Solid Security never scanned your files. Segurium does, free.

What you do not get there and get free here

• A scanner that reads the file. Their Site Scanner checks whether your plugin versions have known vulnerabilities. It never opens the file to judge the code inside it. If something already got in, that difference is the whole ballgame.
• Removal. There is no button anywhere in Kadence Security that takes an infection out. Segurium removes it on the free plan, 3 files every 30 days.
• A firewall you configure yourself. Allow and deny rules for single IPs and CIDR ranges, in the plugin, free. Their firewall arrives with the $299 bundle.
• Country blocking that lives in your database. Free, with a confirm-or-revert step so you cannot lock yourself out. Solid Security keeps country rules in its cloud dashboard, which is also why they cannot be exported.
• Security headers. Three presets plus custom values, free. Their plugin description does not list this.

Both products ship two-factor authentication, brute-force protection and file-change detection at no cost. Checked against their own WordPress.org description and Liquid Web's pricing on 7 August 2026.

What it costs over three years

On one site, that is $660 back over three years if you take Pro, or $897 if the free plan covers you. Their $299 also buys a theme, a page builder, a WooCommerce kit and memberships, so this is only a fair comparison if security is what you were shopping for.

Why people go looking

The name changed twice. iThemes Security became Solid Security, and Solid Security is now Kadence Security under Liquid Web. The plugin, the slug and the 700,000 installs carried across. The old solidwp.com security page redirects to Liquid Web.

The standalone licence went with it. Kadence Security is listed as included with the Kadence Pro bundle at $299 a year. The $99 Essentials tier is a theme and a block library with no security in it. If you only ever wanted the security plugin, the smallest package that still contains it also contains a page builder, a WooCommerce kit and a memberships system.

It stops at the door. Their scanner checks for known vulnerabilities in core, plugins and themes, four times a day on the free plan and hourly on Pro. It queries Google Safe Browsing. It logs which files changed. What it does not do is open a file and judge the code inside it, and there is no button anywhere that removes an infection. If the break-in already happened, the product has nothing to say about it.

How the cleanup actually works

Segurium hashes every file on your server and checks each hash against a cloud database of known-good and known-bad files. Around 94% of your files are settled by the hash alone and never leave the server. A lookup takes about 24 milliseconds.

Separately, an integrity scan compares every core, plugin and theme file against the canonical upstream copy of the exact version you have installed. Where Solid Security tells you a file changed, Segurium tells you what it should contain and puts it back. Free and uncapped while the file is clean.

When a file comes back infected, you click Fix. For an injection into an otherwise-working file, Segurium fetches a cleaned version of that exact file, so your theme keeps rendering and your plugin keeps loading. A file that is nothing but malware becomes zero bytes at the same path. When no clean version can be produced, the cleanup stops and leaves the file exactly as it found it.

The original goes into an encrypted backup on your own server before any of that happens, and one click puts it back. You can look at the malware it removed before you decide. Nothing about a cleanup is one-way.

Bulk Fix All ships on every install, free, with a preflight preview so you can see exactly what it will touch before it touches anything. Pro at $79 a year lifts the cleanup limit and turns on unattended fixing, so a scheduled scan cleans without you opening the dashboard.

Side by side

Kadence prices checked at liquidweb.com on 7 August 2026. Check them again before you decide, because they are theirs to change.

What Segurium does not do

Four things, and on this comparison they matter more than on any other page here, because the two products barely overlap.

• No vulnerability scanning. Their Site Scanner tells you that the plugin you are running has a known hole, four times a day on the free plan. We never look at that. If you drop them entirely you lose this, and it is worth keeping.
• No virtual patching. Patchstack on their Pro tier shields a known vulnerability before the plugin author ships a fix. That is a genuinely different kind of protection and we have no equivalent. We find the code that got in. They stop a known hole being used at all.
• No blocklist check. If Google flags your domain, their scanner picks it up. With Segurium you would find that out yourself.
• Shallower login hardening, and no track record. Login security is their entire product: user security checks, password policies, setup templates by site type, and a brute-force network drawing on close to a million sites. Ours is solid and narrower. They have been on WordPress.org since 2010 with 700,000 installs and 92 out of 100 across nearly 4,000 ratings; we arrived in July 2026 with none.

Which is why the recommendation on this page is to run both rather than replace. Nothing in Segurium conflicts with Kadence Security, and the free plans of both cost nothing together.

Who should switch, and who should not

Switch if your site is infected right now, because this is the gap between the two products and it is not a small one. Switch if the $299 bundle is more product than you wanted for the security you were actually buying.

Do not drop them if virtual patching is why you pay, or if the brute-force network is doing visible work on a site that gets hammered. Add Segurium instead.

What moving across involves

Segurium detects an existing Solid Security install and offers to import from it. It takes less than the Wordfence importer does, and it says so before it writes anything.

Imported for you:

• Your banned IP addresses, merged with any rules you already have.

Two-factor and brute-force settings are not imported yet. Country blocking cannot be imported at all, because Solid Security keeps those rules in its cloud dashboard rather than in your WordPress database, so there is nothing local to copy.

1. Install Segurium from WordPress.org.
2. Accept the service disclosure. Nothing contacts our service before you do.
3. Open the Migration tab, review what it found, and apply it.
4. Re-enter the countries you had blocked. There is a confirm-or-revert step so you cannot lock yourself out.
5. Turn on two-factor authentication and pick a security-headers preset.
6. Run a full scan and an integrity scan.
7. Keep Solid Security if you want the vulnerability scanning and virtual patching. Nothing here conflicts with it.

What leaves your server, in plain terms

Scanning is opt-in. Until you accept the disclosure on the plugin page, Segurium does not contact our service and does not scan.

Files are checked by SHA-256 first. A file has its bytes sent in two cases: when its hash is one we have never seen, which in practice is about 6% of them, and when you clean it and we build the replacement. Everything else is settled by hash.

Samples we do receive are kept for up to 365 days and then deleted by an automated purge, and an analyst can delete one sooner once it has been triaged. Our privacy policy lists every retention period we hold to.

Our servers are in the European Economic Area and Segurium is run from Spain, so GDPR applies to us directly rather than reaching us through an adequacy decision. Two subprocessors sit outside the EEA, for payments and for support email. Both are covered by Standard Contractual Clauses and both are named in the privacy policy.

We do not track your visitors. Segurium looks at files and login attempts.

Questions

What happened to Solid Security?

It was iThemes Security, then Solid Security, and it is now Kadence Security under Liquid Web. Same plugin, same WordPress.org slug, same 700,000 installs. The old solidwp.com security page redirects to Liquid Web's Kadence pages.

Can I still buy the security plugin on its own?

Not as far as their pricing shows. Kadence Security is listed as included with the Kadence Pro bundle at $299 a year and the Elite bundle at $499. Essentials at $99 is the theme and blocks with no security in it.

Does Solid Security scan for malware?

It scans for known vulnerabilities in your core, plugins and themes, and it checks your domain against Google Safe Browsing. It logs file changes. None of that reads the contents of a file to decide whether the code inside it is malicious, and the product has no removal step.

So do I need both?

Quite possibly, and that is a fair answer rather than a sales dodge. Their login hardening and Patchstack virtual patching cover ground Segurium does not touch, and Segurium covers the file layer they do not. The two do not conflict.

Will my Solid Security settings come across?

Your banned IP addresses will. Two-factor and brute-force settings are not imported yet, and country blocking cannot be, because Solid Security keeps that in its own cloud dashboard rather than in your database.

What if I install it and it finds nothing?

Then you have checked something Solid Security never looked at, for free, in twenty minutes. There is no card to enter and no trial to cancel.