Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 68% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

1. ★★★★★ Fields

   1mo ago

   what happened to the option to block an ip address? i have years of effort in there and it seems utterly gone from the interface….. i got seven big critical new warnings and they all relate to settings in pro…. what a joke you are… only want warnings that relate to what i have installed…. shield’s greed of late is vile…and if you took away the ip block then adios, although i already deactivated…. shield seems more a sales plugin for a highly pricy obnoxious annual plan—anyone without a life plan never gets my money–than a security plugin you actually need and that does not take away features while throwing up red flags you can’t even act upon…..

   Read on wp.org ↗
2. ★★★★★ belleisle

   2mo ago

   When I reached out to the team for support, they were very reactive and forthcoming. I very much appreciate their plugin and have now switched all of my WordPress installs to this all-in-one solution.

   Read on wp.org ↗
3. ★★★★★ coughlin

   2mo ago

   I have used several other security and firewall plugins on our sites, and some of them are very frustrating to use and cost just about as much. I like Shield Security becuase: The interface is much more intuitive for me to navigate than some of the others It has the features I need, and they actually work as expected The inline help text and explainer videos really help when configuring tools The reports are helpful, not just data Paul has been very responsive to questions and super helpful While there may be less expensive plugins for WP security, this one packs a lot into the price and makes it worth the investment for my sites.

   Read on wp.org ↗
4. ★★★★★ masorey

   3mo ago

   I’ve been using this software since day one, and it has always been good and reliable. Best of all, whenever I’ve had any trouble, the support team has been incredibly helpful and lightning fast.

   Read on wp.org ↗
5. ★★★★★ peachpit

   3mo ago

   My client picked this plugin, not me. And I just spent 2 days recovering and repairing their website. It was so bad, and that’s why I had to leave a review. We all know that premium versions of security plugins offer more security, in general. I manage around 50 websites currently; all of them are on Free Wordfence security, except this one. None of them have been hacked. Do with that what you will. Take some time to understand what is being restricted and what protection & control you actually have when using this particular plugin’s free version. Nothing is perfect, but this free version was really unnecessarily bad. I couldn’t even run a follow up scan-even THAT is restricted? Yeah, no.

   Read on wp.org ↗
6. ★★★★★ sondrasneed

   6mo ago

   I’m so tired of visitors being locked out of client sites, clients being locked out. I have no idea how to get real support. It’s sold as a simple, robust security plugin, but it’s by no means simple; unless you’re a security expert. I want a refund but have no idea how to reach someone to get it. So unhappy. This topic was modified 4 months, 1 week ago by sondrasneed.

   Read on wp.org ↗
7. ★★★★★ exoduss

   11mo ago

   Installed it two times, and each time it completely blocked access to the WordPress dashboard. Had to use FTP to delete this plugin.

   Read on wp.org ↗
8. ★★★★★ Amanda Mae

   1.2y ago

   I’m a web developer and I like Shield Security. It’s solid and offers strong protection. That said, after following their advice to improve my security grade, I couldn’t edit the WordPress Customizer for months. Support was polite but mostly suggested generic fixes like disabling HTTP headers, which didn’t solve the problem. It took me some digging to find the real cause. The issue was the anonymous REST API setting blocking access. Once I disabled anonymous REST API, everything worked again. I realize this was my fault for not researching the setting before enabling it, but since Shield’s dashboard recommended it to improve my security score, it caught me off guard. Shield Security is the best security plugin on the market, but it would be helpful if they added a clearer caution about how some settings might break parts of WordPress. It’s powerful but comes with some tricky trade-offs.

   Read on wp.org ↗

11 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 6.5 Shield Security <= 21.0.8 - Cross-Site Request Forgery to SQL Injection ↗
   2026-02-18 CVE-2026-0722 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 21.0.8 Patched in 21.0.10
2. Medium · 6.1 Shield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter ↗
   2026-02-18 CVE-2026-0561 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 21.0.8 Patched in 21.0.10
3. Medium · 4.3 Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches <= 21.0.9 - Missing Authorization to Authenticated (Subscriber+) Email MFA Update ↗
   2026-02-18 CVE-2025-14427 Missing Authorization Affects <= 21.0.9 Patched in 21.0.10
4. Medium · 4.3 Shield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator ↗
   2026-01-15 CVE-2025-15370 Authorization Bypass Through User-Controlled Key Affects <= 21.0.9 Patched in 21.0.10
5. Medium · 6.1 Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 20.0.5 - Reflected Cross-Site Scripting ↗
   2024-08-05 CVE-2024-7313 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 20.0.5 Patched in 20.0.6
6. Medium · 4.3 Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 19.1.13 - Cross-Site Request Forgery ↗
   2024-06-01 CVE-2024-4344 Cross-Site Request Forgery (CSRF) Affects <= 19.1.10 Patched in 19.1.11
7. Critical · 9.8 Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion ↗
   2024-02-05 CVE-2023-6989 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Affects <= 18.5.9 Patched in 18.5.10
8. High · 7.2 Shield Security <= 18.5.7 - Unauthenticated Stored Cross-Site Scripting via getColumnContent_Page ↗
   2024-01-16 CVE-2024-22163 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 18.5.7 Patched in 18.5.8
9. High · 7.2 Shield Security <= 17.0.17 - Unauthenticated Stored Cross-Site Scripting ↗
   2023-04-25 CVE-2023-0992 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 17.0.18 Patched in 17.0.18
10. Medium · 4.3 Shield Security <= 17.0.17 - Missing Authorization ↗
    2023-04-25 CVE-2023-0993 Missing Authorization Affects < 17.0.18 Patched in 17.0.18
11. Medium · 5.5 Shield Security <= 13.0.5 - Admin+ Stored Cross-Site Scripting ↗
    2022-01-19 CVE-2022-0211 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 13.0.5 Patched in 13.0.6

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 11 languages, 1 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-07-14 40K+ → 30K+ down after 502 days in tier
2. 2025-02-27 50K+ → 40K+ down after 780 days in tier
3. 2023-01-09 60K+ → 50K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Wordfence Security – Firewall, Malware Scan, and Login Security 5M+ installs · 4.7★ · 3 shared tags A
• Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention 1M+ installs · 4.8★ · 3 shared tags A
• BBQ Firewall – Fast & Powerful Firewall Security 100K+ installs · 4.9★ · 3 shared tags A
• Security Plugin, Firewall & Malware Scanner with Auto Removal 40K+ installs · 4.7★ · 3 shared tags A
• Advanced IP Blocker 2K+ installs · 4.5★ · 3 shared tags A
• Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… 2K+ installs · 4.6★ · 3 shared tags A

Embed this report card

Drop a live Pulse card for Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning into a readme, a review or a deck. It updates itself.

Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning: 30K+ active installs, 4.8★ (1,038 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/wp-simple-firewall