English 
Français 
Italiano 
Español 
Português 
Deutsch Included in every Glow plan
Security
Keep every client site patched, protected and checked from the dashboard you already use. Glow updates vulnerable plugins for you, stops password guessing, scans files every day and tells you as soon as something needs a look.
- Auto-patch vulnerable plugins and themes
- Login protection and admin 2FA
- Daily file scan and one-click hardening
Fix the hole, not just report it
Most hacked WordPress sites get in through a plugin with a known hole and a fix already released. Other tools tell you about it. Glow closes it.
When a vulnerability is published for a plugin or theme on a client site and an update fixes it, Glow runs that update straight away as a safe update: backup first, check the site afterwards, roll back if anything breaks. No waiting for your next maintenance day.
Stop password guessing
Bots try thousands of passwords on every WordPress login page. After 5 failed attempts in 15 minutes, Glow pauses logins from that address for 15 minutes, and each repeat doubles the pause. Application passwords and XML-RPC are covered too, the doors most login plugins leave open.
Locked out a real client? Unlock them from Glow with the reference code on their screen. Want more? Require two-factor sign-in for WordPress administrators with WordPress Access.
A file scan every day
Glow compares WordPress core and plugin files with the official WordPress.org copies every day. It flags files that were changed or added, PHP files hiding in the uploads folder, and exposed copies of wp-config or database dumps that anyone could download.
The scan runs in small steps so the site never slows down, and it never changes a file. You review each finding, dismiss what you expect, and restore a backup if you need to.
Hardening, one switch at a time
The settings every security checklist asks for, without editing wp-config.php on forty sites. Turn them on for one site, or set a default for all of them.
Every switch starts off and says what it might affect, so nothing breaks on a client site by surprise. Turn one off and it is undone on the next page load.
Hear about it first
Glow emails you when something on a client site needs a look: a new vulnerability in a plugin you run, a new administrator account, a security plugin switched off, or a file scan finding.
Alerts are grouped across your sites, so one plugin on 30 sites is one email, not 30.
Out-of-date server software, flagged
Security fixes for PHP, MySQL, MariaDB and nginx arrive as new patch releases. Glow checks each site's server software against the newest release of its branch, and flags anything behind or past end of life.
When the next big PHP advisory lands, you already know which sites to raise with the host.
Show clients the work in every report
Good security is invisible, so clients never see it. The Security section of your client reports changes that: vulnerabilities patched, login attempts blocked, file scans run and hardening in place.
Every month, your clients see what their care plan does for them.
Turn it on when you are ready
Security comes with the Glow plugin and starts in Passive, so nothing on a client site changes until you choose.
- 1
Update the Glow plugin
Version 4.7.0 or later. Update every site from Glow in one go.
- 2
Start in Passive
Glow counts failed logins so you can see what is trying to get in. Nothing is blocked and visitors notice nothing.
- 3
Switch it On
For one site or all of them. Login protection, file scans and auto-patch start. Hardening switches stay off until you pick them.
Security is included in every Glow plan
Many WordPress management tools sell security as an add-on, billed per site. In Glow it is part of the plan you already have.
No per-site add-on
Protect 5 sites or 500 at no extra cost.
No extra plugin
It runs in the Glow plugin already on your sites. Nothing new to install or license.
Works with Wordfence
Already run a security plugin? Glow steps aside where it overlaps and covers the rest.
No credit card needed · No contracts · Cancel whenever
Digital agency and web development teams trust Glow:
WordPress Management Tools
WordPress Management Tools
WordPress Management Tools
WordPress Management Tools
FAQs about Glow Security
Do I still need Wordfence?
Glow covers what most agencies install free Wordfence for: login protection, file scanning and keeping plugins patched. It does not run a request firewall (WAF), which inspects every web request for attacks.
If you want one, keep Wordfence or your host's firewall. Glow detects them and steps aside where they overlap, so they never fight.
Does it cost extra?
No. Security is included in every Glow plan, with no per-site add-on.
What does Glow need on each site?
The Glow plugin, version 4.7.0 or later. Sites on an older version are listed with a note, and you can update them all from Glow.
Could it lock out my clients or break a site?
Glow only pauses logins after 5 failed attempts in 15 minutes, and you can unlock anyone from Glow with the reference code on their screen. Nothing is blocked while a site is Passive.
The file scan never changes a file, and every hardening switch starts off and says what it might affect.
What about vulnerabilities with no fix yet?
Glow alerts you and shows the details on the site, and patches it as soon as a fixed version is released. Blocking an attack before any fix exists needs a dedicated research team, so if a client needs that, pair Glow with a virtual patching service such as Patchstack.
What data leaves the site?
Counts of failed logins with the address they came from, the paths of flagged files and why they were flagged, and the site's hardening and software versions. Never passwords, and never the contents of your files.
Other Features
Vulnerabilities
Get alerts for security vulnerabilities in WordPress core, plugins and themes running on your clients’ sites.
More about VulnerabilitiesWordPress Access
See who can log in to every client site, get flagged on risky accounts and fix them from Glow.
More about WordPress Access