For quite some time now we have been using the BruteProtect plugin for our Managed WordPress clients. BruteProtect allows the millions of WordPress bloggers to work together to defeat Brute Force attacks using a cloud based solution. It served us well and was a member of the Net Solutions Certified Plugins list. Net Solutions maintains a list of WordPress plugins that pass strict quality tests and are used internally as part of a suite of plugins, that in our view provide ultimate performance and good practice for WordPress sites.
In August 2014, BruteProtect was acquired by Automattic (makers of WordPress.com, Akismet, and Jetpack). It didn’t take long before it was clear what the purpose was behind the acquisition. Automatic purchased BruteProtect so they could ultimately drop the product and merge some of its features in the Jetpack suite. This was confirmed in an email we received today.
Just before the email notification however, a new version BruteProtect was released, ver 2.4. Upon closer inspection though, the new version was basically released so that users get notified that support was ending for the product and promoting the Jetpack plugin as a replacement.
Unfortunately Jetpack is one of those plugins that does not pass our quality tests. We looked at this plugin some 12 months ago and deemed it unacceptable based on the performance penalties your site will suffer when loaded! I have looked at it again and again the added features of this plugin do not justify the performance penalties.
We are very conscious of the user experience and organic SEO for the sites we build. Minimizing page load times if of paramount importance and one the the strongest signals we use in optimizing sites. If a plugin has a significant impact on page load time, it better bloody well be worth it. On my installation, enabling JetPack with just the stats enabled caused a major increase in page load times. With Jetpack enabled, the impact of plugins to load time was 55.%. With Jetpack disabled, that value dropped to <2%. So its a classic case of where “Less is More”
Jetpack is garbage and misleading since they claim “Jetpack is built by the people behind WordPress.com and is designed to speed up your site“. The name itself is bitterly hyped up and perhaps “Bloatpack” is more suited.
So we are now looking at how iThemes Security Pro may meet the requirements, or perhaps develop our own Plugin in 2015. Goodbye BruteProtect, it was nice while it lasted.