Three tiers, one engine
WordPress security products
From a hardened free install to a full detection and response stack. Every tier inspects requests before WordPress processes them.
What Hack Halt actually does
Most WordPress security plugins react after WordPress has already loaded, parsed the request and handed it to a plugin that may itself be the vulnerability. Hack Halt works earlier in the request, and keeps working after it — four stages, running on every hit.
Inspect
Every request is examined against firewall policy and WAF signatures before WordPress processes it. Malicious payloads never reach the plugin they were aimed at.
Identify
Intrusion prevention correlates repeat offenders, credential stuffing and reconnaissance. Threat-intelligence feeds and honeypots mean an attacker seen on one protected site is already known here.
Detect
File and database integrity monitoring compare against a known-good baseline. Webshell scanning finds injected code that signature scanners miss, and the vulnerability scanner checks your plugins against published CVEs.
Respond
Incident orchestration groups related signals into one case with a response path. Backups and one-click restore mean recovery is a decision rather than a project.
Which tier fits
The difference between tiers is not how well you are protected at the edge — it is how much of the detection, response and recovery work happens without you.
Start here
Hack Halt Free
Sites that deserve protection, not a security budget
A real firewall, intrusion prevention, MFA enforcement and on-demand vulnerability scanning. Free with no expiry, no request cap and no feature held hostage — the protection layer is complete, the automation is what you add later.
Blocks the automated attacks that make up the overwhelming majority of WordPress traffic.
Explore FreeMost sites
Hack Halt Pro
Sites where downtime costs money
Everything in Free, plus the work you stop doing by hand: scheduled scanning, file integrity monitoring against a known-good baseline, threat-intelligence feeds, honeypot deception and automatic CSP generation.
Turns security from a weekly task into something that runs whether you look at it or not.
Explore ProHighest tier
Hack Halt ProSecure
Sites where a breach is a business event
The full detection and response stack: WAF request inspection before WordPress loads, webshell and database integrity scanning, incident orchestration that correlates an attack chain into one case, and one-click restore when something does land.
Answers the question every other tier leaves open — what happens when something gets through.
Explore ProSecureCompare every capability
Every control in each product, grouped by what it is for. A dash means the capability is absent, not degraded.
| Capability | Free | Pro | ProSecure |
|---|---|---|---|
| Core protection | |||
| Real-time firewall | Included | Included | Included |
| Intrusion prevention / lockouts | Included | Included | Included |
| MFA enforcement | Included | Included | Included |
| Guided hardening | Included | Included | Included |
| Recovery tools | Included | Included | Included |
| Detection | |||
| Vulnerability scanning | Manual | Scheduled | Scheduled |
| File integrity monitoring | Not included | Included | Included |
| Webshell scanning | Not included | Not included | Included |
| Database integrity monitoring | Not included | Not included | Included |
| WAF request inspection | Not included | Not included | Included |
| Intelligence | |||
| Live traffic visibility | Included | Included | Included |
| Geo-IP resolution | Live only | Persistent cache | Persistent cache |
| Threat-intelligence feeds | Not included | Included | Included |
| Honeypot deception | Not included | Included | Included |
| Response | |||
| Autodefense / attack-chain correlation | Not included | Included | Included |
| Incident Orchestration | Not included | Not included | Included |
| Backups and one-click restore | Not included | Not included | Included |
| Security Advisor | Not included | Not included | Included |
| Supply chain | |||
| CSP controls | Manual | Automated | Automated |
| SRI integrity monitoring | Not included | Not included | Included |
Protection, measured
99.9%
Threat detection and prevention rate
Across protected installs
20
Security controls compared
Free, Pro and ProSecure
5
Capability groups covered
Protect, detect, respond, recover
4
Plans, including a free tier
No trial expiry
Common questions
Will Hack Halt slow my site down?
Visitor-facing overhead is a handful of extra database queries on an uncached request, and nothing at all on a cached one. Request inspection happens before WordPress loads its plugins, which is cheaper than the page it is protecting.
Can it lock me out of my own site?
Lockouts apply to repeat failed authentication, and your own address can be allowlisted. An allow decision is terminal across every layer, so an allowlisted address is never blocked by a later rule.
Does it work alongside my existing security plugin?
Technically yes, but two firewalls inspecting the same request duplicates work and makes it harder to tell which one made a decision. Hack Halt is designed to be the layer, not one of several.
What does the free tier actually leave out?
Automation, not protection. Free gives you the firewall, intrusion prevention, MFA and manual vulnerability scanning. Paid tiers add scheduling, file integrity baselines, threat feeds, webshell and database scanning, incident response and restore.
Do I need to be technical to run it?
No. A setup wizard configures hardening, scanning cadence, backups, CSP and the automation playbooks from five questions, and the Security Advisor ranks whatever is left by impact.
Start with the free tier
A real firewall, intrusion prevention and multi-factor authentication, running in minutes. Move up when the automation is worth more than your time.