MalCare charges $299 to remove malware. We do it on the free plan.

What you get free here

• Actually removing the malware. 3 files every 30 days on our free plan. On MalCare, removal starts at $299 a year, and the $99 plan does not do it either. This is the whole argument in one line.
• Two-factor authentication. TOTP, email fallback, backup codes and trusted devices, free. MalCare's plugin description does not list 2FA at all, so the usual answer is a second plugin.
• Security headers. Three presets plus custom values, free. Also absent from their listing.
• Integrity checking. Every core, plugin and theme file compared against the canonical upstream copy of your exact version, and restored if it drifted. Free and uncapped while the file is clean.

Both products scan for free and both block countries. MalCare prices checked at malcare.com on 7 August 2026. Check them again before you decide, because they are theirs to change.

What it costs over three years

On one site, that is $660 back over three years if you take Pro, or $897 if the free plan covers you. Most single-site owners never need more than three cleanups in a month.

Why people go looking

The free plan finds it and stops there. MalCare's pricing page is explicit that cleanup is not included on Free. It is not included on Protect at $99 a year either. The first plan that removes anything is Repair, at $299. You find out which plan you are on at exactly the wrong moment.

The plugin listing pulls in two directions. Its free versus premium table marks one-click cleanups, automatic cleanups and unlimited cleanups as paid. Elsewhere on the same listing, unqualified lines still read "UNLIMITED hack cleanups" and describe a one-click cleaner offering unlimited automated cleanups. Both were read on 19 August 2026. If you install on the strength of a headline rather than the table, you find out which is which at the wrong moment.

You are buying a suite. Uptime monitoring, performance checks, a management dashboard, agency white-labelling. All useful, and all in the price whether or not you run an agency.

How the cleanup actually works

Segurium hashes every file on your server and checks each hash against a cloud database of known-good and known-bad files. Around 94% of your files are settled by the hash alone and never leave the server. A lookup takes about 24 milliseconds.

Detection is not a paid tier. Free and Pro read the same feed at the same moment. The only thing money changes is how many files you may clean.

When a file comes back infected, you click Fix. For an injection into an otherwise-working file, Segurium fetches a cleaned version of that exact file, so your theme keeps rendering and your plugin keeps loading. A file that is nothing but malware becomes zero bytes at the same path. When no clean version can be produced, the cleanup stops and leaves the file exactly as it found it.

The original goes into an encrypted backup on your own server before any of that happens, and one click puts it back. You can look at the malware it removed before you decide. Nothing about a cleanup is one-way.

Bulk Fix All ships on every install, free, with a preflight preview so you can see exactly what it will touch before it touches anything. Pro at $79 a year lifts the cleanup limit and turns on unattended fixing, so a scheduled scan cleans without you opening the dashboard.

Side by side

Rows marked "not listed" mean the feature does not appear in MalCare's own WordPress.org description, read on 7 August 2026. That is not the same as proof it is missing, so check with them if one of those rows decides it for you.

What Segurium does not do

Five things, and you should read them before you switch rather than after.

• Our scan runs on your server. MalCare copies your files once and analyses them on their own infrastructure, so a deep scan never competes with your visitors for CPU. We hash first and most files are answered from the hash alone, which keeps it light, but light is not zero. On a cramped shared host under real traffic, their design is the better one and this row genuinely goes to them.
• No firewall in front of the site. Theirs filters traffic before it reaches your host. Ours filters inside WordPress, after PHP has accepted the request. Same idea, one layer later.
• No backups and no staging. BlogVault builds both and MalCare comes from the same people. We keep encrypted copies of the files we clean and nothing else. That is a restore point, not a backup strategy, and you still need one.
• No site-management suite. No uptime monitoring, no performance checks, no single dashboard across client sites, no white-labelled reports. If you maintain sites for other people, that is most of your working day and we do none of it.
• No track record. MalCare has been on WordPress.org since 2018 with 200,000 installs and 88 out of 100 across 542 ratings. Segurium arrived in July 2026 with none. The free plan exists so you can judge it on your own site rather than on our word.

Who should switch, and who should not

Switch if you run one or two sites, you are on the free plan, and you have just found out that the cleanup you were counting on costs $299. Switch if $79 a year for uncapped cleanup is the shape of the problem you have. Switch if you would rather your files were processed inside the EEA.

Do not switch if you look after client sites and MalCare's dashboard, white-labelling and uptime monitoring are how you work. Do not switch if your host is so tight on CPU that an on-server scan is a real cost.

What moving across involves

There is no settings import from MalCare. Segurium ships importers for Wordfence, All-In-One Security, Solid Security and Sucuri, and MalCare is not among them. You reconfigure by hand, and it takes about ten minutes.

1. Install Segurium from WordPress.org.
2. Accept the service disclosure. Nothing contacts our service before you do.
3. Re-enter the countries you had blocked, and any IP rules. There is a confirm-or-revert step on country blocking so you cannot lock yourself out.
4. Turn on two-factor authentication and pick a security-headers preset.
5. Run a full scan and an integrity scan.
6. Deactivate MalCare once you are happy with what you see.

If you use BlogVault for backups, leave it alone. It is a separate product and nothing here touches it.

What leaves your server, in plain terms

Scanning is opt-in. Until you accept the disclosure on the plugin page, Segurium does not contact our service and does not scan.

Files are checked by SHA-256 first. A file has its bytes sent in two cases: when its hash is one we have never seen, which in practice is about 6% of them, and when you clean it and we build the replacement. Everything else is settled by hash.

A cloud scanner that analyses your files on its own servers has to receive rather more than that, which is the trade you are making for the lighter load.

Samples we do receive are kept for up to 365 days and then deleted by an automated purge, and an analyst can delete one sooner once it has been triaged. Our privacy policy lists every retention period we hold to.

Our servers are in the European Economic Area and Segurium is run from Spain, so GDPR applies to us directly rather than reaching us through an adequacy decision. Two subprocessors sit outside the EEA, for payments and for support email. Both are covered by Standard Contractual Clauses and both are named in the privacy policy.

We do not track your visitors. Segurium looks at files and login attempts.

Questions

Does MalCare's free plan clean malware?

Their pricing page says cleanup is not included on Free, and not on the $99 Protect plan either. Cleanup starts on Repair at $299 a year, and they now say so themselves: 'The honest limit: Free detects malware; removal needs Repair or higher.' Their WordPress.org listing labels cleanups as paid in its feature table while other lines on the same listing still read unlimited hack cleanups. Both read on 19 August 2026. Check their pricing page before you decide.

MalCare scans off my server. Does Segurium slow my site down?

Segurium reads your files on your server, so it uses some CPU that MalCare does not. It hashes first and asks the service about the hash, and about 94% of files are answered without sending anything. Scans are chunked and run in the background, so you can close the tab. On a very constrained shared host, MalCare's model is still the lighter one.

Why is Segurium so much cheaper?

MalCare's price covers a cloud firewall, a site management dashboard, uptime monitoring and an agency toolset. Segurium runs none of that. You are paying for detection and cleanup and nothing else, which is why it is $79 instead of $299.

Can I import my MalCare settings?

No. Segurium has importers for Wordfence, All-In-One Security, Solid Security and Sucuri, and none for MalCare. You reconfigure by hand, which takes about ten minutes.

What happens if Segurium flags a file that is fine?

Nothing happens to the file until you click Clean, unless you turned on unattended fixing yourself, which is off by default. Every row carries two ways to silence it: Ignore until file is the same, which brings the row back if the file changes, and Always ignore for that path. Show malware prints the file so you can read it first. If you think the verdict itself is wrong, tell us from the Support tab or the WordPress.org forum.

What if I install it and it finds nothing?

Then you have a second opinion for free and you have lost twenty minutes. There is no card to enter and no trial to cancel.