity log and live traffic viewer record user actions and HTTP requests, and settings links in the log take you to the rule behind each decision. Email alerts keep you informed of security events and scan results.
Best for
- WooCommerce stores that need protected checkout and login forms
- Blogs and business sites troubled by spam and bots
- Agencies and freelancers managing security on client sites
Features
Firewall and traffic inspector
Screens every incoming request for malicious patterns and blocks hacker attacks and automated bots before they can reach your site data.
Anti-spam for all forms
Uses heuristic and content-based algorithms with a real-time IP database to stop spam, phishing and malicious submissions across your site forms.
Brute force protection
Guards login, registration and REST API endpoints with layered protection and bot detection to stop repeated password guessing and code injection attempts.
Malware scanner and integrity checker
Scans WordPress files, themes and plugins for malware and suspicious changes, removes threats automatically and alerts you when something is found.
Country-based access rules
Restricts access to your website and controls form submissions based on the visitor's geographic location, so you can limit exposure from specific countries.
Cloud threat intelligence
Connects to Cerber Security Cloud to block IP addresses recognized as malicious, adding real-time protection against known bad actors.
Activity log and live traffic
Logs user activity and HTTP requests, and links log events to the role-based setting that shaped each decision, so you can review behavior easily.
File recovery and email alerts
Restores original WordPress files if they are compromised or modified, and sends email notifications about security events, scan results and suspicious activity.
WP Cerber Security older versions
- 9.9.5Aug 314 improvements, 5 fixes
- 9.9.3Aug 129 fixes
- 9.9Jul 213 new, 2 improvements, 2 fixes
- 9.8.3Jul 3
- 9.8Jun 12
- 9.7.3Apr 26
- 9.7Feb 27
- 9.6.11Dec 22, 2025
- 9.6.10Oct 4, 2025
- 9.6.9Jun 5, 2025
Members and buyers of this product can download older versions.
22 older versions in all. If you need one that is not listed, ask support.
Questions about WP Cerber Security
Does it protect WooCommerce checkout forms?
Yes. The plugin protects all WooCommerce forms, including checkout pages, against fraudulent and automated submissions. Its anti-spam and bot detection also cover login and registration forms, so a store gets the same protection as the rest of the site.
Can it remove malware it finds?
The malware scanner checks WordPress files, themes and plugins for malware, viruses and suspicious changes, and it can remove threats automatically. If core WordPress files have been altered, the file recovery feature lets you restore the original versions.
Can I block visitors from certain countries?
Yes. Country-based access rules let you restrict access to your website by geographic location. You can also use location to control form submissions, which helps cut spam coming from regions you do not serve.
How do I know what the plugin has blocked?
An activity log records user actions and HTTP requests, and a live traffic viewer shows requests as they arrive. Log entries link to the setting that affected each decision, and email alerts report security events and scan results.
Is WP Cerber Security free?
The code of WP Cerber Security is licensed under the GPL, so anyone may use, change and share it. GPL Feast is a paid service: a plan or a single purchase gives you the download and automatic updates. The developer's own support, licence key and online services are not included.
Which version of WP Cerber Security is this?
Version 9.10, released Oct 14, 2026. New versions appear here when the developer publishes them, and members get them as automatic updates.
How do I update WP Cerber Security?
Install the free GPL Feast Updater on your site and connect it with your API key. It installs new versions of WP Cerber Security automatically and keeps a backup, so you can roll back.
You might also like
