via pluginvulnerabilities.com => original post link
When it comes to the developers of WordPress security plugins, they shouldn’t be creating the insecurity they are supposed to be protecting against. That unfortunately is true of the current and former developers of the very popular All-In-One Security (AIOS) plugin. It has been such an issue with the new developer that we released an advisory warning against using their plugins until and unless they could show they have gotten a handle on security. So when it comes to the question of using All-In-One Security (AIOS) or Wordfence Security, our advice would be to not use All-In-One Security (AIOS). But let’s say you still want to consider it. Then the most important thing to know about WordPress firewall plugins is the amount of protection they offer against real threats, which we are somehow the only ones that do testing that would measure that.
Since 2021, we have done 16 tests of a large group of WordPress security plugins to see if they would protect against real vulnerabilities that had existed in other plugins. In those tests, All-In-One Security (AIOS) provided protection in only two of the tests. Wordfence Security did somewhat better, providing protection in six. [Read more]