Enforce HTTPS and find mixed content

Really Simple Security Pro extends Really Simple Security with configurable tools for WordPress security. A short onboarding setup guides configuration, and disabled capabilities do not load redundant code.

Enforce HTTPS across your website, then use the mixed-content scan to find files still requested over HTTP. The fixer helps change those requests to HTTPS on both the front end and back end. You can also enable HTTP Strict Transport Security (HSTS) and configure the site for the HSTS Preload list.

Set firewall rules for traffic and access

The WordPress firewall has configurable controls for bots, crawlers, and other unwanted activity. It can block crawlers that generate unusual numbers of 404 errors. Access options let you allow or block traffic by region, IP address, or username.

• Use automated or custom firewall rules.
• Manage IP addresses with blocklists and allowlists.
• Restrict access by region, address, or username.

Respond to detected vulnerabilities

Vulnerability Detection notifies you when a plugin, theme, or WordPress core has a vulnerability. Vulnerability Measures let you configure responses. For example, the add-on can try an update multiple times and notify you during the process. If a plugin or theme cannot be updated to address a vulnerability, it can be quarantined.

Configure security headers and hardening

Configure X-XSS-Protection, X-Content-Type-Options, X-Frame-Options, a Referrer Policy, and CORS headers. The plugin can generate a WordPress-tailored Content Security Policy. These header settings work independently of server configuration, including on Apache, LiteSpeed, and NGINX.

WordPress hardening options address code execution in the uploads folder, login feedback, visitor enumeration, XML-RPC, directory browsing, and restricted usernames.

Protect logins and user accounts

Login Protection lets you allow or require two-factor authentication for selected user roles. Users can receive a two-factor code by email. Limit Login Attempts can temporarily or permanently block IP addresses or usernames, including usernames that do not exist. You can also show hCaptcha or Google reCAPTCHA after a failed login.

Install and configure the plugin

Back up your site, add Really Simple Security Pro to WordPress, activate it, and follow the onboarding setup. Review the SSL, firewall, headers, vulnerability, login, and access settings, then enable the measures that fit your site.