Simple per-site pricing
One license covers one domain. Cancel anytime through your Whop account. What counts as a site?
Yearly is the better price. Monthly is there because a $5 decision should not need a year of commitment.
Free
$0
forever · no card required
One personal site, basic hygiene. A real product, not a trial — it does not expire.
Includes:
- Signature malware scan
- Core integrity check
- Login limiting
- Security score
- Basic hardening
- Definitions update: Weekly
No card required. Does not expire.
Most Popular
Plus
$49$5
per site, per yearper site, per month
or $5 per site, per month or $49 per site, per year
Business sites that must stay online. Everything in Free, plus the firewall, deep scanning, real-time monitoring and 2FA.
Everything in Free, plus:
- Full / deep scan
- Real-time monitoring
- Web application firewall
- IP allow / block + auto-blocking
- Two-factor authentication
- Security headers
- Definitions update: Daily
Renews automatically. Cancel anytime through your Whop account.
Pro
$99$9
per site, per yearper site, per month
or $9 per site, per month or $99 per site, per year
Agencies, e-commerce, high-value targets. Everything in Plus, plus virtual patching, the shared threat feed, auto-remediation and multi-site.
Everything in Plus, plus:
- Virtual patching
- Shared threat feed
- Geo-blocking
- Compromised password check
- Vulnerability alerts
- Auto-remediation
- Multi-site management
- Scheduled reports
- Definitions update: Real-time
Renews automatically. Cancel anytime through your Whop account.
Cancelling never breaks your site — the plugin drops back to Free at the end of the paid term. The full feature matrix is below and on the features page.
What each tier includes
Cumulative — each tier includes everything in the tier before it.
| Feature | What it does | Free | Plus | Pro |
|---|---|---|---|---|
| Signature malware scan | Checks your files against known malware signatures and flags anything that matches. | Included in Free | Included in Plus | Included in Pro |
| Core integrity check | Compares WordPress core files against the official versions to spot tampering. | Included in Free | Included in Plus | Included in Pro |
| Login limiting | Locks out an attacker after repeated failed logins so brute-force attacks fail. | Included in Free | Included in Plus | Included in Pro |
| Security score | A single score with a prioritized list of what to fix first. | Included in Free | Included in Plus | Included in Pro |
| Basic hardening | One-click fixes for the common WordPress mistakes attackers rely on. | Included in Free | Included in Plus | Included in Pro |
| Full / deep scan | Scans themes, plugins, uploads, and the database — not just core files. | Not included in Free | Included in Plus | Included in Pro |
| Real-time monitoring | Watches for file changes as they happen instead of waiting for the next scan. | Not included in Free | Included in Plus | Included in Pro |
| Web application firewall | Blocks malicious requests before WordPress ever runs them. | Not included in Free | Included in Plus | Included in Pro |
| IP allow / block + auto-blocking | Manual allow and block lists, plus automatic blocking of attacking addresses. | Not included in Free | Included in Plus | Included in Pro |
| Two-factor authentication | A second step at login so a stolen password is not enough. | Not included in Free | Included in Plus | Included in Pro |
| Security headers | Adds the HTTP headers that defend against clickjacking and content injection. | Not included in Free | Included in Plus | Included in Pro |
| Virtual patching | Shields a known plugin vulnerability at the firewall until the author ships a fix. | Not included in Free | Not included in Plus | Included in Pro |
| Shared threat feed | Addresses attacking one IronGuard site are blocked across the whole network. | Not included in Free | Not included in Plus | Included in Pro |
| Geo-blocking | Blocks traffic from countries you do not do business with. | Not included in Free | Not included in Plus | Included in Pro |
| Compromised password check | Warns when a user's password appears in a known breach. | Not included in Free | Not included in Plus | Included in Pro |
| Vulnerability alerts | Tells you when a plugin or theme you run has a newly disclosed CVE. | Not included in Free | Not included in Plus | Included in Pro |
| Auto-remediation | Cleans or repairs infected files automatically, with a restore point first. | Not included in Free | Not included in Plus | Included in Pro |
| Multi-site management | All your sites and their security status in one dashboard. | Not included in Free | Not included in Plus | Included in Pro |
| Scheduled reports | Emailed security summaries — useful for client reporting. | Not included in Free | Not included in Plus | Included in Pro |
| Definition updates | How quickly new malware signatures reach your site. | Weekly | Daily | Real-time |
Pricing questions
Will this slow my site down?
Scans are incremental and throttled, and pause under load. The firewall adds a small amount of work per request. IronGuardWP is built for shared hosting — staying inside your host's CPU and memory limits is a design requirement, not an afterthought.
Do I need server access or special software?
No. The scanning engine is pure PHP. No ClamAV, no YARA, no SSH, no command line. If WordPress runs, IronGuardWP runs.
What counts as one site?
One domain. www.example.com and example.com count as the same site. Separate domains need separate licenses.
What happens if I cancel?
Your license runs to the end of the paid term, then the plugin drops back to Free. Nothing breaks and your site is never locked.
Can a plugin like this lock me out of my own site?
IronGuardWP is designed to fail open — if something goes wrong, it stops protecting rather than stopping your site. There is a documented emergency-disable procedure in the docs.
Is Free really free?
Yes, forever, for one site, no card. It is a real product, not a trial.
You found malware — what now?
Every finding tells you what was found, why it matters, and the recommended action. Plus and Pro can quarantine; Pro can clean automatically. Every destructive action is reversible or backed up first.
Does it work with my host / page builder / cache plugin?
It is standard WordPress PHP with no unusual server requirements. Report conflicts to support and they get fixed.
How do I move my license to a new domain?
Re-bind it in the portal or ask support. Moving a site is normal and is not treated as a second site.
Where is my billing handled?
Whop. Manage payment, renewal, and cancellation in your Whop account; the link is in the plugin and the portal.