Skip to content
Just updated87 new versions in the last 24 hoursDownloads left today: of of leftNo downloads left today · Resets in h
Join nowAccount
WP Cerber Security plugin cover image

PluginUpdated

WP Cerber Security

by Cerber Tech Incv9.10Unlimited sites

WP Cerber Security by Cerber Tech Inc is a WordPress security plugin for site owners who need defenses against malicious traffic, spam, and account attacks.

Product facts

Version
9.10
Released
14 October 2026
Type
Plugin
Licence
GPL
Included in
Every plan, or $10.99 / year on its own

Overview

WP Cerber Security screens incoming requests for malicious patterns and automated bot activity. Its firewall and traffic inspection tools help block attacks, while login protections guard against brute-force attempts. The plugin also applies spam checks to site forms, including WooCommerce forms, and offers country-based rules for controlling site access and form submissions.

The plugin scans WordPress files, themes, and plugins for malware and suspicious changes, and can restore original WordPress files if they have been compromised or modified. Site owners can review logged user activity and HTTP requests, receive email alerts about security events, and use two-factor authentication to add another sign-in check.

Features

  • Request screening: The firewall inspects incoming requests for malicious patterns and automated bots, helping block hacker activity before it reaches the site.
  • Login attack protection: Layered defenses help prevent brute-force attempts and code injections across login, registration, and REST API endpoints.
  • Spam filtering: Heuristic and content-based checks, along with a real-time IP database, screen form submissions for spam, phishing, and other malicious content.
  • File and malware scans: Scan WordPress files, themes, and plugins for malware, viruses, and suspicious changes, with automatic removal of detected threats.
  • Country-based access rules: Set geographic rules to restrict site access and control which form submissions are accepted based on location.
  • Activity and traffic logs: Review records of user activity and HTTP requests to monitor suspicious behavior and keep security records.

Best for

  • WordPress blogs and professional websites
  • WooCommerce store operators
  • Site owners monitoring suspicious traffic

Changelog

Version 9.10

  • Security Two-factor authentication is now protected against PIN distributed brute-force attacks with per-account rate limiting. Each account can receive at most 5 new 2FA challenges per rolling hour and 10 per rolling 24 hours.
  • Security When an account exceeds a 2FA challenge limit, WP Cerber blocks new sign-ins to that account for 24 hours and notifies the account owner of a possible password compromise.
  • Security Hostnames obtained through reverse DNS lookups are now treated as untrusted data and escaped every time they are displayed in the admin area.
  • Security Fixed a REST API user enumeration bypass. With "Block access to users' data via REST API" enabled, visitors blocked from the standard users route could still get the user list by changing the letter case or adding a trailing backslash or newline.
  • Fixed A `rest_route` query parameter passed as an array, such as `?rest_route[]=x`, caused an uncaught `TypeError` (HTTP 500) in `CRB_Request::get_rest_api_path()`. WP Cerber now leaves such requests to WordPress, as on a site without WP Cerber.
  • Fixed The "BLOCKED" and "PROHIBITED" user status labels and the red highlighting of usernames were missing on the WordPress "Users" admin page after a change in the WordPress Users table markup. They are displayed again.
  • Fixed The GDPR personal data export now reports Activity log read errors. Previously, a database error could make the export state that no activity was logged or end the export early.
  • Fixed The GDPR personal data erasure no longer confirms that data was erased when a database error prevents WP Cerber from verifying that Activity log records were removed.
  • Improved WP Cerber now recognizes the core REST API users routes the same way WordPress dispatches them: regardless of letter case, with trailing slashes and backslashes removed, and with one trailing newline allowed. All requests that were blocked before remain blocked.

Earlier versions

  • 9.9.5: 4 improved, 5 fixed
  • 9.9.3: 9 fixed
  • 9.9: 3 new, 2 improved, 2 fixed

FAQ

Is WP Cerber Security free?

The code of WP Cerber Security is licensed under the GPL, so anyone may use, change and share it. GPL 247 is a paid service: a plan or a purchase of WP Cerber Security gives you the download and its updates. The developer's own support, licence key and online services are not included.

Which version of WP Cerber Security is this?

Version 9.10, released 14 October 2026. New versions appear here when the developer publishes them.

How do I update WP Cerber Security?

Install GPL 247 Updater on your site and paste your key from My Account. It installs new versions of WP Cerber Security for you.

You might also like