Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning
by Paul · Security
Also makes 5 other plugins · 131.1K+ installs across the portfolio →
Smart WordPress security that blocks bots automatically, guides you to what matters, and repairs problems — without drowning you in noise.
Try it live opens a temporary test site in your browser, which can take about 20 seconds to load. Plugins that rely on outside services or a full server may not work completely there.
Health
A 89/100
no flags
Active installs
30K+
≈38K estimated
Momentum
+8%
downloads vs prior 30d
Biggest opportunity: Swap “security”, “2fa” and “activity log” for “blocking”, “brute force login” and “scanning”. “security” isn't earning its slot: you're not in the first 24 results for its own search. “blocking” sits at #4 untagged, close enough for a declared tag to move it up. “2fa” isn't earning its slot: it only gets you to #23. “brute force login” sits at #4 untagged, close enough for a declared tag to move it up. “activity log” isn't earning its slot: it only gets you to #17. “scanning” sits at #4 untagged, close enough for a declared tag to move it up. All five slots are taken, so one has to go.
89 health vs 66 average across 1,777 Security plugins
Install conversion
How it's measured →0.2%
of downloads still active
At least 30K of 12.9M lifetime downloads are still running, below its category: the median Security plugin keeps 1.4%, across 1,060 plugins.
Downloads count every update, not just first installs, so older and more frequently released plugins read lower. Compare against other Security plugins, not across the directory. wp.org reports active installs as the bottom of a band, so the real rate is this or higher.
This plugin shipped 25 releases in the last 12 months, and every existing install that updated counted as another download. wp.org publishes no split between first installs and updates, so we show the raw rate rather than guess at one.
Details
Directory ranking optimization
How it's scored →How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.
Excellent listing optimization
Well tuned across the board
Updated 5 days ago
Tested up to WordPress 7.2, the current branch or newer
4.8★ over 1,039 reviews, smoothed to 4.77★
5 of 5 tags set · short description in place
1 of 1 support threads resolved in the last 2 months
Search visibility
How it's tracked →Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.
37
Momentum
Losing ground
-0.3
Velocity
places per keyword, 28d
18%
Breadth
of keywords climbing, 28d
-0.2
Acceleration
recent half vs earlier
wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.
| Keyword | wp.org | On merit | wp.org move, 90 days |
|---|---|---|---|
| bot blocking | #1 | #1 | 0 |
| blocking | #4 | #3 | up 1 |
| scanning | #4 | #4 | down 1 |
| brute force login | #4 | #4 | up 1 |
| force login | #8 | #6 | up 1 |
| login protection | #9 | #6 | down 3 |
| bots your tag | #11 | #7 | down 2 |
| bot | #11 | #7 | down 1 |
| brute | #11 | #8 | 0 |
| brute force | #11 | #8 | down 3 |
| file integrity | #7 | #3 | down 1 |
| block bots | #8 | #6 | 0 |
| ip blocking | #9 | #8 | down 1 |
| problems | #14 | #11 | 0 |
| activity log your tag | #17 | #10 | down 4 |
| bot detection | #10 | #6 | down 2 |
| firewall your tag | #17 | #13 | down 3 |
| brute force protection | #11 | #8 | down 2 |
| bot protection | #11 | #6 | down 2 |
| protection | #20 | #13 | down 4 |
| security your tag | Not in the top 24 | ||
218 searches this plugin appeared in over the last 90 days, 20 listed. 171 left out as unrelated or noise (years, numbers, stray words). 1 of its tags isn't in the top 24 for their own search.
What to do about it
- Swap “security”, “2fa” and “activity log” for “blocking”, “brute force login” and “scanning”. “security” isn't earning its slot: you're not in the first 24 results for its own search. “blocking” sits at #4 untagged, close enough for a declared tag to move it up. “2fa” isn't earning its slot: it only gets you to #23. “brute force login” sits at #4 untagged, close enough for a declared tag to move it up. “activity log” isn't earning its slot: it only gets you to #17. “scanning” sits at #4 untagged, close enough for a declared tag to move it up. All five slots are taken, so one has to go.
- Under-ranked on “2fa”. wp.org puts you #23; on merit you place #13. The plugins above you are winning on install count, not on rating or upkeep.
- One page off on “bots”. #11 puts you just past the first ten results, where almost all the clicks stop. The gap to close is small.
Daily downloads
Since 5 Oct 2022 · 1,489 days · wp.org + Plugin Pulse archive
30-day downloads
Rolling 30-day volume · peak 142.8K · peaks are release surges
Directory rank vs rivals
wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you
Rating trend
Star average over time · dips mark rough releases
Health trend
Composite health score, snapshotted daily
Update activity
How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.
Release cadence
Actively maintainedHow often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.
25
releases in the last 12 months
5d ago
latest release · v22.3.4 · 27 Oct 2026
123
tagged releases on record
Recent releases
What its installed base runs
via wordpress.orgShare of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.
Estimated active installs
The public count shows “30K+”. Our estimate pins where the real number sits.
Crossed into this band 4 months ago and the previous band took 17 months to cross, so the real count is still just under 40K.
Install history since 2 Oct 2021
Recent reviews
All reviews on wp.org ↗- ★★★★★ Fields4mo ago
what happened to the option to block an ip address? i have years of effort in there and it seems utterly gone from the interface….. i got seven big critical new warnings and they all relate to settings in pro…. what a joke you are… only want warnings that relate to what i have installed…. shield’s greed of late is vile…and if you took away the ip block then adios, although i already deactivated…. shield seems more a sales plugin for a highly pricy obnoxious annual plan—anyone without a life plan never gets my money–than a security plugin you actually need and that does not take away features while throwing up red flags you can’t even act upon…..
Read on wp.org ↗ - ★★★★★ belleisle5mo ago
When I reached out to the team for support, they were very reactive and forthcoming. I very much appreciate their plugin and have now switched all of my WordPress installs to this all-in-one solution.
Read on wp.org ↗ - ★★★★★ coughlin5mo ago
I have used several other security and firewall plugins on our sites, and some of them are very frustrating to use and cost just about as much. I like Shield Security becuase: The interface is much more intuitive for me to navigate than some of the others It has the features I need, and they actually work as expected The inline help text and explainer videos really help when configuring tools The reports are helpful, not just data Paul has been very responsive to questions and super helpful While there may be less expensive plugins for WP security, this one packs a lot into the price and makes it worth the investment for my sites.
Read on wp.org ↗ - ★★★★★ masorey5mo ago
I’ve been using this software since day one, and it has always been good and reliable. Best of all, whenever I’ve had any trouble, the support team has been incredibly helpful and lightning fast.
Read on wp.org ↗ - ★★★★★ peachpit5mo ago
My client picked this plugin, not me. And I just spent 2 days recovering and repairing their website. It was so bad, and that’s why I had to leave a review. We all know that premium versions of security plugins offer more security, in general. I manage around 50 websites currently; all of them are on Free Wordfence security, except this one. None of them have been hacked. Do with that what you will. Take some time to understand what is being restricted and what protection & control you actually have when using this particular plugin’s free version. Nothing is perfect, but this free version was really unnecessarily bad. I couldn’t even run a follow up scan-even THAT is restricted? Yeah, no.
Read on wp.org ↗ - ★★★★★ sondrasneed8mo ago
I’m so tired of visitors being locked out of client sites, clients being locked out. I have no idea how to get real support. It’s sold as a simple, robust security plugin, but it’s by no means simple; unless you’re a security expert. I want a refund but have no idea how to reach someone to get it. So unhappy. This topic was modified 4 months, 1 week ago by sondrasneed.
Read on wp.org ↗ - ★★★★★ exoduss1.1y ago
Installed it two times, and each time it completely blocked access to the WordPress dashboard. Had to use FTP to delete this plugin.
Read on wp.org ↗ - ★★★★★ Amanda Mae1.4y ago
I’m a web developer and I like Shield Security. It’s solid and offers strong protection. That said, after following their advice to improve my security grade, I couldn’t edit the WordPress Customizer for months. Support was polite but mostly suggested generic fixes like disabling HTTP headers, which didn’t solve the problem. It took me some digging to find the real cause. The issue was the anonymous REST API setting blocking access. Once I disabled anonymous REST API, everything worked again. I realize this was my fault for not researching the setting before enabling it, but since Shield’s dashboard recommended it to improve my security score, it caught me off guard. Shield Security is the best security plugin on the market, but it would be helpful if they added a clearer caution about how some settings might break parts of WordPress. It’s powerful but comes with some tricky trade-offs.
Read on wp.org ↗
Security history
via Wordfence IntelligenceAll 12 disclosed vulnerabilities are patched in the current version (22.3.4). Sites still on an older version should update.
- Patched High · 7.2 Shield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log ↗2026-10-30 CVE-2026-118057 Improper Neutralization of Input During Web Page Generation Affects <= 22.3.2 Patched in 22.3.4
- 2026-02-18 CVE-2026-0722 Improper Neutralization of Special Elements used in an SQL Command Affects <= 21.0.8 Patched in 21.0.10
- Patched Medium · 6.1 Shield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter ↗2026-02-18 CVE-2026-0561 Improper Neutralization of Input During Web Page Generation Affects <= 21.0.8 Patched in 21.0.10
- Patched Medium · 4.3 Shield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator ↗2026-01-15 CVE-2025-15370 Authorization Bypass Through User-Controlled Key Affects <= 21.0.9 Patched in 21.0.10
- Patched Medium · 6.1 Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 20.0.5 - Reflected Cross-Site Scripting ↗2024-08-05 CVE-2024-7313 Improper Neutralization of Input During Web Page Generation Affects <= 20.0.5 Patched in 20.0.6
- Patched Critical · 9.8 Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion ↗2024-02-05 CVE-2023-6989 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 18.5.9 Patched in 18.5.10
- Patched High · 7.2 Shield Security <= 18.5.7 - Unauthenticated Stored Cross-Site Scripting via getColumnContent_Page ↗2024-01-16 CVE-2024-22163 Improper Neutralization of Input During Web Page Generation Affects <= 18.5.7 Patched in 18.5.8
- 2023-04-25 CVE-2023-0992 Improper Neutralization of Input During Web Page Generation Affects < 17.0.18 Patched in 17.0.18
- 2022-01-19 CVE-2022-0211 Improper Neutralization of Input During Web Page Generation Affects <= 13.0.5 Patched in 13.0.6
Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.
CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.
Behavioral tests
via WP HiveAutomated install-time checks, tested on PHP 8.1.12 · WP 7.0
Languages
via translate.wordpress.orgTranslated into 11 languages, 1 at 90% or more
AI assistants
How it's measured →Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.
Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.
Readme readiness
8 of 8 pass · checked 27 Oct 2026Can an assistant quote this readme? Eight deterministic checks over the wp.org listing, no model involved.
- ✓ Says what it does "Smart WordPress security that blocks bots automatically, guides you to what matters, and repairs problems —..."
- ✓ Has a FAQ 8 questions in the FAQ.
- ✓ FAQ asks real questions 8 of 8 read like questions a user would type.
- ✓ Names who it is for Names its audience or use cases ("built for", "who want", "if you have").
- ✓ Names what it works with Mentions WooCommerce, Elementor, Contact Form 7, Ninja Forms and 3 more.
- ✓ Headings and lists 8 headings and 8 lists.
- ✓ Enough to quote 6,377 characters of description.
- ✓ Tags match the text All 5 tags appear in the text.
Growth timeline
Install-tier crossings we have observed, and how long each tier took to outgrow
- 2026-07-14 40K+ → 30K+ down after 502 days in tier
- 2025-02-27 50K+ → 40K+ down after 780 days in tier
- 2023-01-09 60K+ → 50K+ down after 557 days in tier
- 2021-07-01 70K+ → 60K+ down after 303 days in tier
- 2020-09-01 80K+ → 70K+ down after 62 days in tier
- 2020-07-01 70K+ → 80K+ up after 30 days in tier
- 2020-06-01 80K+ → 70K+ down after 792 days in tier
- 2018-04-01 70K+ → 80K+ up after 179 days in tier
Competes with
The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).
-
Wordfence Security – Firewall, Malware Scan, and Login Security 5M+ installs · 4.7★ · 3 shared tags A -
Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention 1M+ installs · 4.8★ · 3 shared tags A -
BBQ Firewall – Fast & Powerful Firewall Security 100K+ installs · 4.9★ · 3 shared tags A -
Security Plugin, Firewall & Malware Scanner with Auto Removal 40K+ installs · 4.7★ · 3 shared tags A -
Advanced IP Blocker 3K+ installs · 4.6★ · 3 shared tags A -
Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… 3K+ installs · 4.6★ · 3 shared tags A
Embed this report card
Drop a live Pulse card for Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning into a readme, a review or a deck. It updates itself.
<iframe src="https://plugins.wpmayor.com/embed/wp-simple-firewall" width="480" height="300" style="border:0" loading="lazy" title="Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning — Plugin Pulse"></iframe> Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning: 30K+ active installs, 4.8★ (1,039 reviews). Plugin Pulse (WP Mayor), as of 2026-11-01. https://plugins.wpmayor.com/plugin/wp-simple-firewall
Spotted a number that looks wrong? Report a data issue and we'll check it against the source.