Lean Security
for WordPress

Nope. We obsess over WordPress performance. ArmorPro adds roughly 15ms to page load time and runs just 2 database queries. It's built to be lightweight from the ground up—the way WordPress security plugins should be.

Yes! ArmorPro plays nicely with WP Rocket, W3 Total Cache, LiteSpeed Cache, and pretty much every WordPress caching solution out there. We've tested extensively to make sure there are no conflicts.

ArmorPro includes a string-matching firewall with 600+ patterns across 5 categories and per-pattern management, plus an Enhanced Firewall (WAF) mode that runs before WordPress loads with ~1ms overhead. Also includes brute force protection with IP logging, security headers management (including HSTS, CSP, and Permissions-Policy), REST API protection, activity logs, two-factor authentication (TOTP), passkey authentication (WebAuthn/FIDO2), country blocking, custom login URL, email notifications, auto-blacklisting of repeat offenders, and CSV export. All features are included in every tier.

ArmorPro uses a string-matching firewall with 600+ patterns across 5 categories: SQL injection and malicious query strings, dangerous request URIs (shell files, config access, exploit paths), known malicious user agents (120+ scanners, scrapers, attack tools), spam referrers, and IP address patterns. Each pattern can be individually enabled or disabled through the Pattern Manager with hit counts. You can also add your own custom patterns. The Enhanced Firewall (WAF) mode runs as a standalone PHP engine before WordPress loads via auto_prepend_file, adding only ~1ms of overhead. It also blocks XML-RPC requests and enforces REST API authentication.

ArmorPro includes TOTP-based two-factor authentication for WordPress that works with any authenticator app (Google Authenticator, 1Password, Authy, etc.). Each WordPress user sets up 2FA from their profile with a QR code scan. Backup codes are provided for account recovery. Admins can require 2FA for specific WordPress user roles.

Passkeys are a modern, passwordless authentication method using the WebAuthn/FIDO2 standard. Instead of typing a password, users authenticate with Face ID, Touch ID, Windows Hello, or a hardware security key. Passkeys are phishing-resistant since they're bound to the specific website and can't be reused elsewhere. Each user can register multiple passkeys (up to 10) from their profile page.

Yes. ArmorPro, CitedPro, and BoostPro are free to download and use, with every feature switched on. No trial period, no locked panels, no site limits, and no upgrade nags. The only thing you can pay us for is the optional SRWorks AI subscription.

AI content generation in CitedPro (meta descriptions, schema, llms.txt), AI performance recommendations in BoostPro, a higher PageSpeed testing allowance, priority email support, and every AI feature we add later. One key covers both plugins. Everything else in the plugins works without it, and if you would rather bring your own AI provider you can do that instead — the subscription is the option for people who want it handled.

Everything except AI generation. The full SEO suite, sitemaps, schema, llms.txt, AI bot tracking, page caching, image optimization, unused CSS removal, the firewall, two-factor authentication, passkeys, country blocking, and every other feature works with no subscription. BoostPro's PageSpeed score is free too. ArmorPro has no AI features at all, so it never needs one. On WordPress 7.0 or later you can also run the AI features on your own connected AI provider instead of subscribing — see below.

Yes. WordPress 7.0 added a built-in AI Client, and if you connect your own provider — Anthropic, OpenAI or Google — under Settings → Connectors, the AI features in BoostPro and CitedPro use it automatically. No subscription, no key from us, and you pay your provider directly for what you use. SRWorks AI is there for people who would rather not open an API account and manage billing with a model provider; if you already have one, use it. If you have both, the subscription takes precedence, so your own provider is never charged for something you have already paid us for. Requires WordPress 7.0 or later — on earlier versions the subscription is the only option.

One test a day per site, plus an automatic test every week. With SRWorks AI that becomes ten a day and an automatic test daily. The limit exists because Google gives us a fixed number of PageSpeed requests per day shared across every BoostPro install, and it cannot be bought in larger amounts — rationing it is what lets us give the score away instead of charging for it. Re-testing the same page is served from cache and does not count against your allowance.

Yes. SRWorks AI is a single subscription that unlocks the AI features in CitedPro and BoostPro, plus every AI feature we add later. One key, one renewal, no per-plugin maths.

Yes. Personal covers 1 site, Business covers up to 5, and Agency covers up to 100. All three tiers unlock exactly the same AI features. You can upgrade at any time and only pay the prorated difference.

The plugins keep working exactly as before, forever. You lose access to the AI generation features until you renew, and nothing else changes. Your settings, logs, and generated content are never touched.

Because the cost is ongoing. Every AI generation is a request we pay for, so a one-time fee would mean either capping your usage hard or losing money on the people who get the most value. An annual subscription keeps it honest in both directions.

We use Polar as our merchant of record, powered by Stripe for secure payment processing. You can pay with all major credit cards (Visa, Mastercard, American Express, Discover) or PayPal. All transactions are encrypted and PCI compliant.

Absolutely. You're fully protected by our 30-day money-back guarantee. If you're not happy, we'll refund your purchase—no questions asked. See our refund policy for full details.

Yes! Earn 20% commission for the first 12 months of any referred SRWorks AI subscription and 10% on every renewal after that. It's free to join with no approval wait times. Visit our affiliates page to learn more and sign up.