Sigil vs PW Security and Backup: Which Free WordPress Security Plugin Fits Your Site?

Who This Comparison Is For

Both Sigil and PW Security and Backup are free, newly published WordPress.org plugins that take a narrow, unbundled approach to a problem most security suites try to solve all at once. But they solve different narrow problems. Sigil is entirely focused on login authentication — passkeys, TOTP, backup codes, and email codes. PW Security and Backup is focused on server-side hardening and recovery — login attempt limiting, file integrity scanning, malware detection, and local ZIP backups. If you're trying to decide between them, the real question isn't "which is better" but "which layer of security are you missing?"

Pricing

There's no pricing decision to agonize over here — both are completely free with no premium tier, no add-on packs, and no license key gating any feature. Sigil is distributed under the GPL through the WordPress.org repository with passkey support included at no cost, which the guide notes is unusual since passkeys are typically reserved for paid plans elsewhere. PW Security and Backup is likewise fully free, with its entire feature set (login limiting, scanning, malware detection, backups) available with no paid tier existing at all. Neither plugin has a support contract beyond the wordpress.org forums.

Feature Comparison

The feature sets barely overlap, which is the point. Sigil adds four authentication factors to the login screen — passkeys via WebAuthn, TOTP authenticator apps, downloadable backup codes, and email fallback codes — plus role-based enforcement with grace periods and REST API routes for headless WordPress setups. It also works at the multisite network level, letting a network admin enforce a policy globally or delegate it per subsite.

PW Security and Backup, by contrast, doesn't touch authentication factors at all. It limits login attempts (brute-force protection), scans for file integrity changes and malicious code, and generates automated ZIP backups of the site and database — all stored locally on your own server with no telemetry sent externally. It has no WAF and no off-site backup storage, positioning it as a local-only, privacy-first alternative to cloud-connected security suites.

In short: Sigil hardens who can get into wp-admin. PW Security and Backup hardens what happens to the server and site files once someone's logged in, plus gives you a local fallback if something goes wrong.

	Sigil	PW Security and Backup
Price	Free, GPL, no premium tier	Free, no premium tier
Best for	Sites needing passkey/2FA login enforcement, including headless WordPress	Privacy-conscious freelancers/agencies wanting local-only hardening and backups
Standout feature	Role-based 2FA enforcement with grace periods, plus REST API routes for decoupled auth	Local ZIP backups and scanning with zero telemetry sent externally
Platform	WordPress (single-site and multisite/network-level)	WordPress (standard single-site install flow)
What it doesn't do	No file scanning, malware detection, or backups	No 2FA/passkey login protection, no WAF

Setup Experience

Both install in the standard WordPress way with no forced upsell wizard. Sigil's setup is role-by-role toggling from Settings → Sigil, which the guide notes can get tedious on a multisite network with many roles, though it also offers a [sigil_enroll] shortcode for front-end enrollment without touching wp-admin. Passkey registration specifically requires HTTPS. PW Security and Backup's setup is fully manual too — you set login thresholds and backup frequency yourself, with no onboarding wizard, since there's no paid tier to funnel you toward.

Which Should You Choose?

If your priority is stopping account takeovers — especially for Administrator and Editor roles, or you're running a membership site, LMS, or headless WordPress front end — Sigil is the direct fit, and its multisite-aware, role-based enforcement is more granular than most plugins bother with.

If your priority is hardening the server itself and having a fast local restore point, particularly because you have data residency concerns or simply don't want scan results and backups phoning home to a vendor's cloud, PW Security and Backup is built exactly for that, though it explicitly isn't a substitute for a real WAF or off-site disaster-recovery backups.

Agencies and freelancers managing multiple client sites may well end up wanting both: Sigil locking down who can log in, and PW Security and Backup watching the files and generating local backups underneath it. Neither plugin overlaps with the other's core job, so running them together doesn't create redundancy — it just closes two different gaps at zero added cost.