Really Simple Security Pro

Really Simple Security Pro extends Really Simple Security with configurable controls for HTTPS, site traffic, vulnerabilities, and user access. A short onboarding setup helps you review and configure the available measures. Its modular styling means disabled features do not load redundant code.

Apply HTTPS and address mixed content

Advanced SSL enforcement applies HTTPS across your website. The mixed-content scan finds files requested over HTTP, and the fixer helps change those requests to HTTPS on the front end and back end. You can enable HTTP Strict Transport Security (HSTS) and configure the site for the HSTS Preload list.

Security header options include X-XSS-Protection, X-Content-Type-Options, X-Frame-Options, a Referrer Policy, and CORS headers. The plugin can automatically generate a WordPress-tailored Content Security Policy and works independently of server configuration on Apache, LiteSpeed, NGINX, and other setups.

Manage traffic with firewall and access rules

The WordPress firewall uses automated and customisable rules to handle bots, crawlers, and other unwanted activity. It can block crawlers that generate unusual numbers of 404 errors. Configure access by region, IP address or range, and username, with IP blocklist and allowlist controls.

After a failed login, you can display a CAPTCHA using hCaptcha or Google reCAPTCHA. These settings let you shape which traffic reaches the site and how repeated login attempts are handled.

Respond to software vulnerabilities

Vulnerability Detection notifies you when plugins, themes, or WordPress core contain vulnerabilities. Vulnerability Measures can make repeated attempts to force an update and notify you during the process. If a plugin or theme cannot be updated to address a vulnerability, it can be quarantined.

Protect accounts and harden WordPress

Login Protection lets you allow or enforce two-factor authentication for selected user roles. Users can receive a two-factor code by email; login options also include TOTP-based two-factor authentication and passkey login. You can require strong passwords, set password-change intervals, and limit login attempts.

Hardening controls address code execution in the uploads folder, login feedback, user enumeration, XML-RPC, directory browsing, and restricted usernames. Additional settings include a custom login URL, file permission checks and fixes, database prefix changes, moving debug.log to a non-public folder, application password controls, admin creation controls, and disabling HTTP methods.

Configure the measures you need

Add Really Simple Security Pro to your WordPress site, activate it, and follow the onboarding setup. Review the SSL, firewall, header, vulnerability, login, and access-control settings, then enable the measures appropriate for your site.