Imunify360 protects our servers from outside WordPress, so ordinary security plugins run alongside it. What's worth adding inside WordPress is two-factor login, an activity log and off-site backups. A full firewall-and-scanner suite such as Wordfence also works, but it mostly repeats what Imunify360 already does.
Imunify360 runs on the server, outside WordPress. It scans files for malware and filters attacks on every Tremhost web hosting plan, reseller account and managed cPanel VPS. A plugin works inside WordPress, so the two don’t compete for the same job.
| Plugin type | Worth adding? | Examples |
|---|---|---|
| Two-factor login for admins | Yes, the most useful addition | Two Factor (from WordPress.org), Wordfence Login Security |
| Activity log | Yes, for sites with several editors | WP Activity Log, Simple History |
| Off-site backups | Yes | UpdraftPlus, to Google Drive or Dropbox |
| Login attempt limits | Optional | Limit Login Attempts Reloaded |
| Full firewall and malware scanner | Optional; mostly repeats Imunify360 | Wordfence, Solid Security, Sucuri Security |
If you do install a full suite
- Use only one. Two security suites on one site slow it down and block each other.
- Schedule its scans for quiet hours rather than running them constantly. Scans use your account’s resources.
- If your site is behind Cloudflare, set the plugin to read the visitor’s real IP from Cloudflare’s header. Otherwise it may block Cloudflare instead of the attacker.
- If it locks you out, or Imunify360 blocks your office, see The firewall blocked my IP address. What do I do?
What matters more than any plugin
- Keep WordPress, plugins and themes updated, and delete the ones you don’t use.
- Never install “nulled” (pirated) premium plugins. They are a common way sites get hacked.
- Give every person their own login, with the lowest role they need. Don’t use
adminas a username. - For a firewall in front of the site, Armor Guard puts Cloudflare Pro protection there for $9 a month. Managed WordPress includes Cloudflare Pro and malware removal.
Tip: Turn on two-factor login for your Tremhost client area and cPanel too. Whoever gets into those can reach every site on the account.
Not sure what your site needs? Ask us on WhatsApp.
Updated 6 November 2026. Something here out of date? Tell us.