🛒 0 item(s)

Download-wp-security-shield- Pay Once Use On Unlimited Websites

WP Security Shield adds several well-established hardening measures to a WordPress
site without requiring an external service or account:

  • Login protection — locks out an IP after repeated failed login attempts,
    and hides WordPress’s specific “invalid username” / “incorrect password”
    messages so the login form can’t be used to guess valid usernames.
  • Security headers — X-Frame-Options, X-Content-Type-Options,
    Referrer-Policy, Permissions-Policy.
  • XML-RPC lockdown — disables XML-RPC, a common brute-force and
    DDoS-amplification target (toggle off if you use Jetpack or the WP mobile app).
  • User enumeration blocking — blocks ?author=1 style scans and hides the
    public REST /wp/v2/users endpoint.
  • Version disclosure removal — strips the WordPress version number from
    page source and asset URLs.
  • File editor lockout — disables the in-dashboard theme/plugin file editor.
  • Basic request firewall — blocks requests containing common attack
    signatures (SQL injection, path traversal, etc.) in the URL or query string.
  • Activity log — records failed logins, lockouts, and firewall blocks in
    a dedicated table, viewable (and one-click reversible) from the dashboard.

== What this plugin is not ==

This is application-layer hardening, not a substitute for:

  • Keeping WordPress core, themes, and plugins updated
  • Strong, unique passwords and (ideally) two-factor authentication
  • Reputable hosting with server-level security and backups
  • A dedicated WAF/CDN (Cloudflare, Sucuri, etc.) for high-traffic or
    high-value sites — the built-in firewall here is intentionally simple to
    minimize false positives, not a comprehensive WAF.

== Installation ==

  1. Upload the wp-security-shield folder to /wp-content/plugins/, or upload the
    zip via Plugins → Add New → Upload Plugin.
  2. Activate the plugin through the “Plugins” menu in WordPress.
  3. Go to the new “Security Shield” menu item to review settings — sensible
    defaults are already on.

== Frequently Asked Questions ==

= I use Jetpack or the WordPress mobile app and my site broke =

Turn off “Disable XML-RPC” under Settings — those tools depend on it.

= Will this conflict with other security plugins? =

Running two plugins that both rewrite login error messages or send the same
headers is harmless but redundant. If you already use a full WAF/security
suite, you may want to disable the overlapping features here (e.g. the basic
firewall) to avoid duplicate work.