NinjaFirewall is two plugins, and neither one cleans an infected file

What you get here that they do not ship at any price

• A cleanup step. NinjaScanner has no repair routine. Its per-file actions are Restore file, Quarantine file and Ignore file, and Restore rebuilds from the WordPress.org package. Segurium takes the injected code out of the file you have and writes the cleaned version back, 3 files every 30 days on the free plan.
• Two-factor authentication. Neither NinjaFirewall edition ships it. Their answer to login attacks is brute-force protection, which is a good answer and a different one. Free here, with TOTP, email fallback, backup codes and trusted devices.
• Country blocking and IP rules. Both sit in WP+ at $89 a year per domain. Both are free here, and country blocking has a confirm-or-revert step so a mistake cannot lock you out of your own admin.
• One plugin instead of two. The firewall and the scanner are separate products with separate licences on their side. Scanning, cleanup, hardening and the firewall are one install here.

Security headers are free in both products, and NinjaFirewall's free set covers Content-Security-Policy and Strict-Transport-Security. Both also ship brute-force protection and file integrity monitoring at no cost. Read from the vendor's shipped plugin code and pricing page on 19 August 2026.

What it costs over three years

On one site, that is $30 back over three years if you take Pro, or $267 if the free plan covers you. WP+ buys country and IP access control, rate limiting and bot filtering, which is depth in the firewall rather than malware coverage. NinjaScanner Premium, which adds scheduled scans and WP-CLI, is a further $29 a year per domain.

Why people go looking

NinjaFirewall stopped scanning on purpose. Open the Anti-Malware menu in version 4.9 and the whole page reads: "Oops...! We have removed the Anti-Malware from NinjaFirewall. Instead, we have now a brand new and much better antivirus plugin:" followed by a link to NinjaScanner. That is a defensible split. It also means the plugin you installed for security is not looking at your files.

NinjaScanner restores from upstream or quarantines. Their words on the integrity checker: "The File Integrity Checker will compare your WordPress core files as well as your plugin and theme files to their original package... Infected or corrupted files can be easily restored with one click." The sources are downloads.wordpress.org, the plugin SVN and the versioned core ZIP. When the infected file is a custom theme template, a paid plugin or anything hand-written, no package exists to restore from. What is left is Quarantine, and quarantining a template your pages call is a white screen.

The best firewall mode needs a server change. Full WAF mode writes auto_prepend_file into your php.ini or .user.ini, or a php_value auto_prepend_file line into .htaccess. It backs up the original first and needs no root, so it works on plenty of shared hosting. The vendor is straight about the rest: "It works on most websites right out of the box, or may require some very little tweaks. But in a few cases, mostly because of some shared hosting plans restrictions, it may simply not work at all." They warn Docker users the site may crash, and the plugin does not support Microsoft Windows. The fallback, WordPress WAF mode, loads as a must-use plugin and stays good; their own line is that it "offers a level of protection and performance much higher than other security plugins".

Quotations read from NinjaFirewall 4.9 and NinjaScanner 3.3.1 as shipped, on 19 August 2026.

How the cleanup actually works

Segurium hashes every file on your server and checks each hash against a cloud database of known-good and known-bad files. Around 94% of your files are settled by the hash alone and never leave the server. A lookup takes about 24 milliseconds, which is why a full scan does not sit on your CPU for an hour.

Detection is not a paid tier. Free and Pro read the same feed at the same moment. The only thing money changes is how many files you may clean.

When a file comes back infected, you click Fix. For an injection into an otherwise-working file, Segurium fetches a cleaned version of that exact file, so your theme keeps rendering and your plugin keeps loading. A file that is nothing but malware becomes zero bytes at the same path. When no clean version can be produced, the cleanup stops and leaves the file exactly as it found it.

This is the difference against NinjaScanner. Their flow ends at three buttons: Restore file, which needs an upstream package; Quarantine file, which moves the code out of the tree and leaves whatever depended on it broken; and Ignore file. Segurium's flow ends with the file still in place and still working, minus the injection.

The original goes into an encrypted backup on your own server before any of that happens, and one click puts it back. You can look at the malware it removed before you decide.

Separately, an integrity scan compares every core, plugin and theme file against the canonical upstream copy of the exact version you have installed, and restores anything that drifted. While the file is clean that is unlimited on the free plan and never touches your cleanup count. NinjaScanner's File Integrity Checker does this job free as well, so treat it as a draw.

Bulk Fix All ships on every install, free, with a preflight preview so you can see what it will touch before it touches anything. Pro at $79 a year lifts the cleanup limit and turns on unattended fixing, so a scheduled scan cleans without you opening the dashboard.

Side by side

The NinjaFirewall column mixes two products: rows about scanning, restoring and scheduled scans describe NinjaScanner, which you install separately. Prices and ratings read from the vendor's pricing page and api.wordpress.org on 19 August 2026. Check them again before you decide, because they are theirs to change.

What Segurium does not do

Read this before you change anything, rather than after.

• No firewall in front of WordPress. In Full WAF mode NinjaFirewall runs through auto_prepend_file, so it sees a request before WordPress boots and it covers non-WordPress PHP sitting in the same tree. Ours runs inside WordPress and filters requests PHP has already accepted. Theirs is the better design for that job and we are not asking you to give it up.
• Nothing reaches NinTechNet, and hashes do reach us. Their privacy policy says it plainly: "We, NinTechNet Limited, do not process any personal data whatsoever. What happens on your server stays on your server". Segurium sends a SHA-256 for every file, and the file body in two cases. On that axis their position is stronger and you should weigh it. What we offer against it is jurisdiction: our servers are in the EEA and Segurium is run from Spain, so GDPR applies to us directly. NinTechNet Limited is registered in Hong Kong and their terms put any dispute in front of Hong Kong courts, while their own servers sit in Germany and France.
• No rate limiting, bot filtering or response body filtering. All three are WP+ features. Our brute-force protection covers login attempts and stops there. We also ship no curated IP blocklist, so you write your own IP and CIDR rules and nothing arrives pre-filled.
• No blocklist monitoring. NinjaScanner queries the Google Safe Browsing API and tells you if your site is flagged. We check no blocklist.
• No vulnerability scanning, no virtual patching, no audit log. We do not match your plugin versions against a CVE database and we do not shield a known hole while you wait for the author's fix. NinjaFirewall ships event notifications free and centralised logging in WP+; we have no audit log today.
• No CDN, no DDoS protection, and nobody on call. Neither product offers the first two, and they normally arrive from your host or your CDN, so this costs you less than a bare "No" suggests. We also have no backups product, no staging and no uptime monitoring, and nobody at Segurium logs into your site, ever.
• No track record. NinjaFirewall has been on WordPress.org since 2013, with 100,000 active installs and the highest rating in this comparison set. Segurium arrived in July 2026 with two ratings. The free plan exists so you can judge it on your own site rather than on our word.

Who should switch, and who should not

Keep NinjaFirewall. Replace NinjaScanner. That is the honest recommendation and it costs nothing to test: the firewall you already trust stays where it is, and Segurium takes over detection and cleanup. Turn NinjaScanner's scans off once you are happy, so you are not scanning the same files twice.

Do the swap if an injection has ever landed in a custom theme file and Quarantine was the only button that applied. Do it if you want two-factor authentication without a third plugin, or if country blocking and IP rules are the reason you were looking at the $89 WP+ licence.

Do not do it if you need rate limiting, bot filtering or response body filtering, because those are WP+ features with no equivalent here. Do not do it if your rule is that nothing about your site may reach a third-party service, because NinTechNet meets that rule and we do not.

What moving across involves

Nothing imports. No migration adapter exists for NinjaFirewall or NinjaScanner, so anything you want on this side you set by hand. Keep the firewall running, which is what we suggest, and the list is short.

What you re-enter yourself:

• Scan exclusions, if you had any in NinjaScanner.
• Blocked countries and blocked IP addresses, if you were on WP+.
• Security header values, if you tuned them away from the defaults.
• Two-factor enrolment, which is new because NinjaFirewall has none.

1. Install Segurium from WordPress.org. Leave NinjaFirewall alone.
2. Accept the service disclosure. Nothing contacts our service before you do.
3. Run a full scan and an integrity scan.
4. Compare the result against your last NinjaScanner report.
5. Set your firewall rules, headers and two-factor.
6. Turn off NinjaScanner's scans, or deactivate that plugin.

What leaves your server, in plain terms

Scanning is opt-in. Until you accept the disclosure on the plugin page, Segurium does not contact our service and does not scan.

Files are checked by SHA-256 first. A file has its bytes sent in two cases: when its hash is one we have never seen, which in practice is about 6% of them, and when you clean it and we build the replacement. Everything else is settled by hash.

NinjaScanner answers the same question differently: its LMD and ClamAV signature sets ship inside the plugin, so matching happens on your disk, and its outbound URL check goes to the Google Safe Browsing API. That design sends less. It also knows only what the last plugin update taught it, while a hash lookup asks at scan time.

Samples we do receive are kept for up to 365 days and then deleted by an automated purge, and an analyst can delete one sooner once it has been triaged. Our privacy policy lists every retention period we hold to.

Our servers are in the European Economic Area and Segurium is run from Spain, so GDPR applies to us directly rather than reaching us through an adequacy decision. Two subprocessors sit outside the EEA, for payments and for support email. Both are covered by Standard Contractual Clauses and both are named in the privacy policy.

We do not track your visitors. Segurium looks at files and login attempts.

Questions

Should I uninstall NinjaFirewall?

No. Keep it, in Full WAF mode if your host allows that mode. It filters requests before WordPress loads, which Segurium cannot do. The half worth replacing is NinjaScanner, because that is the half with no cleanup step.

NinjaScanner already finds malware. What does Segurium add?

The step after detection. NinjaScanner offers Restore file, Quarantine file or Ignore file. Restore rebuilds the file from its WordPress.org package, so it works whenever the file came from there. Segurium removes the injected code from the file you have and writes the cleaned version back, which is the answer that still applies when the file never had an upstream package.

What does quarantine actually leave me with?

The file moves to wp-content/ninjascanner/<random>/quarantine/ and stays there until you restore or delete it, because their garbage collector does not flush that folder. NinjaScanner sandboxes the move first and warns you if removing the file would fatal your site, which is careful design. It still means the code is gone rather than fixed, so whatever needed that file stops working.

Is Segurium's firewall as good as NinjaFirewall's?

No. In Full WAF mode NinjaFirewall loads through auto_prepend_file, before WordPress and before your plugins, and it covers non-WordPress PHP scripts in the same directory tree. Ours runs inside WordPress and filters requests PHP has already accepted. Theirs is better positioned and you should keep it.

NinTechNet says nothing reaches their servers. Segurium sends hashes. Why accept that?

Because it buys a verdict you never had to download. NinjaScanner matches signature sets that ship inside the plugin and queries the Google Safe Browsing API for URLs. Segurium sends a SHA-256 per file, and about 94% of your files are settled by that hash and never leave the server. Bytes go up in two cases: a hash nobody has seen before, and a cleanup, where the file body is what the replacement is built from. If sending nothing at all is your rule, NinTechNet meets it and you should stay.

Will my NinjaFirewall settings come across?

None of them. There is no importer for either plugin. You re-enter what you want by hand, and there is little of it if you keep NinjaFirewall running.

What if I install it and it finds nothing?

Then you have a second opinion from a different engine for free. There is no card to enter and no trial to cancel.