Security controls that work together

Really Simple Security Pro extends Really Simple Security with configurable tools for HTTPS, site traffic, software vulnerabilities, and visitor accounts. A short onboarding setup helps you review the available measures. Its modular design means disabled features do not load redundant code.

HTTPS, mixed content, and security headers

Enforce HTTPS across your website, then scan for documents still requested over HTTP. The mixed-content fixer helps change those requests to HTTPS on both the front end and back end. You can also enable HTTP Strict Transport Security (HSTS) and configure the site for the HSTS Preload list.

Security header options include X-XSS-Protection, X-Content-Type-Options, X-Frame-Options, a Referrer Policy, and CORS headers. The add-on can generate a WordPress-tailored Content Security Policy and works independently of server configuration on Apache, LiteSpeed, NGINX, and other setups.

Firewall and access rules

The WordPress firewall has automated and custom rules for managing bots, crawlers, and other unwanted activity. It can block crawlers that generate unusual numbers of 404 errors. Access controls let you allow or block traffic by region, IP address or range, and username, with IP blocklist and allowlist options.

For login attempts, configure a threshold to temporarily or permanently block IP addresses or usernames, including usernames that do not exist. You can also show hCaptcha or Google reCAPTCHA after a failed login.

Vulnerability responses and site hardening

Vulnerability Detection notifies you when plugins, themes, or WordPress core contain known vulnerabilities. Vulnerability Measures let you configure responses, including repeated update attempts with notifications. If a extension or theme cannot be updated to address a vulnerability, it can be quarantined.

Advanced hardening options include a custom login URL, file permissions checks and fixes, database prefix changes, moving the debug log to a non-public folder, controlling application passwords and admin creation, and disabling HTTP methods.

Login protection and setup

Allow or require two-factor authentication for selected user roles. Users receive their verification code by email. Other hardening options can prevent code execution in the uploads folder, hide login feedback, limit user enumeration, disable XML-RPC, restrict directory browsing, and block specified usernames.

Install and activate Really Simple Security Pro on your WordPress site, then follow the onboarding setup. Review the SSL, firewall, header, vulnerability, login, and access settings and enable the measures that fit your site.