Patchstack keeps the hole shut. Segurium cleans up what got in.

Where the line actually falls

Most comparisons on this site are about price. This one is about scope, and reading it the wrong way leaves you less protected rather than more.

• Patchstack answers "can this be exploited". They match the plugin, theme and core versions you have installed against their vulnerability database, and on a paid plan they push a rule that neutralises a specific hole without touching the vulnerable code. They are a CVE Numbering Authority and the database is free to browse. None of that is something we do or intend to do.
• Segurium answers "is something already in there". Every file on the server is checked by hash against a cloud database, and an infected file gets the injected code removed while the file keeps working. That is a question Patchstack does not ask. Their own FAQ says it does not scan your files like a malware scanner and will not help you find existing malware.

Both positions taken from Patchstack's own documentation and plugin listing, read on 19 August 2026.

What each free plan actually covers

Patchstack, free. Daily checks of your installed versions against their vulnerability database, with an email when one of them is affected, plus update management and optional automatic updates for vulnerable plugins. Their documentation is explicit that the free version only detects and notifies. It ships no firewall and no virtual patching. Protection starts at $5 a month per site.

Segurium, free. Hash-first scanning of every file, the same detection feed the paid plan reads, 3 cleanups every 30 days, unlimited integrity restores while a file is clean, two-factor authentication, brute-force protection, IP and CIDR firewall rules, country blocking and security headers.

Between them that is vulnerability alerting, file scanning, cleanup and the hardening set, for nothing, from two companies established in the EU. It is a better free stack than either product alone and neither of us loses anything by saying so.

One caveat worth your time. Patchstack's documentation and their WordPress.org listing both describe a plan called Personal, free, with three site slots. Their pricing page no longer sells it and instead points readers below fifteen sites at partners and resellers. Their surfaces disagree, both were read on 19 August 2026, and the plugin listing is the one to check before you plan around it.

What it costs over three years

Segurium Pro is the dearer of the two by $57 over three years. The free plan is $180 cheaper than theirs over the same period and reads the same detection feed Pro does. Segurium Pro lifts the cleanup ceiling and turns on unattended fixing, so a scheduled scan cleans without you opening the dashboard. Their $60 buys virtual patching, which is a capability we do not ship rather than a cheaper version of ours. Their Developer plan is $828 a year and covers 25 sites.

Why people go looking

The site is already hacked. This is the common one, and Patchstack answer it themselves rather than making you find out: their pricing page says the product will not help you find existing malware and recommends contacting your host or a professional. Somebody who arrives at a security plugin on the day their site starts redirecting needs the other kind of tool.

The hardening set is behind the paywall. Two-factor authentication, security headers, banned IP lists and brute-force protection are all paid-plan features there. Every one of them is free here. That is a real difference in what a free install gives you, and it is not a criticism of their pricing, which is aimed at agencies running twenty-five sites.

Country blocking went away. Their current settings documentation lists no country option, the old page for it now returns a 404, and the shipped plugin carries no geolocation code. An article from 2021 still describes the feature. If you configured it years ago, check whether it is still doing anything.

How the cleanup actually works

Segurium hashes every file on your server and checks each hash against a cloud database of known-good and known-bad files. Around 94% of your files are settled by the hash alone and never leave the server. A lookup takes about 24 milliseconds, which is why a full scan does not sit on your CPU for an hour.

Detection is not a paid tier. Free and Pro read the same feed at the same moment. The only thing money changes is how many files you may clean.

When a file comes back infected, you click Fix. For an injection into an otherwise-working file, Segurium fetches a cleaned version of that exact file, so your theme keeps rendering and your plugin keeps loading. A file that is nothing but malware becomes zero bytes at the same path. When no clean version can be produced, the cleanup stops and leaves the file exactly as it found it.

The original goes into an encrypted backup on your own server before any of that happens, and one click puts it back. You can look at the malware it removed before you decide.

Separately, an integrity scan compares every core, plugin and theme file against the canonical upstream copy of the exact version you have installed, and restores anything that drifted. While the file is clean that is unlimited on the free plan and never touches your cleanup count.

Bulk Fix All ships on every install, free, with a preflight preview so you can see exactly what it will touch before it touches anything. Pro at $79 a year lifts the cleanup limit and turns on unattended fixing.

Side by side

Patchstack prices, plan names and feature gates read from their own pricing page, documentation and plugin listing on 19 August 2026. Check them again before you decide, because they are theirs to change.

What Segurium does not do

Four things, and the first one is the reason this page exists.

• No virtual patching. Patchstack can neutralise a specific known vulnerability while the vulnerable plugin stays installed and unpatched. We cannot, and it is not on the roadmap. If you run a plugin the author has abandoned, or a client site you cannot update this quarter, that capability is the whole reason to pay them and dropping it would leave you exposed.
• No vulnerability database. We do not check your installed versions against known holes at all. Patchstack's database is free to browse whether or not you use their plugin, and they assign CVE identifiers as a Numbering Authority. Nothing here replaces that, which is exactly why the free pairing is the recommendation.
• No firewall in front of WordPress. Ours filters inside WordPress, after PHP has already accepted the request. Their mitigation engine runs inside the application too, so on that axis the two are alike, but neither is an edge firewall. A volumetric attack is your host's problem in both cases.
• No track record. Patchstack has been on WordPress.org since 2021 and holds 98 out of 100 across 61 ratings, which is the highest score in this comparison set. Segurium arrived in July 2026. The free plan exists so you can judge it on your own site rather than on our word.

Who should switch, and who should not

Almost nobody should switch, and that is the honest answer. Add Segurium and keep Patchstack. Their free plan tells you a plugin you run has a known hole, which is a question we never ask, and ours tells you whether something already got in, which is a question they never ask. Running both is free and there is nothing to disable on either side.

Pay them rather than us if the thing keeping you awake is an unpatched plugin you cannot remove. Virtual patching is the answer to that and we do not have one.

Pay us rather than them if the thing keeping you awake is what might already be sitting in your uploads folder, or if you want the hardening set without a subscription. Two-factor, security headers, IP rules and country blocking are free here and paid there.

What moving across involves

There is no settings import, because there is almost nothing to import. A free Patchstack install holds your site list and your notification preferences, both of which live in their dashboard rather than in your database.

If you are on a paid plan and dropping it, the things you set up there and will want again here are your IP rules, your two-factor enrolment and your security headers. All three are free on this side and take about ten minutes between them.

1. Install Segurium from WordPress.org.
2. Accept the service disclosure. Nothing contacts our service before you do.
3. Run a full scan and an integrity scan.
4. Turn on two-factor, set your security headers, and add any IP rules you were carrying.
5. Leave Patchstack installed. If you were paying for protection, decide that separately from this and not on the same afternoon.

What leaves your server, in plain terms

Scanning is opt-in. Until you accept the disclosure on the plugin page, Segurium does not contact our service and does not scan.

Files are checked by SHA-256 first. A file has its bytes sent in two cases: when its hash is one we have never seen, which in practice is about 6% of them, and when you clean it and we build the replacement. Everything else is settled by hash.

Patchstack take a different position on this: they say what happens on your site stays on your site, because they match version numbers rather than reading files. That is true and it is the trade-off. Answering whether a file is malicious means something has to look at the file, which is why about 6% of them are uploaded and why the retention periods below exist.

Samples we do receive are kept for up to 365 days and then deleted by an automated purge, and an analyst can delete one sooner once it has been triaged. Our privacy policy lists every retention period we hold to.

Our servers are in the European Economic Area and Segurium is run from Spain, so GDPR applies to us directly rather than reaching us through an adequacy decision. Two subprocessors sit outside the EEA, for payments and for support email. Both are covered by Standard Contractual Clauses and both are named in the privacy policy.

We do not track your visitors. Segurium looks at files and login attempts.

Questions

Can I keep the free Patchstack plan and add Segurium?

Yes, and for a lot of single-site owners that is the right answer. Their free plan emails you when a plugin you run turns out to have a known hole. Segurium checks whether something already got through and removes it if it did. The two never look at the same thing, so there is nothing to disable on either side and the pair costs nothing.

Does Segurium do virtual patching?

No, and it is not planned. Virtual patching means shipping a rule that neutralises a specific vulnerability without changing the vulnerable code, which needs a vulnerability research operation and a rule engine behind it. Patchstack has both. If a plugin you depend on has an unpatched hole and you cannot remove it, their paid protection is the tool for that and we have nothing equivalent.

Their free plan is free. What is the catch?

There is not one, but read what it covers. Their own documentation says the free version only detects and notifies you about vulnerabilities in the software versions you run. It ships no firewall, no virtual patching, no file scanning and no cleanup. Their paid protection starts at $5 a month per site. Checked on 19 August 2026.

Does Patchstack scan my files?

No. They match your installed plugin, theme and core versions against their vulnerability database. Their own answer to the question is that plugin-level malware scanners can be whitelisted by the malware itself and that they would rather prevent than detect, and they point you at network-level tools instead. It is a coherent position and it means nobody is looking at what is already in your uploads folder.

My site is already hacked. Will Patchstack help?

Their pricing page answers that directly: it does not scan your files like a malware scanner, will not help you find existing malware, and they recommend contacting your host or a professional. That is the case Segurium is built for. Install the free plugin and run one scan.

Are you both in the EU?

Yes. Patchstack is an Estonian company and Segurium is run from Spain, with servers in the European Economic Area. Neither of us reaches GDPR through an adequacy decision. If jurisdiction is what is driving your shortlist, this comparison does not separate us.