Jetpack Protect's free plan never looks inside your files

Four things that cost nothing here

• A scan that reads your files. Segurium hashes every file on the server and checks each hash against a cloud database. On Jetpack, file scanning is the paid plan: their free tier checks the WordPress version, your plugins and your themes against known vulnerabilities, and stops there.
• Cleanup that keeps the file. 3 files every 30 days on the free plan, and the theme or plugin carries on working afterwards. Every fix Jetpack documents is delete the file, replace it from your backup, or update and delete the plugin.
• Seeing what was found. Segurium shows you the malware on the row before you clean it, on every install. Jetpack puts threat history behind Scan, Security or Complete, and their free users check the dashboard themselves because free plans get no notifications.
• Cleanup after the fact. Their documentation says Jetpack Scan relies on the site not being infected at the time of purchase. Segurium starts from the files you have today, whatever state they are in.

Both products ship brute-force protection at no cost, and both ship a firewall you can write IP rules in for free. Jetpack Protect works without the main Jetpack plugin. Checked against Automattic's own support and pricing pages on 19 August 2026.

What it costs over three years

On one site, that is $121.20 back over three years if you take Pro, or $358.20 if the free plan covers you. The $119.40 is the renewal price. The first year is $59.40, and their own page says the discount is for the first year only, with all renewals at full price. It buys off-site malware scanning on top of the vulnerability checks, one-click fixes, email alerts and their automatic firewall rules. Prices exclude VAT and were read from Automattic's product API on 19 August 2026.

Why people go looking

The free plan checks versions, not files. Automattic is clear about it: "Jetpack Protect is a free plugin that checks your site daily for vulnerable plugins and themes." The free scan covers the WordPress version and its known vulnerabilities, your installed plugins and theirs, your installed themes and theirs. Nothing reads the bytes of a file. A green dashboard tells you that nothing you run has a published hole. It does not tell you whether something walked in through one last month. Free users are not alerted either way, in their words: "With the Free plan, you will need to check your Protect dashboard." Instant email notifications sit in the paid list.

The paid fix is delete and restore. "Jetpack Scan removes any infected files and replaces them with a clean version from your backup." For a shell dropped into your uploads folder, that is the right move. For one injected line in a theme file you paid for, deleting the file takes the page down and restoring from backup needs a backup with a clean copy of that same file in it.

And it wants a clean baseline. "While Jetpack Scan can fix some hacked files after purchase, we do rely on the site not being infected at the time of purchase and having a clean version to compare any changed files to." Their pricing FAQ says the same thing twice over: Jetpack Protect (Scan) "is not designed to fully clean up sites infected before it was active." Most people install a malware scanner after they suspect an infection, and that is the case their fix model excludes.

Every sentence in quotation marks above is Automattic's own published wording, read on 19 August 2026. Check it yourself before you decide.

How the cleanup actually works

Segurium hashes every file on your server and checks each hash against a cloud database of known-good and known-bad files. Around 94% of your files are settled by the hash alone and never leave the server. A lookup takes about 24 milliseconds, so a full scan does not sit on your CPU for an hour.

Detection is not a paid tier. Free and Pro read the same feed at the same moment. The only thing money changes is how many files you may clean.

When a file comes back infected, you click Fix. For an injection into an otherwise-working file, Segurium fetches a cleaned version of that exact file, so your theme keeps rendering and your plugin keeps loading. A file that is nothing but malware becomes zero bytes at the same path. When no clean version can be produced, the cleanup stops and leaves the file exactly as it found it. It never truncates a file it failed to clean.

The original goes into an encrypted backup on your own server before any of that happens, and one click puts it back. You can look at the malware it removed before you decide anything. Nothing about a cleanup is one-way, and nothing depends on you having had a backup before the infection.

Separately, an integrity scan compares every core, plugin and theme file against the canonical upstream copy of the exact version you have installed, and restores anything that drifted. While the file is clean that is unlimited on the free plan and never touches your cleanup count.

Bulk Fix All ships on every install, free, with a preflight preview so you see exactly what it will touch before it touches anything. Pro at $79 a year lifts the cleanup limit and turns on unattended fixing, so a scheduled scan cleans without you opening the dashboard.

Side by side

Jetpack figures read from Automattic's support pages, their product API and api.wordpress.org on 19 August 2026. Their store prices by visitor location, so the dollar figures here are the USD list prices and yours may render differently. Refunds run 14 days on yearly plans and 7 on monthly. Check all of it again before you decide, because it is theirs to change.

What Segurium does not do

Six things. Read them before you switch rather than after, because the first one is a reason to keep Jetpack Protect installed.

• No vulnerability scanning. This is the big one. Automattic runs WPScan and maintains the vulnerability database behind Protect, and it is a genuine asset with nothing comparable on our side. We do not check your plugin versions against known CVEs and we do not tell you that the contact form you installed in 2023 has a published hole. Their free plan does that daily, for nothing. Keep it. Their own pages give three different sizes for that database on the same day, from "more than 30,770" to "60,000+", so treat the number loosely and the capability seriously.
• No firewall in front of WordPress. Ours filters inside WordPress, after PHP has accepted the request. Jetpack's firewall also runs as PHP on your own server and sits inside WordPress by default, but they ship a standalone mode that runs before WordPress loads once you set the auto_prepend_file directive. If you turn that on, theirs fires a layer earlier than ours.
• No managed firewall rule feed. A paid Jetpack plan keeps their rules updated automatically, and any rules already delivered keep working after the subscription lapses. Segurium has no curated list and no rule feed. You write your own IP and CIDR rules and pick your own blocked countries.
• No backups, no staging, no uptime monitoring. VaultPress Backup is bundled into Jetpack Security and Complete, and it is a real backup product. Segurium keeps an encrypted copy of each file it cleans, on your own server, so you can undo a cleanup. That is not a backup of your site and you still need one.
• No CDN and no DDoS protection. That layer normally arrives from your host or a CDN, so a bare "no" overstates what you lose here.
• No security audit log, no human incident response, no track record. Jetpack's paid plans include priority support from WordPress experts. Nobody at Segurium logs into your site, ever. Segurium arrived on WordPress.org in July 2026, against 100,000 active installs and 92 out of 100 for Jetpack Protect. The free plan exists so you can judge it on your own site rather than on our word.

Who should switch, and who should not

Switch if you installed Jetpack Protect expecting a malware scan and have now read what the free plan checks. Switch if you are looking at $119.40 a year for Jetpack Scan and the thing you want out of it is a clean file at the end. Switch if your site was already infected when you started shopping, because their documentation says that is the case their fix model does not cover.

Do not switch if the vulnerability database is what you came for. We do not have one. Do not switch if you want VaultPress Backup, priority support, or an automatic firewall rule feed that maintains itself.

The honest answer for most free sites is to run both. Jetpack Protect Free tells you a plugin you run has a known hole. Segurium Free tells you whether something already got in. Together they cost nothing and cover two different failures. If you pair them, keep Jetpack's vulnerability checks on and let Segurium handle the file scanning and the cleanup.

What moving across involves

There is no importer. Segurium reads settings from several other security plugins, and Jetpack is not one of them, so nothing carries across automatically. Here is what you set by hand, and it takes a few minutes.

• Your IP allow and block rules, copied off Jetpack's firewall screen.
• The country list, if you want to filter by country.
• Scan exclusions, for any path you want left alone.
• Two-factor enrolment for each user who needs it.

The WordPress.com connection is the piece you can drop. Jetpack Protect requires it, including for the firewall, and Segurium does not ask for an account anywhere. If you keep Jetpack Protect Free for the vulnerability checks, keep the connection too.

1. Install Segurium from WordPress.org.
2. Accept the service disclosure. Nothing contacts our service before you do.
3. Copy your IP rules and country list into the firewall tab.
4. Add any scan exclusions you were using.
5. Run a full scan and an integrity scan.
6. Decide whether Jetpack Protect stays for the vulnerability checks.

What leaves your server, in plain terms

Scanning is opt-in. Until you accept the disclosure on the plugin page, Segurium does not contact our service and does not scan.

Files are checked by SHA-256 first. A file has its bytes sent in two cases: when its hash is one we have never seen, which in practice is about 6% of them, and when you clean it and we build the replacement. Everything else is settled by hash.

Jetpack takes the other approach and says so plainly: scanning takes place on their servers, so that, in their words, you can access your site even when it goes down. Their policy adds that they may use scanned content to improve performance but do not otherwise store it long-term. Segurium settles about 94% of your files by hash on your own server and sends bytes in two cases only.

Samples we do receive are kept for up to 365 days and then deleted by an automated purge, and an analyst can delete one sooner once it has been triaged. Our privacy policy lists every retention period we hold to.

Our servers are in the European Economic Area and Segurium is run from Spain, so GDPR applies to us directly rather than reaching us through an adequacy decision. Two subprocessors sit outside the EEA, for payments and for support email. Both are covered by Standard Contractual Clauses and both are named in the privacy policy.

We do not track your visitors. Segurium looks at files and login attempts.

Questions

Does Jetpack Protect Free scan for malware?

No, and Automattic says so on their own support pages: "Jetpack Protect is a free plugin that checks your site daily for vulnerable plugins and themes." The free scan compares your WordPress version, your plugin versions and your theme versions against a vulnerability database. It does not read the contents of your files. Malware scanning starts on Jetpack Scan at $119.40 a year.

My dashboard is green. Am I clean?

On the free plan, green means no plugin or theme you run has a known published vulnerability. That is worth having. It says nothing about a backdoor already sitting in wp-content/uploads, because nothing looked at that file. Segurium Free hashes every file and checks each hash against a cloud database, which is the other question.

I already pay for Jetpack Scan. What does Segurium add?

The fix. Every remediation path Jetpack documents is delete the file, replace it from your backup, or update and delete the plugin. Segurium writes a cleaned version of that exact file back, so a theme with one injected line keeps rendering. If no clean version can be produced, the cleanup stops and leaves the file as it found it.

My site is already hacked. Will Jetpack Scan clean it?

Read their own sentence before you pay: "While Jetpack Scan can fix some hacked files after purchase, we do rely on the site not being infected at the time of purchase and having a clean version to compare any changed files to." Their pricing FAQ puts it more bluntly: Jetpack Protect (Scan) "is not designed to fully clean up sites infected before it was active." Most people start looking for a malware scanner after the infection, which is the case that sentence excludes.

Is the paid Jetpack scan real-time or daily?

Their pages disagree. One support page says real-time malware scanning. Another says scans occur daily or when manually triggered. Both were live on 19 August 2026. Ask them which one governs your plan before you buy on that basis.

Can I run both?

Yes, and for a free site that is the pairing we would recommend. Jetpack Protect Free tells you a plugin you run has a known hole. Segurium Free tells you whether something already got in. They answer different questions and neither one covers the other. You will hold a WordPress.com connection for Jetpack, which is mandatory on their side.

Do I need a WordPress.com account for Segurium?

No. You accept the service disclosure in the plugin and scan. Jetpack requires a free WordPress.com account connection for Protect and for the firewall, plus a publicly reachable site and a reachable XML-RPC file. If your site is password-protected, behind a Coming Soon page or running locally, Jetpack Protect will not work there.