Download-wp-security-shield- Pay Once Use On Unlimited Websites

WP Security Shield adds several well-established hardening measures to a WordPress
site without requiring an external service or account:

• Login protection — locks out an IP after repeated failed login attempts,
  and hides WordPress’s specific “invalid username” / “incorrect password”
  messages so the login form can’t be used to guess valid usernames.
• Security headers — X-Frame-Options, X-Content-Type-Options,
  Referrer-Policy, Permissions-Policy.
• XML-RPC lockdown — disables XML-RPC, a common brute-force and
  DDoS-amplification target (toggle off if you use Jetpack or the WP mobile app).
• User enumeration blocking — blocks ?author=1 style scans and hides the
  public REST /wp/v2/users endpoint.
• Version disclosure removal — strips the WordPress version number from
  page source and asset URLs.
• File editor lockout — disables the in-dashboard theme/plugin file editor.
• Basic request firewall — blocks requests containing common attack
  signatures (SQL injection, path traversal, etc.) in the URL or query string.
• Activity log — records failed logins, lockouts, and firewall blocks in
  a dedicated table, viewable (and one-click reversible) from the dashboard.

== What this plugin is not ==

This is application-layer hardening, not a substitute for:

• Keeping WordPress core, themes, and plugins updated
• Strong, unique passwords and (ideally) two-factor authentication
• Reputable hosting with server-level security and backups
• A dedicated WAF/CDN (Cloudflare, Sucuri, etc.) for high-traffic or
  high-value sites — the built-in firewall here is intentionally simple to
  minimize false positives, not a comprehensive WAF.

== Installation ==

1. Upload the wp-security-shield folder to /wp-content/plugins/, or upload the
   zip via Plugins → Add New → Upload Plugin.
2. Activate the plugin through the “Plugins” menu in WordPress.
3. Go to the new “Security Shield” menu item to review settings — sensible
   defaults are already on.

== Frequently Asked Questions ==

= I use Jetpack or the WordPress mobile app and my site broke =

Turn off “Disable XML-RPC” under Settings — those tools depend on it.

= Will this conflict with other security plugins? =

Running two plugins that both rewrite login error messages or send the same
headers is harmless but redundant. If you already use a full WAF/security
suite, you may want to disable the overlapping features here (e.g. the basic
firewall) to avoid duplicate work.