All-In-One Security says a plugin cannot scan for malware reliably. Their answer costs $89 a year

Four things that cost nothing here

• Malware detection of any kind. The AIOS free plugin has no signature matching and no content inspection, and their own comparison chart scores the free tier NO on "Monitors and alerts you to infection by malware". Here every file is checked on every scan, and a free install reads the same detection feed a paid one does.
• Removing it. 3 files every 30 days on the free plan, one click each, with the file still working afterwards. AIOS has no delete, quarantine, repair or restore control in any scanner template at any tier. Their premium answer is advice from their support team.
• Country blocking. Free here, with a confirm-or-revert step so a mistake cannot lock you out of your own admin. On AIOS it is Premium, which their readme header and their in-plugin chart both state.
• Two-factor backup codes. Free here, with an email fallback and trusted devices. AIOS ships two-factor free and puts the emergency codes behind Premium, so a lost phone on their free tier means a database edit.

AIOS gives away plenty Segurium has no equivalent for, including the table prefix change, file permission fixes, salt rotation and an .htaccess firewall layer. That list is further down and it is why most readers should keep AIOS installed. Free and premium split read from the AIOS 5.4.9 plugin ZIP, its readme and its in-plugin comparison chart on 19 August 2026.

What it costs over three years

Segurium Pro is the dearer of the two by $103.50 over three years. The free plan is $133.50 cheaper than theirs over the same period and reads the same detection feed Pro does. What the extra buys is the cleanup itself: an infected file gets a cleaned copy written back rather than an alert, and Pro lifts the ceiling on how many. Their Personal plan is $89 a year and covers two sites, so the row above divides it. Comparing $89 against our per-site $79 would flatter us and the arithmetic is not close enough to need help. What the $44.50 buys is a scan run weekly from their server that notifies you when it finds something, plus cleanup advice from their support team. It does not buy a control in the plugin that removes anything. New customers pay half in year one and list price after. Prices checked at teamupdraft.com on 19 August 2026.

Why people go looking

The plugin tells you itself. Open the malware scan tab in the free AIOS plugin and the shipped template says:

"Due to the constantly changing and complex nature of Malware, scanning for such things using a standalone plugin will not work reliably. This is something best done via an external scan of your site regularly. This is why we have created an easy-to-use scanning service which is hosted off our own server which will scan your site for malware weekly and notify you if it finds anything."

Then: "This service is included with the premium plugin". The diagnosis is correct and we build on the same one. A million installs run a scanner whose vendor has written down that it will not work reliably, and the vendor's fix is weekly, off-server and paid.

What the free scan reports. Three verdicts and no others: file contents changed, with the known and actual checksums side by side, file metadata changed, plus files added and removed. Their own feature text calls it file change detection. A checksum mismatch is worth knowing, and it looks identical whether a plugin updated itself last night or something wrote a backdoor into it.

Nothing in AIOS removes anything. Search every scanner template in 5.4.9 for delete, quarantine, clean, repair or restore and you get one hit, and that hit is the premium upsell. The only action offered on a flagged file is "View the scan results and clear this message". Their premium chart describes the Site Scanner as "Monitors and alerts you to infection by malware", and the premium bullets are "We provide advice for malware cleanup" and "Blacklist removal". Their readme offers "hands-on advice and support for malware removal" from their team. That is a support engagement you open.

The price ladder. Personal covers two sites at $89 a year, then $149 for ten, $249 for thirty-five, $349 for unlimited. Their pricing announcement calls the ten-site plan Professional and their live pricing page calls the same plan Business, so check which name you are buying under. New customers get 50% off the first year and renew at list price, with a 14-day money-back guarantee. The live page is geo-priced and VAT-inclusive, so your figure may differ.

Quotes read from the free All-In-One Security 5.4.9 ZIP on WordPress.org and prices from teamupdraft.com, both on 19 August 2026.

How the cleanup actually works

Segurium hashes every file on your server and checks each hash against a cloud database of known-good and known-bad files. Around 94% of your files are settled by the hash alone and never leave the server. A lookup takes about 24 milliseconds, so a full scan does not sit on your CPU for an hour. This is the off-server check AIOS describes, run whenever you ask for it rather than once a week. Free and Pro read the same feed at the same moment, and the only thing money changes is how many files you may clean.

When a file comes back infected, you click Fix. For an injection into an otherwise-working file, Segurium fetches a cleaned version of that exact file, so your theme keeps rendering and your plugin keeps loading. A file that is nothing but malware becomes zero bytes at the same path. When no clean version can be produced, the cleanup stops and leaves the file exactly as it found it.

The original goes into an encrypted backup on your own server before any of that happens, one click puts it back, and you can read the malware it removed before you decide.

Separately, an integrity scan compares every core, plugin and theme file against the canonical upstream copy of the exact version you have installed, and restores anything that drifted. That is the AIOS file change detection signal with the repair attached. While the file is clean it is unlimited on the free plan and never touches your cleanup count. Other products stop there and overwrite from the WordPress.org original, which is the approach we compare on the Wordfence page.

Bulk Fix All ships on every install, free, with a preflight preview so you can see what it will touch before it touches anything. Pro at $79 a year lifts the cleanup limit and turns on unattended fixing, so a scheduled scan cleans without you opening the dashboard.

Side by side

AIOS rows read from the free 5.4.9 plugin, its readme and its in-plugin comparison chart, with prices from teamupdraft.com, all on 19 August 2026. Check them again before you decide, because they are theirs to change.

What Segurium does not do

Read this before you touch your AIOS install. Most of it argues for keeping AIOS.

• No WordPress hardening toolkit. AIOS changes the wp_ table prefix, scans and fixes file permissions, rotates your salts weekly with 64 extra characters, forces logout, holds new registrations for manual approval, blocks user enumeration, manages active sessions, blocks comment spam and auto-blocks spamming addresses, prevents hotlinking, disables the dashboard file editor and protects readme.html. Segurium does none of that. All of it is free in AIOS and none of it conflicts with us.
• No firewall in front of PHP. The AIOS .htaccess layer can drop a request before WordPress loads, which ours cannot. Their 6G rules ship free, along with PHP-level rules, fake-Googlebot blocking, and IP and user-agent lists. Ours filters inside WordPress with IP and CIDR rules and a country filter. The .htaccess half needs Apache, so on nginx the gap narrows to their PHP rules. Neither product runs a WAF at the edge and neither ships a curated IP blocklist, so both of us leave you writing your own rules on your own server.
• No audit log, no monitoring, no vulnerability database. AIOS records plugin and theme add, remove and update events free, and Premium adds blacklist monitoring against the search-engine lists plus uptime and response-time checks. Segurium ships none of that, and it does no vulnerability scanning against a CVE database and no virtual patching. There is no backups product and no staging either; the AIOS database backup runs through UpdraftPlus rather than either of us. Neither product gives you a CDN or DDoS protection, and that normally arrives from your host, so the loss there is smaller than a bare No suggests.
• No human incident response. AIOS Premium includes advice from their team and priority support. Nobody at Segurium logs into your site, ever. If you want a person on the other end during an incident, buy theirs and keep it.
• No track record. AIOS has been on WordPress.org since June 2013, with a million active installs and 94 out of 100 across 1,714 ratings. Segurium arrived in July 2026 with two ratings. The free plan exists so you can judge it on your own site rather than on our word.

Who should switch, and who should not

Almost nobody should switch. Keep AIOS and add Segurium next to it. The two products do different jobs, the AIOS free scanner reports file changes rather than malware, and there is no second malware scanner to turn off. Turn off nothing and you lose nothing.

Add Segurium if you want to know whether a changed file is malware, if something is already on your site and the only AIOS button is "clear this message", or if country blocking and two-factor backup codes are what you were about to pay $89 a year for. Stay on AIOS alone if the hardening is all you wanted and you have never had an infection. Buy AIOS Premium instead of us for blacklist and uptime monitoring, or to have their team advise you through a cleanup you carry out yourself.

Running both, watch the firewall: keep your IP rules in one of the two products and leave the other empty, or two deny lists will confuse you later.

What moving across involves

Segurium detects an existing AIOS install and offers to import from it. Two settings come across on their own: your banned IP addresses, and your scan exclusions from both AIOS fields, the paths and the extensions. Extensions arrive rewritten as wildcards, so an AIOS entry of .log lands here as *.log. Your IP whitelist is skipped on purpose, because it is a bypass list and the Segurium firewall is a deny list. Country blocking and brute-force thresholds are not imported either. The switching guide at /migrate/aios/ covers each of those and what to write down before you change anything.

What leaves your server, in plain terms

Scanning is opt-in. Until you accept the disclosure on the plugin page, Segurium does not contact our service and does not scan.

Files are checked by SHA-256 first. A file has its bytes sent in two cases: when its hash is one we have never seen, which in practice is about 6% of them, and when you clean it and we build the replacement. Everything else is settled by hash.

Samples we do receive are kept for up to 365 days and then deleted by an automated purge, and an analyst can delete one sooner once it has been triaged. Our privacy policy lists every retention period we hold to.

Our servers are in the European Economic Area and Segurium is run from Spain, so GDPR applies to us directly rather than reaching us through an adequacy decision. Two subprocessors sit outside the EEA, for payments and for support email. Both are covered by Standard Contractual Clauses and both are named in the privacy policy.

We do not track your visitors. Segurium looks at files and login attempts.

Questions

AIOS says a plugin cannot scan for malware reliably. Does that apply to Segurium?

They are right, and that is why Segurium does not try. The plugin hashes each file with SHA-256 and asks a cloud database what that hash is. The judgement happens off your server, which is the same conclusion AIOS reached. The difference is when it happens and who gets it: every install runs the check on demand, and free installs read the same detection feed paid ones do. Their off-server scan runs weekly and starts at $89 a year.

Should I uninstall AIOS after installing Segurium?

Most people should not. AIOS ships hardening Segurium has no equivalent for: the wp_ table prefix change, file permission scan and fix, weekly salt rotation, forced logout, manual approval of new registrations, comment spam controls, hotlink prevention, and an .htaccess layer that can act before PHP runs. Keep all of it. Add Segurium for detection and cleanup and the two do not overlap, because the AIOS free scanner reports file changes rather than malware.

What does the $89 plan buy?

A scan of your site run weekly from their server that notifies you when it finds something, country blocking, smart 404 blocking, blacklist and uptime monitoring, two-factor backup codes, and cleanup advice from their support team. It covers two sites. It does not add a control to the plugin that removes anything from an infected file, because no such control exists in the scanner templates at any tier.

Is the AIOS firewall better than Segurium's?

In one respect yes. Their .htaccess rules sit in front of PHP, so a blocked request never reaches WordPress. Ours filters inside WordPress, after PHP accepted the request. Same kind of rules, one layer later. Their .htaccess layer needs Apache, so on nginx that advantage disappears and their PHP-level rules do the work. If you are on Apache and under sustained attack, keep theirs.

Will my AIOS settings come across?

Two of them come across on their own: your banned IP addresses, and your scan exclusions from both AIOS settings, the file paths and the file extensions. Your AIOS IP whitelist is skipped on purpose, because it is a bypass list and the Segurium firewall is a deny list. Country blocking and brute-force thresholds are not imported. The switching guide at /migrate/aios/ covers each of those in full.

What if I install it and it finds nothing?

Then you have a second opinion for free and you have spent twenty minutes. There is no card to enter and no trial to cancel.