Companies Using iThemes Security

iThemes Security is the hardest kind of product for a crawler: a security plugin whose best features happen where we can't look. A domain counts here when a page loads files from the plugin's folder, /wp-content/plugins/better-wp-security/. Our October 2026 crawl finds 1,564 live domains like that, 1,099 of them matched to a company, 8th of 18 in WAF & DDoS Protection. WordPress.org reports more than 700,000 active installations. So the first job is to explain what the 1,564 are.

Three names, one folder

The plugin launched on WordPress.org in 2010 and is still maintained; its page was last updated on 14 October 2026, at version 10.0.6. Its changelog records the renames. Version 9.0.0, tagged in October 2023, announced that iThemes Security was now Solid Security. Version 10.0.0, tagged in May 2026, changed the branding from SolidWP to Kadence. The folder never changed, which is why we still track it under the iThemes name: most searchers still use it. The old solidwp.com/security address now redirects to Liquid Web's Kadence pages, where Kadence Pro ($299 a year) and Elite ($499) include Kadence Security with Pro features such as Patchstack virtual patching.

Sales signal: two renames in three years leave buyers unsure who supports their plugin. A WordPress care plan or a security vendor can open with that question.

Which files we see

I sampled 60 random domains from the clean set. 47 loaded, and all 47 carried the plugin's files. 46 loaded its tab-napping protection script from the WordPress Tweaks module; the other loaded a strong-passwords script. Nothing else in the plugin left a mark. Brute-force protection, two-factor and the firewall run on the server and the login page. The rule also reads only the free plugin's folder. Pro installs live in ithemes-security-pro, and since version 9.4.4 the free and Pro plugins can't run together, so a Pro site drops out of our count entirely. One thing works in the signal's favour: WordPress only loads a plugin's files while the plugin is active, so unlike a pasted tracking tag, this marker doesn't outlive an uninstall, unless a page cache keeps serving an old copy.

Sales signal: every domain here runs the free edition. That makes the list an upgrade list for the vendor and a switching list for competing security plugins.

Flat since July

The chart reads 1,434 in June, 1,568 in July, 1,550 in August, 1,562 in September and 1,564 in October. The step into July reflects our crawl covering more domains, which also turn over every month, and our detection widening. Since March 2026, 310 domains dropped the files, and 31 of those still show them on another hostname. The script addresses we sampled carried version numbers from 4041 to 4122, while the current release, 10.0.6, is build 4130, so many sites run a release or two behind.

"This page counts the sites where one optional tweak is switched on. The plugin itself is on far more WordPress sites than any crawler can prove." - Mehmet Suleyman, CEO & Co-founder at TechnologyChecker.io

Sales signal: treat 1,564 as a sample of a much larger installed base. The companies on it are real users with the plugin active today.

Small businesses with older sites

69.67% of matched companies with a known size have 1 to 10 employees and 21.93% have 11 to 50. Nearly half, 48.99%, were founded in the 2010s, and only 4.03% in the 2020s. Construction (5.81%) and Real Estate (5.7%) lead the industries, ahead of Medical Practices (3.62%) and Hospitality (3.18%). The named users fit: Champion Installs, Industrial Scaffold Services, The Chateau Spa and Wellness Resort, Cuba's Clínica Central Cira García. Ellsworth Corporation runs the plugin on its careers site, Diffusion, the London PR agency, on its main site, and Catcote Academy, a special school in Hartlepool, on its homepage.

Sales signal: the buyer is the owner or the agency that maintains the site. Lead with maintenance and peace of mind.

The US and, unexpectedly, Spain

The United States has 220 matched companies. Spain is second with 129, ahead of the United Kingdom (92), Australia (86) and France (70). I looked for a Spanish host or agency behind it and found none: the 59 .es domains in the clean set are spread across many servers, the largest holding six.

Sales signal: Spain is a real market for this plugin. A Spanish-language WordPress security or maintenance offer has a list to start from.

Rivals inside and outside WordPress

We publish no switching rows for iThemes Security. Its direct rivals are other plugins, Wordfence first, and hosted firewalls such as Sucuri that filter traffic before WordPress runs. In our table those hosted services look enormous next to the plugin, because a proxy shows on every page and a plugin mostly doesn't.

"Comparing a WordPress plugin with a proxy firewall on crawl counts is like counting cars by the ones parked on the street. You'll undercount everyone with a garage." - Mehmet Suleyman, CEO & Co-founder at TechnologyChecker.io

Sales signal: for a hosted firewall vendor, these sites already think about security but rely on a free plugin. That's a clear upgrade conversation.

The stack

WordPress is on every domain we could profile. WPBakery (10.05%), Elementor (9.4%) and Divi (5.96%) are the main builders. Apache serves 41.54%, Nginx 19.44% and LiteSpeed 16.98%, and Cloudflare fronts 20.29%, so about one site in five already puts a proxy in front of the plugin. Google Analytics is on 51.65% and MonsterInsights on 4.86%.

Sales signal: the four sites in five without Cloudflare are the natural audience for a hosted firewall or CDN offer, and page-builder sites are a good fit for maintenance retainers.

Key takeaways

1. 1,564 live domains, 8th of 18, against more than 700,000 active installs: a floor, not a census.

2. The signal is mostly the tab-napping script, and only the free plugin's folder.

3. Renamed Solid Security in 2023 and Kadence Security in 2026.

4. Small, established businesses, led by construction and real estate, with Spain unusually strong.

How to use this list

Filter by country and industry, and remember every row runs the free edition. For the full list of 1,564 iThemes Security domains with company, size and stack data, explore TechnologyChecker.io.