Wordfence vs Solid Security (Now Kadence Security): The 2026 Numbers

Wordfence beats Solid Security, now called Kadence Security, by 92.7 to 82.7 out of 100 on our data. That puts Wordfence 2nd and Kadence Security 7th of the 18 free security plugins we ranked. Most of the gap is support: Wordfence resolved 87% of its recent support threads, Kadence Security 40%.

In our lab neither plugin adds a single kilobyte to the page a visitor downloads. Server time is close too: a median +9.1 ms for Kadence Security and +16.2 ms for Wordfence. That 7.1 ms gap is within our noise, so on speed we call them even.

Pick Wordfence if you want a web application firewall and a malware scanner that checks your files, backed by the stronger support record. Pick Kadence Security if your main concern is logins: two-factor authentication, password rules and brute force protection.

Last updated: 14 October 2026. We re-run the numbers every month.

Solid Security is now Kadence Security

If you search WordPress.org for Solid Security, the plugin you will find is Kadence Security. It is the same plugin, under the same slug, better-wp-security, with the same install base. Its listing today reads “Kadence Security – Password, Two Factor Authentication, and Brute Force Protection”.

The page opens with “Formerly iThemes Security.” Its changelog records both renames: version 9.0.0 says “iThemes Security is now Solid Security!”, and version 10.0.0 says “Updated branding from SolidWP to Kadence.” If you already run Solid Security or iThemes Security, updating moves you to the renamed plugin. We tested version 10.0.6.

Side by side

Metric	Wordfence	Kadence Security
Score (out of 100)	92.7	82.7
Rank among 18 security plugins	2	7
WordPress.org score (out of 100)	92.2	79.6
Active installs	5M+	700,000+
Rating	94% (5,025 ratings)	92% (3,992 ratings)
Support threads resolved (last 2 months)	153 of 175	4 of 10
Last updated	30 September 2026	14 October 2026
Version tested	9.0.2	10.0.6
Tested up to WordPress	7.1.3	7.1.3
Requires PHP	7.0	7.4
On WordPress.org since	21 April 2012	23 October 2010
Weight added to the page	0 KB	0 KB
Server time added (median)	+16.2 ms (6 runs)	+9.1 ms (5 runs)
Server time points (out of 15)	14.3	15

The score is out of 100, scored as in our security ranking. 85 points come from the WordPress.org record (Satisfaction 35, Adoption 25, Maintenance 20, Support 20, scaled to 85). 15 points come from server time: 10 ms or less added earns all 15, 150 ms or more earns none. A security plugin runs on every request, so server time is the cost visitors feel. Wordfence takes 14.3 of the 15 and Kadence Security all 15. The method is on how we rank, and every plugin we scored is in our full security ranking.

Satisfaction

Wordfence is rated 94% from 5,025 ratings; Kadence Security 92% from 3,992. We blend each rating with 25 imaginary votes at 80%, which barely moves either at these counts: 93.9 and 91.9. That earns 29.7 and 27.9 of 35 points. Both have a large, mostly happy user base, and the difference is small.

Adoption

Wordfence has 5M+ active installs, Kadence Security 700,000+. Our adoption score uses a log scale that gives full marks at 1,000,000, so Wordfence takes all 25 points and Kadence Security 23.7. On raw installs Wordfence is roughly seven times larger; on our scale that is worth 1.3 points.

Maintenance

Both are actively maintained and take full marks. Wordfence was last updated 30 September 2026, 14 days before our data pull. Kadence Security shipped version 10.0.6 on 14 October 2026, the day we pulled the data. Both list WordPress 7.1.3 as tested.

Support

This is where the comparison is decided. In the last two months Wordfence’s WordPress.org forum had 175 support threads and 153 were marked resolved, 87%. Kadence Security’s had 10, with 4 resolved, 40%.

That is 17.5 against 8.0 of 20 points, a 9.5-point swing, most of the 12.6-point gap between their WordPress.org scores (92.2 and 79.6). Wordfence also handles far more threads, so its rate rests on a bigger sample. A forum’s resolved rate is not the whole support story, but it is the public record.

Lab: weight and server time

We installed each plugin from WordPress.org on 14 October 2026 onto a fresh WordPress 7.1.3 site (PHP 8.5, Twenty Twenty-Five, no other plugins), activated it alone with default settings, and loaded a 1,500-word test post as a logged-out visitor.

Weight: both add 0 KB. The page stayed at 19.8 KB of HTML, CSS and JS (gzipped), the same as with no plugin. Neither adds a stylesheet or script to the front end for visitors.

Server time: each run takes the median of 15 requests and subtracts the same page with no plugin. The no-plugin baseline varied by run, from 59.8 to 77.8 ms, so we compare the added time. We ran Wordfence 6 times (+27.3, +9.6, +29.9, +15.6, +11.4, +16.9 ms) and Kadence Security 5 times (+15.6, +2.7, +9.1, -2.5, +11.9 ms). The medians are +16.2 ms and +9.1 ms.

The 7.1 ms gap between them is within our noise of about 10 ms. Across the 18 security plugins, medians ran from -0.4 ms to +199.7 ms, so both sit near the light end.

What each one does

Both lists come from each plugin’s own WordPress.org page. Features marked Premium or Pro there are labelled the same way here.

Wordfence

• Firewall: a Web Application Firewall that identifies and blocks malicious traffic, running on your site rather than in the cloud. Rule updates come from its Threat Defense Feed; its page says the free version gets them delayed by 30 days.
• Malware scanner: checks core files, themes and plugins for malware, bad URLs, backdoors, SEO spam, malicious redirects and code injections, and compares files with the WordPress.org copies. It can repair changed files by overwriting them with the original.
• Login security: passkeys, two-factor authentication through any TOTP authenticator app, a login page CAPTCHA, XML-RPC options, and blocking admin logins that use known compromised passwords.
• Brute force protection by limiting login attempts.
• Live Traffic view, and blocking by IP, IP range, hostname, user agent and referrer. Country blocking is Premium.
• Wordfence Central to manage several sites in one place, free for unlimited sites. The Audit Log and real-time IP blocklist are Premium.

Kadence Security

• Login security: two-factor authentication with mobile apps such as Authy and Google Authenticator, email or backup codes, plus password requirements for your users. Passwordless logins, reCAPTCHA and trusted devices are Pro.
• Brute force protection: local protection, plus a network option that blocks an attacker across sites in the Kadence Security community. You can also ban users and user agents.
• Firewall: its screenshots show firewall rules and its changelog adds support for custom firewall rules. The page does not describe a web application firewall in the way Wordfence’s does.
• Site Scanner: checks for known vulnerabilities in WordPress core, plugins and themes, four times a day on the free version, and checks Google’s blocklist through the Safe Browsing API. Automated vulnerability patching through Patchstack is Pro.
• File change detection, Enforce SSL, and scheduled database backups (its page notes this is not a complete backup).
• Hardening tools: hide the login URL, change the database prefix, change user ID 1 and change WordPress salts. Site templates apply security settings by type of site, such as ecommerce or blog.

One requirement to check first: its FAQ says “Kadence Security requires Apache or LiteSpeed and mod_rewrite or NGINX to work.” Wordfence’s page lists no server requirement.

Which should you pick

• You want one plugin that covers firewall, malware scanning and logins: Wordfence. Kadence Security’s page does not describe a file-level malware scanner.
• You mainly want to lock down logins on a small site: Kadence Security. Its 2FA, password rules and brute force protection are the core of the free plugin.
• You already run Solid Security or iThemes Security and it works for you: you are already on Kadence Security after updating. Its support record is the weak number to watch.
• You care most about getting answers on the forum: Wordfence, with 153 of 175 recent threads resolved.
• Your server is not Apache, LiteSpeed or Nginx: check Kadence Security’s requirement before installing.

Pick one rather than running both. We tested each one alone, and the numbers here say nothing about the two together.

Questions people ask

Is Solid Security the same as Kadence Security?

Yes. The WordPress.org plugin with the slug better-wp-security was iThemes Security, then Solid Security, and is listed today as Kadence Security. Its changelog records both renames, and it keeps the same install base, 700,000+.

Which is better, Wordfence or Solid Security?

On our data, Wordfence: 92.7 against 82.7 out of 100, 2nd against 7th of 18 security plugins. The difference comes mostly from support, 87% of threads resolved against 40%. On speed they are even.

Does Wordfence slow down WordPress?

It added 0 KB to our test page and a median +16.2 ms of server time over 6 runs. Kadence Security added +9.1 ms, and the gap is within noise. Visitors download nothing extra from either plugin.

Is the free version of Wordfence enough?

Its page lists the firewall, malware scanner, 2FA, passkeys and Live Traffic in the free plugin. The trade-off it states is that free sites get new firewall rules and malware signatures 30 days after Premium sites.

Does Kadence Security have a malware scanner?

Its page describes a Site Scanner that checks for known vulnerabilities in core, plugins and themes and checks Google’s blocklist status. It does not describe scanning your files for malware code the way Wordfence’s scanner does.