Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
by Really Simple Plugins · Security
Also makes 3 other plugins · 3.1M+ installs across the portfolio →
Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate.
Try it live opens a temporary test site in your browser, which can take about 20 seconds to load. Plugins that rely on outside services or a full server may not work completely there.
Health
A 96/100
no flags
Active installs
3M+
≈3.5M estimated
Momentum
-52%
downloads vs prior 30d
Biggest opportunity: Rating quality scores 98/100. Lift the average: resolve the issues driving the low reviews.
96 health vs 66 average across 1,776 Security plugins
Install conversion
How it's measured →1.3%
of downloads still active
At least 3M of 223.1M lifetime downloads are still running, in line with its category: the median Security plugin keeps 1.4%, across 1,059 plugins.
Downloads count every update, not just first installs, so older and more frequently released plugins read lower. Compare against other Security plugins, not across the directory. wp.org reports active installs as the bottom of a band, so the real rate is this or higher.
This plugin shipped 8 releases in the last 12 months, and every existing install that updated counted as another download. wp.org publishes no split between first installs and updates, so we show the raw rate rather than guess at one.
Details
Recent review vibe
read from the latest 12 reviews to 2026-07-16Reviewers overwhelmingly praise the plugin as simple and effective, though one recent reviewer flagged non-functional IP/country blocking and a broken premium support widget in Brave.
Directory ranking optimization
How it's scored →How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.
Excellent listing optimization
Well tuned across the board
Updated 5 days ago
Tested up to WordPress 7.1.4, the current branch or newer
4.9★ over 8,869 reviews, smoothed to 4.90★
5 of 5 tags set · short description in place
8 of 8 support threads resolved in the last 2 months
Search visibility
How it's tracked →Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.
46
Momentum
Holding steady
+0.4
Velocity
places per keyword, 28d
36%
Breadth
of keywords climbing, 28d
-0.0
Acceleration
recent half vs earlier
wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.
| Keyword | wp.org | On merit | wp.org move, 90 days |
|---|---|---|---|
| ssl | #1 | #1 | 0 |
| simple ssl | #1 | #1 | 0 |
| detection | #1 | #1 | up 1 |
| ssl certificate | #1 | #1 | 0 |
| encrypt | #1 | #1 | 0 |
| clickjacking | #1 | #1 | 0 |
| vulnerabilities your tag | #2 | #2 | down 1 |
| vulnerability | #2 | #2 | down 1 |
| wordpress hardening | #2 | #1 | 0 |
| hardening | #2 | #1 | 0 |
| free ssl | #1 | #1 | 0 |
| site hardening | #1 | #1 | 0 |
| ssl security | #1 | #1 | 0 |
| add ssl | #1 | #1 | 0 |
| ssl client certificate | #1 | #1 | 0 |
| https your tag | #3 | #3 | 0 |
| user enumeration | #2 | #2 | 0 |
| blocklist | #2 | #2 | 0 |
| mixed content | #2 | #2 | 0 |
| login protection | #4 | #3 | up 1 |
1050 searches this plugin appeared in over the last 90 days, 20 listed. 911 left out as unrelated or noise (years, numbers, stray words).
What to do about it
- Your five tags are all earning their place. Each gets you onto page 1 of its own search, so none is worth giving up. “application passwords”, “bad” and “certificate” (#4, #4 and #4 untagged) would be the next worth testing if a slot frees up.
Daily downloads
Since 5 Oct 2022 · 1,488 days · wp.org + Plugin Pulse archive
30-day downloads
Rolling 30-day volume · peak 5.6M · peaks are release surges
Directory rank vs rivals
wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you
Rating trend
Star average over time · dips mark rough releases
Health trend
Composite health score, snapshotted daily
Update activity
How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.
Release cadence
Actively maintainedHow often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.
8
releases in the last 12 months
5d ago
latest release · v9.8.4 · 26 Oct 2026
8
tagged releases on record
Recent releases
What its installed base runs
via wordpress.orgShare of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.
Estimated active installs
The public count shows “3M+”. Our estimate pins where the real number sits.
Crossed into this band 9 months ago; a band this size takes about a year or more to cross, which places it about 50% of the way through.
Install history since 1 Oct 2021
Recent reviews
All reviews on wp.org ↗- ★★★★★ innovatedmedia4mo ago
I’ve been using this plugin for years! It’s simple to use, and very intuitive, and it has truly made every website I have built and continue to manage so much easier. It saves me a lot of time doing things I used to have to do the long way. Highly recommend.
Read on wp.org ↗ - ★★★★★ minhtri48874mo ago
Công cụ tuyệt vời
Read on wp.org ↗ - ★★★★★ smarrazzo4mo ago
Worked well and it just works
Read on wp.org ↗ - ★★★★★ dome00135mo ago
it’s really simple
Read on wp.org ↗ - ★★★★★ zamzough5mo ago
Easy to use, works well. Great !
Read on wp.org ↗ - ★★★★★ chaosheld5mo ago
I hate to pay for plugins that simply don’t do the things they are advertising. Man, even the stupid “Premium Support” message box is running into an error when using! That is really bad. I mean if such basic thing doesn’t work in a standard browser like Brave, the rest can only be shit right? What is even worse is that the IP block and country block is not doing anything at all. What? I mean what is the purpose if it simply doesn’t do anything? I am adding IP addresses from bots out of my logs and imagine what …. the bots are still doing their litte scraping job for some suckers draining the internet. If that is one feature obviously not working how can I trust other features to work as expected?
Read on wp.org ↗ - ★★★★★ drhcweiss5mo ago
Gott sei Dank über 200000 Spams abgeblockt! Vielen Dank! MglG doc This topic was modified 3 weeks, 5 days ago by drhcweiss.
Read on wp.org ↗ - ★★★★★ joluzalo5mo ago
¡Excelente plugin
Read on wp.org ↗
Latest updates
via wp.org changelogRecent releases and news for this plugin
- 2026-10-26 Version 9.8.4 Security: On multisite, only network admins can now deactivate the plugin network-wide. 9.8.4
- 2026-09-15 Version 9.8.3 Security: Fixed a remaining 2FA bypass in XML-RPC authentication. Security: Fixed an issue where unauthenticated visitors could bloat the database via the 404 interceptor. Thanks to Naoki Kawahigashi via WPScan for repor 9.8.3
- 2026-09-14 Version 9.8.2 Security: Users required to use 2FA could extend their own grace period. Fixed: 2FA onboarding after logging in through WooCommerce. Fixed: The firewall could reference advanced-headers.php when the file did not exist. F 9.8.2
- 2026-09-01 Version 9.8.1 Security: Prevented unexpected deletion of the login nonce. Security: Prevented a bug that incorrectly changed the 2FA status from active to open. Security: Prevent XML-RPC logins without 2FA for users with 2FA configure 9.8.1
- 2026-08-25 Version 9.8.0 Fixed: Other plugin installation now retrieves the download link correctly. Fixed: PHP 8.5 compatibility issues. Fixed: The 2FA grace period was not always handled correctly. Changed: REST API checks are faster and run o 9.8.0
- 2026-07-29 Version 9.7.0 Fixed: Alignment of the e-mail validation status icon. Fixed: Vulnerability data is included in uninstall cleanup. Changed: Removed an unused passkey log message. Changed: Updated the Other Plugins section in onboarding 9.7.0
Security history
via Wordfence IntelligenceAll 13 disclosed vulnerabilities are patched in the current version (9.8.4). Sites still on an older version should update.
- Patched Medium · 5.3 Really Simple Security (Free) <= 9.8.2 - Unauthenticated Unbounded Option Growth ↗
- Patched Medium · 5.3 Really Simple Security <= 9.8.0 - Unauthenticated Two-Factor Authentication Bypass ↗
- Patched Critical · 9.8 Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass ↗2024-11-14 CVE-2024-10924 Authentication Bypass Using an Alternate Path or Channel Affects 9.0.0 - 9.1.1.1 Patched in 9.1.2
- Patched Medium · 5.5 Really Simple SSL <= 7.2.3 - Authenticated (Admin+) Server-Side Request Forgery ↗
Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.
CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.
Behavioral tests
via WP HiveAutomated install-time checks, tested on PHP 8.1.12 · WP 7.0.1
Languages
via translate.wordpress.orgTranslated into 64 languages, 41 at 90% or more
Plus 40 more locales with partial translations.
AI assistants
How it's measured →Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.
Share of voice
How often each assistant names Really Simple Security when asked about these topics, where it comes in the answer, and how that compares with its wp.org search position. Latest run 25 Oct 2026.
Readme readiness
7 of 8 pass · checked 26 Oct 2026Can an assistant quote this readme? Eight deterministic checks over the wp.org listing, no model involved.
- ✓ Says what it does "Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, V..."
- ✓ Has a FAQ 9 questions in the FAQ.
- ✓ FAQ asks real questions 9 of 9 read like questions a user would type.
- ! Names who it is for One audience phrase ("if you want"); say who the plugin is for and what they use it for.
- ✓ Names what it works with Mentions LiteSpeed.
- ✓ Headings and lists 17 headings and 11 lists.
- ✓ Enough to quote 5,449 characters of description.
- ✓ Tags match the text All 5 tags appear in the text.
Growth timeline
Install-tier crossings we have observed, and how long each tier took to outgrow
- 2026-02-05 4M+ → 3M+ down after 5 days in tier
- 2026-01-31 3M+ → 4M+ up after 1 days in tier
- 2026-01-30 4M+ → 3M+ down after 570 days in tier
- 2024-07-09 5M+ → 4M+ down after 1316 days in tier
- 2020-12-01 4M+ → 5M+ up after 243 days in tier
- 2020-04-02 3M+ → 4M+ up after 153 days in tier
- 2019-11-01 2M+ → 3M+ up after 183 days in tier
- 2019-05-02 1M+ → 2M+ up after 335 days in tier
Competes with
The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).
-
WebAuthn Provider for Two Factor 2K+ installs · 4.3★ · 3 shared tags A -
Wordfence Security – Firewall, Malware Scan, and Login Security 5M+ installs · 4.7★ · 2 shared tags A -
Hostinger Tools 3M+ installs · 3.6★ · 2 shared tags B -
Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention 1M+ installs · 4.8★ · 2 shared tags A -
Two Factor 100K+ installs · 4.7★ · 2 shared tags A -
Patchstack – WordPress & Plugins Security 100K+ installs · 4.7★ · 2 shared tags A
Embed this report card
Drop a live Pulse card for Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) into a readme, a review or a deck. It updates itself.
<iframe src="https://plugins.wpmayor.com/embed/really-simple-ssl" width="480" height="300" style="border:0" loading="lazy" title="Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) — Plugin Pulse"></iframe> Really Simple Security – Simple and Performant Security (formerly Really Simple SSL): 3M+ active installs, 4.9★ (8,869 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/really-simple-ssl
Spotted a number that looks wrong? Report a data issue and we'll check it against the source.