Passkeys, standard 2FA, trusted devices, brute-force protection, country blocking, and verified crawler exemption are free, permanently. Not a 14-day trial, not a "free forever" plan that quietly stops updating. Pro is a genuinely separate, optional tier for people who want more, not a paywall in disguise.

Free covers login security and geo-blocking, the fundamentals every WordPress site should have. Pro is a genuinely full security suite on top of that, not a couple of bonus extras:

• Threat intelligence — four independently maintained blocklists, matched locally, updated daily
• Bot Shield — canary trap, admin honeytoken, honeypot, behavioural detection, AI crawler blocking, rate limiting, and datacenter/cloud IP blocking
• File integrity & vulnerability scanning — daily core file checks with automatic restore and quarantine, plus every installed plugin/theme checked against a real CVE database
• Monitoring, scoring & audit — a tamper-evident audit log, composite threat scoring, site-wide anomaly alerting, a Health Score, dashboard widget, and client-ready security reports
• Deeper login security — 2FA enforcement policies by role, session hijacking detection, and new-device/new-country alerts
• Hardening — XML-RPC and REST API hardening, upload folder execution blocking, security headers, a security.txt file, login URL hiding, and local request-pattern detection against common SQLi/XSS attempts
• Operations — webhook alerts to Slack/Discord, a weekly email digest, white-label branding, and WP-CLI support

Nothing in Free is crippled to push you toward Pro, it's a genuinely complete tool on its own, Pro just goes considerably further.

No. Nothing in SecondGate, Free or Pro, requires an account, an API key, or any third-party sign-up.

Not in the network-edge sense Sucuri operates in, and Pro doesn't run a general malware scanner across your whole site. What Pro does include is real request-level protection: local pattern detection against common SQLi/XSS attempts, a canary trap and honeypot that catch scanners directly, and automatic restore of tampered core files. Deliberately not marketed as a full WAF, that's a category that needs a team continuously updating signatures against new attacks, which is a different kind of product entirely. If your site's already been compromised and needs cleanup, that's a job for a dedicated incident-response service.

No telemetry, no usage data, no visitor data sent to us, ever, on either tier. Country blocking, threat-intel matching, and vulnerability scanning are all checked locally, on your own server, against publicly downloaded or publicly queried data. We have no visibility into how the plugin is used on any individual site.

This is the one we get asked most, and it's a fair worry, most country-blocking tools check a visitor's User-Agent, which anyone can fake, including a script pretending to be Googlebot. SecondGate verifies real crawlers with reverse and forward DNS lookups instead, the same method Google's own documentation recommends, so a genuine crawler is never caught by a rule that would normally apply. This is free on every install, not a Pro feature.

Partly, and it's worth being precise about the scope. Pro automatically restores modified WordPress core files from WordPress.org's own official checksummed archive, and quarantines anything unexpected found alongside them, real, automated remediation, not just detection. But that's specifically scoped to core files, checked against an official checksum. It has no way to clean malware injected into a plugin, a theme, the uploads folder, or your database, there's no official checksum to restore those against. If an infection's gotten in outside of core, that's a job for a dedicated incident-response service, not something to assume SecondGate has already handled.

A single line in wp-config.php, define('TFIB_DISABLE', true), disables all blocking and enforcement site-wide immediately. It's there specifically so you always have a way back in via FTP or your host's file manager, even if wp-admin itself is unreachable.

Every feature is tested against a real, live WordPress site before it's considered finished, not a demo environment. That's caught real issues along the way, including a hosting-level filter silently intercepting the exact file paths our canary trap uses as bait, and a first version of crawler verification that trusted a name instead of a network. Those got found and fixed because the testing was real, not because nothing ever went wrong.

A passkey lets you sign in with Face ID, Touch ID, Windows Hello, or a hardware key, whatever your device already has. There's no code to type and nothing that can be phished, because it's cryptographically tied to your exact domain, a fake login page simply can't use it.

Standard TOTP codes work fine, Google Authenticator, Authy, 1Password, Bitwarden, or any other authenticator app. Passkeys are the recommended option, not a requirement, and both are free.

Use one of the backup codes generated when you first set up two-factor authentication, then set up 2FA and a new passkey on your replacement device.

Yes, in Pro. 2FA enforcement policies let you require it for specific roles, administrators only, editors and above, or everyone, with a configurable grace period so nobody's locked out the moment it's switched on.

Running two plugins with overlapping firewall features can cause conflicts. Login security and geo-blocking generally coexist fine alongside a malware-scanning plugin, since they're solving different problems, not competing for the same job.

By default, only your server's real connecting IP is trusted, which can't be forged. If a proxy in front of your site rewrites the visitor's real IP into a header, you can explicitly enable and select that header in Advanced settings, off by default, since trusting the wrong header by default is a real, previously-exploited vulnerability in other country-blocking plugins.

This hasn't been tested on Multisite. It's built and tested against standard single-site WordPress installs.

Pro includes WP-CLI support (wp secondgate status, scan, refresh) for scripted or remote management, and cross-site list sharing so your deny list and canary-caught IPs can be exported and reused across sites you manage, no account or central server involved.

£19.99 a year for the full suite described above. The first 100 testers get full Pro access free, no catch, while we're still in that early phase.

Yes, at any point, and you'll keep access until the end of the billing period you've already paid for. We also offer a 14-day money-back guarantee on new Pro subscriptions, no questions asked.

The plugin's core code is GPL-licensed, so nothing about the underlying code becomes unusable. Pro features stop receiving updates and license validation once the subscription ends, but the Free tier keeps working exactly as it always has, permanently.