Jetpack Security
- Real-time cloud backups plus a daily full backup that took under 2 minutes
- Partial restore: themes, plugins, database, or uploads on their own
- Scan alerts name the flaw and the fixed version
- One dashboard for backups, scans, spam, and the activity log
- Free if your host includes it, as Pressable does
- The 10GB cap keeps only 7 days of backups on my site
- Premium plugins like WP Rocket need a manual update
- Needs a free WordPress.com account
- Overlaps with host features like a firewall
- I haven’t tested a restore yet
What Does Jetpack Security Do?
Jetpack plugin is built by Automattic (the company behind WordPress.com). The core Jetpack plugin is free to use, and Jetpack Security is one of its paid plans. It adds three products on top:
- VaultPress Backup: real-time cloud backups with a one-click restore option.
- Jetpack Scan: real-time malware scanner that looks for modified WordPress core files and known plugin vulnerabilities.
- Akismet Anti-spam: filters spam comments and form submissions.
- WAF: active firewall rules for WordPress security.
My Jetpack Security subscription came bundled with the Pressable hosting plan.
I tested all four Jetpack plugin’s premium features on this site. I cover how Jetpack cloud backups, malware scans, and spam filter behave on a live site. What the plan costs and whether Jetpack slows down my WordPress site.
I’ll show my website speed test results with the Jetpack plugin on and off. By the end, you’ll know whether the Jetpack Security plan is worth paying for, or use it (if your host already covers it).
Here’s my website configuration:
- Plan: Jetpack Security v16.3.1
- Hosting: Pressable Signature 1
- Site Config: WordPress v7.1.3 with PHP v8.5
- Site Content: 0.4GB (15 plugins, 2 themes, 9,078 uploads, 63 posts, 8 pages)
- Cache: WP Rocket
- CDN: WP Cloud by Pressable
VaultPress Backup: Does Jetpack Backup in Real Time?
Yes. Jetpack VaultPress Backup takes real-time snapshots of my site as I make changes.
It takes a daily full backup and runs automatically on Jetpack’s cloud servers (without using my server resources). My site’s total file size is 0.4GB, and Jetpack completes a full backup process in under 2 minutes.
Jetpack Activity log: Along with daily full backups, Jetpack also takes my site’s snapshots as I make changes on my site. Every entry shows who made the change. For me, that’s my name and the Administrator role. The latest backup also gets a “Restore to this point” button.
How many days of backups can I keep?
That depends on your site’s total file size.
The Jetpack Security plan includes 10GB of cloud backup storage. My site’s total file size is 0.4 GB, yet 7 days of backups use 3.0GB. That’s because Jetpack keeps many restore points, not just one full site backup copy.
To keep 30 days of backups, I need to buy a Jetpack storage add-on ($2.95/month for 10GB). And if you hit the storage limit, Jetpack deletes older backups and may shorten the retention period. So check this screen before you count on long retention.
Can I Restore Only Part of My Site?
Yes, you can restore to a specific event, a specific day, or specific files and plugins. You can also download a backup and restore it manually.
Jetpack warns that a restore replaces all settings, posts, pages, and content with whatever was in the restore point. You can’t stop a restore once it starts. How long it takes depends on your site’s total size.
Note: If your site is completely down, Jetpack suggests a fresh WordPress install, then connecting Jetpack, then restoring. A manual restore is the last option. I haven’t run a restore on my site because I haven’t needed one yet. Check Jetpack’s official restore guide.
Jetpack Scan: What Does it Find and What Doesn’t?
Jetpack Scan checks for malware, changed core files, and plugins with known vulnerabilities. Since my plan started in September 2026, it has flagged two active vulnerable plugins.
| Plugin | Version | Severity | Found | Auto-Fix |
|---|---|---|---|---|
| WP Rocket | 3.23.3.3 | High | Oct 15, 2026 | No (Manual Update) |
| Rank Math SEO | 1.0.279 | Medium | Oct 8, 2026 | Yes |
On October 15th, Jetpack flagged WP Rocket v3.23.3 as having a high-severity vulnerability. Jetpack identified a flaw in WP Rocket versions below 3.23.5: an unauthenticated denial-of-service tracked as CVE-2026-97076 (via WPScan).
Jetpack alert linked to vulnerability details and gave me two buttons: Fix threat and Ignore threat. Jetpack offered an auto-fix, but when I clicked it, Jetpack said WP Rocket isn’t available on WordPress.org. So I had to update it manually.
As for the Rank Math alert, there was a flaw in versions below 1.0.280, tracked as CVE-2026-104752. It allows a user with administrator access to upload a PHP file and achieve remote code execution. Jetpack rated it a Medium security risk and flagged it on October 8, the same day WPScan published it. Jetpack auto-fixed it by updating the Rank Math plugin to the current version.
Worth knowing: Jetpack can auto-fix plugin vulnerabilities from the WordPress.org directory. But premium plugins may need a manual update. Before using the auto-fix feature, make sure to create a cloud backup. Jetpack auto-fix replaces the affected file, and it will delete the affected file or directory.
Why Jetpack Security Missed the UpdraftCentral Attack?
On 18th October, 2026, the most popular WordPress backup & restore plugin, “UpdraftPlus,” got compromised via its UpdraftCentral key. (High security vulnerability).
What Happened: Hackers got unauthorized access to the TeamUpdraft website, which exposed UpdraftCentral connection keys. With this key, they can create a backdoor variant that creates an administrator and tries to hide it (bypass 2fa, password hashes).
This security incident exposed Jetpack Security’s blind spot. Even with Jetpack’s automated malware scans, file integrity checks, and firewalls active, it remained completely silent about this incident.
How the attack worked: Hackers used genuinely signed, legitimate remote management commands authorized by stolen UpdraftCentral keys. Since the exploit did not involve traditional malicious code uploads or local file tampering, Jetpack security scanners failed to flag it as an intrusion.
From Jetpack’s perspective, the instructions appeared completely authentic, bypassing normal file-change alerts. Furthermore, on sites where UpdraftCentral keys had never been manually generated or used, there were no anomalous local files or active backdoors for a scanner to catch.
Does the Jetpack plugin Slow Down My Site?
No. Jetpack plugin didn’t slow down my site.
For the speed tests, I ran the same page through DebugBear, PageSpeed Insights, and GTmetrix. I tested in three setups: Jetpack fully active, Jetpack deactivated, and Jetpack active with Image CDN and Asset CDN turned off (only on GTmetrix). WP Rocket cache plugin stayed active in every test.
DebugBear Speed Test
I ran my homepage speed test on DebugBear. I ran this test once per setup.
What this means: there’s no real difference in the DebugBear speed test. TTFB differs by 2 ms, LCP by 4 ms, and page weight by only 1 KB. Jetpack was even 15 ms faster on First Contentful Paint. Differences this small are normal between two runs of the same page.
| Metric | With Jetpack | Without Jetpack |
|---|---|---|
| Lab score | 100% | 100% |
| TTFB | 64 ms | 62 ms |
| First Contentful Paint | 327 ms | 342 ms |
| Largest Contentful Paint | 386 ms | 382 ms |
| Total Blocking Time | 0 ms | 0 ms |
| Cumulative Layout Shift | 0.01 | 0.01 |
| Page weight | 291 KB | 292 KB |
PageSpeed Insights Speed Test
I tested my homepage speed on PageSpeed Insights three times. Here’s the result on both desktop & mobile.
Desktop Score:
| Metric | With Jetpack | Without Jetpack |
|---|---|---|
| Performance score | 100 | 100 |
| First Contentful Paint | 0.3 s | 0.3 s |
| Largest Contentful Paint | 0.5 s | 0.5 s |
| Total Blocking Time | 0 ms | 0 ms |
| Cumulative Layout Shift | 0 | 0.057 |
| Speed Index | 0.5 s | 0.3 s |
Mobile Score:
| Metric | With Jetpack | Without Jetpack |
|---|---|---|
| Performance score | 99 | 100 |
| First Contentful Paint | 0.9 s | 0.9 s |
| Largest Contentful Paint | 1.9 s | 1.2 s |
| Total Blocking Time | 0 ms | 0 ms |
| Cumulative Layout Shift | 0 | 0 |
| Speed Index | 2.6 s | 2.2 s |
What this means: Desktop score is a tie, and Mobile score is with one clear difference I saw. With Jetpack on, LCP was 0.7 seconds slower, and the score was 99 instead of 100. Both results are still “good and within Core Web Vitals limits.” I only ran PageSpeed with Jetpack fully on or fully off. So I can’t say whether the Security features, Image CDN, or Asset CDN caused the gap.
GTmetrix Speed Tests
GTmetrix speed test told a different story in my first run. With all Jetpack features on, the page made more requests and downloaded more data. I turned off Image CDN and Asset CDN and ran it again, and the result matched the run with Jetpack deactivated. I can’t say why the first run was heavier. I also ran a separate TTFB test, and it showed no difference.
Total Blocking Time was 0 ms and Cumulative Layout Shift was 0.05 in all three runs. The first run made 13 more requests and downloaded 65 KB more. I ran each GTmetrix setup once.
| Setup | Grade | LCP | TTFB | Fully Loaded | Page size | Requests |
|---|---|---|---|---|---|---|
| All Jetpack features on | A (100% / 99%) | 609 ms | 248 ms | 813 ms | 349 KB | 29 |
| Jetpack deactivated | A (100% / 100%) | 402 ms | 125 ms | 568 ms | 284 KB | 16 |
| Jetpack on (Image & Asset CDN off) | A (100% / 100%) | 392 ms | 140 ms | 619 ms | 284 KB | 16 |
My conclusion: the Jetpack Security features didn’t slow my site. My GTmetrix LCP score difference is real; multiple factors could cause it, not just Jetpack plugin. If you’re thinking of using Jetpack, test it on your own site, especially if your host already has a CDN.
What Does Jetpack’s Image CDN Do?
Image CDN serves my images from Jetpack’s servers. It’s a free feature available on all Jetpack plans. My host already has its own CDN, so it may add little for me. I had it on during the “with Jetpack” tests.
As you can see in my Cloudways review post, the featured image loads from an i0.wp.com address. The URL carries a width setting, and the page also offers a smaller 300px version for small screens. The 1024px image weighs 71.1 kB.
What else is on Jetpack Dashboard?
As for Jetpack dashboard, it show my shows my last scan time, my scan status, traffic stat, WAF status, and blocked logins since activation. Also, Jetpack keeps records of the activity log with name and role. It even logged the moment I turned on required two-step authentication.
Aside from backup and scans, Jetpack security plans come with 49 additional features. On my website, 13 of 49 features are active. Some of these features are free to use, and some need a Jetpack Complete subscription to use fully. Jetpack’s comparison table lists brute-force protection and downtime monitoring under Jetpack Free. So check the plan page before you assume a feature needs the paid plan.
Why does my Jetpack Auto-Firewall show Inactive?
On my own site, Auto-Firewall rules are disabled because my hosting provider, “Pressable,” uses the same built-in firewall as Jetpack WAF rules. Jetpack’s pricing page lists a website firewall (WAF) in the Security plan, so this is just overlap with my host. If your host doesn’t have an active firewall, Jetpack WAF automatically activates.
Akismet Anti-Spam
Jetpack security plans include 10k Akismet API calls per month. Akismet Anti-spam shows as Active on my dashboard. Its statistics page shows 128 spam blocked for both of the past two months. Akismet reports 100% accuracy, with 0 missed spam and 0 false positives.
That’s Akismet’s own figure, and I didn’t audit it manually. My spam filtering is set to silently discard the worst spam, and Akismet deletes anything in the spam folder after 15 days. There’s also a setting that lets MCP clients, such as AI assistants, access Akismet data. It’s off on my site.
Jetpack Pricing: How Much Does Jetpack Security Plan Cost?
Jetpack Security plan costs $9.95/month for the first year, then the regular price is $19.95/month. Plans are billed yearly, and Jetpack offers a 14-day full refund policy.
| Plan | First-year price | Regular price |
|---|---|---|
| Security | $9.95/mo | $19.95/mo |
| Growth | $9.95/mo | $19.95/mo |
| Complete | $24.95/mo | $49.95/mo |
My plan shows under Purchases as a “Host Managed Plan.” Pressable hosting offers the Jetpack Security plan included with all its plans at no extra charge, so I don’t pay Jetpack directly.
Jetpack Free vs Security: What Do You Pay For?
Jetpack free version covers basic brute-force protection, downtime monitoring, and Image CDN. Security plans add real-time backups, malware scanning, automatic firewall rules, basic traffic analytics, and Akismet spam protection. Below is Jetpack’s own comparison of the features that matter here. I left out the Growth plan; it focuses on stats, social, and newsletter tools.
| Feature | Free | Security | Complete |
|---|---|---|---|
| Brute-force attack protection | Included | Included | Included |
| Automated backups | Not included | Real-time | Real-time |
| Backup storage | Not included | 10 GB | 1 TB |
| 1-click restore | Not included | Included | Included |
| Malware scanning | Not included | Real-time | Real-time |
| Web Application Firewall (WAF) | Manual rules | Automatic rules | Automatic rules |
| Akismet spam protection | Not included | 10k API calls/mo | 60k API calls/mo |
| Activity log retention | 20 events | 30 days | 1 year |
| Image CDN | Included | Included | Included |
| Downtime monitoring | Included | Included | Included |
| Priority support | Community forums | Included | Included |
How Does Jetpack Security Compare to Alternatives?
Jetpack Security bundles backups, scanning, and spam filtering into a single plugin. Each plugin below covers part of that job.
| Plugin | What it is | How it works | Compared with Jetpack |
|---|---|---|---|
| Wordfence | Security plugin with a firewall and malware scanner | Runs inside your WordPress site (heavy & uses server resources) | A heavy plugin. Scanning uses your own server resources. |
| MalCare | Cloud-based Security plugin & malware scanner | Scanning happens in the cloud (like Jetpack scan) | Lightweight; malware scanning is off-site. |
| BlogVault | WordPress cloud backup plugin | Stores backups off-site in the BlogVault cloud server. | Does a similar job to Jetpack VaultPress Backup. |
| UpdraftPlus | WordPress backup plugin | Saves regular backups to storage you choose. | Regular scheduled backups saved on a third-party server |
My Verdict: Is Jetpack Security Worth Buying?
Yes, the Jetpack Security plan is worth buying. It works perfectly on my site. I don’t need to install separate backup, security, and analytics plugins on my site. Jetpack cloud backups run while I work, the restore options are specific, and the malware scan alerts are easy to understand and fix.
Most importantly, Jetpack security features didn’t slow my site down either.
Jetpack backup storage limit is the main thing to know before you buy. If 7 days of backup is enough for you, it’s a hands-off safety net. If you need a month or more, you need to buy extra cloud storage. One more thing: I haven’t tested a Jetpack restore yet, so that part of my verdict is based on the restore screen and Jetpack’s guide.
Who Should Use Jetpack Security?
- Use it if you run a blog, affiliate site, or small business site and want off-site, real-time backups, WAF, and security scans in one place.
- Skip it if you need long backup history on a tight budget. Also skip it if your host already gives you off-site, real-time backups, malware scanning, and an active firewall you trust.
That’s all for the Jetpack security review. If you have any questions related to Pressable hosting & the Jetpack plugin, let me know in the comment section.
Thank you. Have a nice day.
