WordPress security controls in one plugin

Really Simple Security Pro extends Really Simple Security with settings for HTTPS, traffic, security headers, vulnerabilities, logins, and site access. A short onboarding setup guides configuration. Its modular styling means disabled features do not load redundant code.

Enforce HTTPS and address mixed content

Enforce HTTPS across the site and scan for documents requested over HTTP. The mixed-content fixer helps change those requests to HTTPS on the front end and back end. You can also enable HTTP Strict Transport Security (HSTS) and configure the site for the HSTS Preload list.

Configure firewall and access rules

The WordPress firewall provides configurable controls for bots, crawlers, and other unwanted activity. It can block crawlers that generate unusual numbers of 404 errors. Access settings let you allow or block traffic by region, IP address or range, and username.

• Use automated or custom firewall rules.
• Manage IP addresses with blocklists and allowlists.
• Limit login attempts by temporarily or permanently blocking IP addresses or usernames, including usernames that do not exist.
• Show hCaptcha or Google reCAPTCHA after a failed login.

Set security headers and vulnerability responses

Configure X-XSS-Protection, X-Content-Type-Options, X-Frame-Options, Referrer Policy, and CORS headers. The extension can generate a WordPress-tailored Content Security Policy and works independently of server configuration, including Apache, LiteSpeed, and NGINX.

Vulnerability Detection notifies you when a plugin, theme, or WordPress core has a known vulnerability. Vulnerability Measures can retry updates several times and notify you during the process. If a plugin or theme cannot be updated to address a vulnerability, it can be quarantined.

Protect logins and harden WordPress

Login Protection lets you allow or require two-factor authentication for selected visitor roles. Available login methods include email codes, TOTP, and passkey login. You can also require strong passwords and password changes at a defined interval.

Additional hardening settings include a custom login URL, file permission checks and fixes, changing the database prefix, moving the debug log to a non-public folder, controlling application passwords and admin creation, and disabling HTTP methods. Other settings address code execution in the uploads folder, login feedback, user enumeration, XML-RPC, directory browsing, and restricted usernames.

Install and configure

Add Really Simple Security Pro to your WordPress site, activate it, and follow the onboarding setup. Then review the HTTPS, firewall, header, vulnerability, login, and access settings and enable the measures appropriate for your site.