Really Simple Security Pro: SSL, Firewall & Login Protection

Really Simple Security Pro extends Really Simple Security with WordPress controls for site traffic, HTTPS, software vulnerabilities, and user accounts. A short onboarding setup helps configure the available measures. Its modular styling means disabled functions do not load redundant code.

Connect HTTPS enforcement with mixed-content repair

Enforce HTTPS across your site, then scan for files still requested over HTTP. The mixed-content fixer helps change those requests to HTTPS on the front end and back end. You can also enable HTTP Strict Transport Security (HSTS) and configure the site for the HSTS Preload list.

Use firewall rules to manage traffic

The WordPress firewall has automated and customisable rules for bots, crawlers, and other unwanted activity. It can block crawlers that generate unusually high numbers of 404 errors. Configure access by region, IP address or range, and username, with IP blocklist and allowlist controls. CAPTCHA settings after a failed login include hCaptcha and Google reCAPTCHA.

Pair security headers with vulnerability measures

Header options include X-XSS-Protection, X-Content-Type-Options, X-Frame-Options, a Referrer Policy, and CORS headers. The plugin can also generate a WordPress-tailored Content Security Policy. These controls work independently of server configuration on Apache, LiteSpeed, NGINX, and other configurations.

Vulnerability Detection notifies you when WordPress core, a plugin, or a theme contains a vulnerability. Vulnerability Measures let you configure responses such as repeated update attempts. If a plugin or theme cannot be updated to address a vulnerability, it can be quarantined.

Apply login and account controls

Login Protection lets you allow or require two-factor authentication for selected user roles; customers receive their code by email. Other hardening options can prevent code execution in the uploads folder, prevent login feedback and disable user enumeration, disable XML-RPC and directory browsing, and restrict usernames.

Configure the measures for your site

Install Really Simple Security Pro on your WordPress site, activate it, and follow the onboarding setup. Review the SSL, firewall, header, vulnerability, login, and access-control settings, then enable the measures appropriate for your site.