There is no safe “turn everything on” Jetpack preset. Enable a feature when it fills a real protection, uptime, backup, performance, content, or audience need; first check what your host and other plugins already provide. For many sites, the sensible starting point is Downtime Monitor, a tested backup plan, and only the security controls your plan and hosting environment support. Use Jetpack’s settings tabs or search to review each feature, and disable unused features from the Features page.
Start with a site inventory, not a universal preset
Jetpack combines several product areas inside one WordPress connection. The right settings for a small brochure site are different from those for a WooCommerce shop, a publication with several administrators, or a multisite network. Before changing switches, write down what the site needs and where each need is already handled.
As an Amazon Associate I earn from qualifying purchases.
- Protection: firewall controls, malware scanning, and spam protection.
- Availability: alerts when the site stops responding.
- Recovery: an off-site copy of the database, files, and eligible commerce data.
- Performance, content, and audience: enable these only when you understand the feature’s effect and are not duplicating an existing host or plugin service.
Open Jetpack in the WordPress dashboard and browse the settings tabs. If you know the feature name, use the settings search instead of scanning every panel. Jetpack’s Getting Started guidance also documents a Features page where individual features can be turned off. Disable capabilities you do not use; a smaller, intentional configuration makes ownership and troubleshooting clearer.
Record the result of this inventory in your site documentation: which tool handles backups, who receives alerts, which plan supplies each paid capability, and which administrator can change the setting. Recheck this record after a hosting move, a plan change, or the installation of another security or optimization plugin.
#1 Best Overall
Use these decision rules before enabling anything
| Jetpack area | Enable when | Requirements or limits to verify | Operational question |
|---|---|---|---|
| Firewall | You want Jetpack to inspect incoming requests and allow or block traffic. | It is deactivated by default after a Jetpack connection. Automatic rules require an eligible paid plan—Jetpack Security, Jetpack Complete, or Jetpack Scan—and a WordPress.com connection. Manual rules can block specified IP addresses. | Could a rule block your own address, a staff member, an integration, or a legitimate customer? |
| Malware scanning | You need the scanning capability included with your plan and do not already have equivalent coverage. | Confirm the plan and configuration that provide scanning; coverage is separate from the firewall. | Who reviews findings and what is the recovery procedure? |
| Akismet spam protection | Comments, forms, or other submissions are attracting unwanted content. | Confirm that your chosen Akismet setup and site workflow cover the submission types you use. | Will moderators still review false positives? |
| Downtime Monitor | You need a simple availability alert and have a working Jetpack connection. | It is free and does not require a Jetpack plan. Email goes to the WordPress.com account that originally connected the site. | Is that account still monitored, especially if several administrators run the site? |
| VaultPress Backup | You need Jetpack-managed recovery copies and your plan includes backups. | Requires an eligible plan, a working connection, the Jetpack plugin or standalone VaultPress Backup plugin, and at least one theme or plugin from the WordPress.org repository. The backup page is unavailable for WordPress multisite. | Does your host permit the required access, and who will perform a restore? |
| Performance, content, or audience features | A measured site need is not already covered elsewhere. | Review the individual feature’s plan, compatibility, and effect before enabling it. | Will this duplicate a host or plugin function or change front-end behavior? |
Security: choose controls by threat and plan
Firewall
Jetpack Firewall examines incoming traffic and can allow or block it according to rules. The documented default is important: Jetpack Firewall is deactivated by default when you connect Jetpack to your WordPress.com account. Connecting Jetpack therefore does not, by itself, mean that the firewall is enforcing traffic rules.
Automatic firewall rules are a paid-plan capability. Jetpack’s documentation lists Jetpack Security, Jetpack Complete, or Jetpack Scan as eligible plans, together with a WordPress.com connection. If you are on another plan, do not assume the automatic rule set is available. Check the plan shown for your site before looking for an enable switch.
Manual rules are a different choice. They can include blocking specified IP addresses. Add a manual block only when you can identify the address and have a way back into the site. A shared office connection, mobile carrier, VPN exit, monitoring service, payment provider, or legitimate crawler may use an address that looks suspicious. Save the current rule list and test from an unaffected administrator account before applying a broad range. If you lock yourself out, remove or revise the rule through an account or host-level access path that remains available; do not add successive blocks without identifying the original cause.
Malware scanning and spam protection
Jetpack’s protection overview treats malware scanning and Akismet spam protection as separate capabilities. A firewall filters traffic; it does not replace a scan for malicious files, and a spam filter addresses unwanted submissions rather than server compromise. Confirm which of these your plan and configuration provide instead of inferring coverage from the presence of one security switch.
For scanning, decide in advance who receives a finding, how quickly it is reviewed, and whether the response is to restore a known-good backup, remove a compromised component, or involve the host. For spam protection, keep a moderation path for false positives and check the forms and comment types your site actually accepts. If another plugin or your host already supplies one of these functions, compare overlap before enabling a second system.
Downtime Monitor: the useful free baseline for many sites
Jetpack’s Downtime Monitor is documented as a free feature and does not require a Jetpack plan. It does require a working Jetpack connection, so resolve connection errors before judging the monitor itself.
- In the WordPress dashboard, open Jetpack → Settings → Security.
- Find Downtime Monitor and turn it on.
- Confirm the notification account. Email alerts go only to the WordPress.com account that originally connected the site.
- If several administrators share responsibility, verify that this account is actively monitored or change the connection to an account with the appropriate operational ownership.
- Review the mobile app’s push-notification options if a prompt is needed when email is missed.
The recipient rule is easy to overlook during staff changes. Adding another WordPress administrator does not automatically add that person to Monitor email. Treat the original connecting account as an operational dependency and document its owner.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Backups: enable them only after checking eligibility and recovery needs
Prerequisites
VaultPress Backup requires all of the following: a plan that includes backups, a working Jetpack connection, either the Jetpack plugin or the standalone VaultPress Backup plugin, and at least one theme or plugin installed from the WordPress.org repository. The documented plans that include backups are VaultPress Backup, Jetpack Security, and Jetpack Complete.
VaultPress Backup’s backup page is not available for WordPress multisite installations. A multisite network therefore needs a recovery approach that explicitly supports multisite; do not assume a single-site backup screen will cover every site in the network.
What the service captures and when
The documentation says backups include the WordPress database, key site directories, and WooCommerce products and orders. Backups occur at least daily and also after certain events, including publishing or updating posts and installing or updating themes and plugins. “At least daily” is not a configurable schedule: the documented setting does not let you choose hourly or weekly frequency.
That event behavior matters when planning changes. A theme or plugin update can create a new recovery point, but it is still prudent to stage risky changes and record what changed. Confirm that the data you consider essential is within the documented coverage, especially uploads, custom directories, external media, and third-party services that WordPress does not store in its database.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesMake the backup useful before an incident
- Write down the plan and connection owner so renewal or account changes do not silently remove eligibility.
- Identify who can access the backup interface and who has authority to restore production.
- Document the host’s restore process and keep a separate copy of critical configuration information that is not part of WordPress content.
- After enabling backups, verify that a recent backup is visible and that the site’s most important content appears in the covered database, directories, or WooCommerce records.
- Run a restore rehearsal on a staging environment when your host permits it. A backup that exists but cannot be located, downloaded, or restored is not an operational recovery plan.
Hosting compatibility can decide whether a setting works
Jetpack’s known-issues documentation identifies two concrete hosting boundaries. VaultPress Backup and Scan do not work on Pantheon because of file-system access restrictions. WP Engine users need to add server credentials for VaultPress Backup. These are not generic WordPress errors; they are environment requirements.
Rank #4
Before enabling backup or scanning on any managed host, look for host-specific instructions and ask support whether outbound requests, file access, credentials, DNS, caching, or security rules interfere with Jetpack. A connection that appears active in the dashboard can still fail when a host blocks a callback or denies a filesystem operation.
Jetpack support also states that some server, firewall, DNS, speed, and performance matters fall outside product support. If a setting fails because the host blocks a request or access method, the host may need to make the change. Capture the exact error, timestamp, affected URL or feature, and recent configuration changes before opening a support ticket; that information helps separate a Jetpack setting issue from an infrastructure restriction.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Performance, content, and audience features need their own test
Jetpack includes features beyond security, monitoring, and backups. Do not enable an optimization, publishing, statistics, or audience feature merely because it is available. Define the outcome first—for example, a reporting gap, a distribution workflow, or a measured page-speed problem—then compare Jetpack’s behavior with the host and plugins already in place.
Check for duplicate caching, image handling, analytics, sharing, related-content, search, or subscription functions. Two systems acting on the same page, asset, or tracking event can create inconsistent results, duplicate data, or confusing controls. Enable one feature at a time, test logged-out pages and administrator workflows, and record the rollback path. If the test does not address the stated need, turn the feature off from the Features page.
Best Value
A safe order for changing Jetpack settings
- Inventory: list the site’s protection, uptime, recovery, performance, content, and audience requirements.
- Map existing coverage: note what the host, another plugin, or a separate service already does.
- Check plan and host: confirm eligibility, connection status, multisite support, and host-specific requirements.
- Choose an owner: assign the WordPress.com account that should receive Monitor mail and the person responsible for security findings and restores.
- Enable one capability: change a single setting, then test the site from an administrator session and a logged-out browser.
- Record the result: note the date, setting, plan, owner, and observed behavior.
- Remove unused features: use the Features page to turn off anything that has no current job.
Troubleshooting branches
The firewall switch or automatic rules are missing
Confirm that the site is connected to WordPress.com and that the plan is Jetpack Security, Jetpack Complete, or Jetpack Scan if you expect automatic rules. A connection alone does not activate the firewall, and a lower or different plan may not expose automatic rules.
Monitor is enabled but nobody sees email
Check the inbox and spam folder for the WordPress.com account that originally connected Jetpack. Adding administrators does not change that recipient. If the account is obsolete, transfer operational ownership through the documented connection process and then verify the new notification path.
Backups cannot be opened or do not start
Check plan eligibility, Jetpack connection health, plugin installation, and the WordPress.org theme-or-plugin prerequisite. Next, check host constraints: Pantheon is documented as incompatible with VaultPress Backup and Scan, while WP Engine requires server credentials for VaultPress Backup. If the host blocks access or requests, contact the host with the exact error rather than repeatedly toggling the setting.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →A new feature conflicts with an existing tool
Disable the duplicate capability from Jetpack’s Features page or the other plugin’s settings, keeping one clearly owned implementation. Retest cached and uncached pages, forms, analytics, and administrator workflows after the change.
Keep the configuration reviewable
Jetpack settings should be treated as an operating decision, not a one-time setup ritual. Review them after a host migration, a WordPress multisite decision, a plan change, a new security plugin, or a change in the WordPress.com account that owns alerts. The most defensible configuration is the one whose purpose, plan, recipient, host requirement, and recovery path are written down—and whose unused features are switched off.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
