Firewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team. Make security a priority with Wordfence.
- Installs
- 5+ million
- Rating
- 4.7 (5K)
- Updated
- 31 days ago
Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning
Smart WordPress security that blocks bots automatically, guides you to what matters, and repairs problems — without drowning you in noise.
- Active installs
- 30,000+
- #935 of 1,000
- Downloads, all time
- 12.9M
- 12,913,185
- Downloads, 30 days
- 58.2K
- 16.3K in the last 7
- Rating
- 4.8 / 5
- 1,039 reviews
- Last updated
- 4 days ago
- Oct 27, 2026
- Version
- 22.3.4
- 124 releases
Upkeep and compatibility
| Last updated | October 27, 2026Updated in the last 3 months |
|---|---|
| Tested up to | WordPress 7.2Covers WordPress 7.1.4, the current release |
| Needs WordPress | 5.7 or newer |
| Needs PHP | 7.4 or newer |
| First published | July 9, 2013 |
| Support, last two months | 1 of 1 threads resolved (100%) |
Reviews
4.8 / 5 from 1,039 reviews
| 5 stars | 969 |
|---|---|
| 4 stars | 26 |
| 3 stars | 12 |
| 2 stars | 9 |
| 1 star | 23 |
Downloads, last 30 days
What the author says it does
Most security plugins hand you a dashboard full of alerts and expect you to know what to do next. Shield works differently.
It blocks threats automatically, repairs what it can on its own, and then shows you exactly what still needs your attention — ranked by impact, not volume. Less noise. More action.
🤖 Security That Runs Itself
The most powerful thing Shield does is what it handles without you:
- Automatic IP Blocking — every visitor is quietly scored as they interact with your site. Failed logins, firewall blocks, silentCAPTCHA failures, and other signals accumulate into a reputation score. When a visitor’s score crosses the threshold, Shield blocks them — automatically, without you lifting a finger
- Automatic File Repair — when a file integrity scan finds a changed WordPress core file, Shield pulls the original from WordPress.org and restores it. Detected and fixed, without waiting for you to act
- Automatic Bot Recognition — Shield identifies legitimate crawlers (Google, Bing, DuckDuckGo, Yandex, Apple) and known services (ManageWP, Pingdom, Stripe, CloudFlare) and never blocks them. Your SEO and monitoring tools keep working
🧭 Guided Security, Not Just a Dashboard
Shield organises your security into four focused areas so you always know where to look:
The opening of the plugin's own description. The full text, installation notes and changelog are on its WordPress.org page.
Questions the author answers
How does automatic IP blocking work?
Shield assigns offense points to visitors who trigger security rules — failed logins, firewall blocks, silentCAPTCHA failures, and other signals. When a visitor’s points reach the configured threshold, they are blocked automatically. You can review blocked IPs, adjust thresholds, or add manual rules from the IP Rules section.
How does silentCAPTCHA detect bots without interrupting real visitors?
It analyses passive signals — timing, form interaction behaviour, and request characteristics — to distinguish automated requests from genuine visitors. There is no challenge to complete, no external site keys to set up, and no JavaScript that can break your forms. Everything stays on your server.
My server already has a firewall. Why do I need Shield too?
Your host or network firewall protects the server perimeter. Shield works inside WordPress, where it understands login attempts, user changes, plugin activity, file integrity, and attack patterns specific to WordPress. The two layers solve different problems and complement each other.
Can Shield block comment SPAM?
Yes. silentCAPTCHA protects the WordPress comment form in the free plugin. ShieldPRO extends coverage to Contact Form 7, Ninja Forms, WooCommerce, and a range of other integrations.
Can I use Shield alongside another security plugin?
Generally, no. Running two plugins that control the same login or request flows leads to duplicate blocking, noisier logs, and harder troubleshooting. If you keep another plugin active, disable the areas where they overlap.
I’ve locked myself out of my site. What do I do?
This usually happens after adding your own IP to the block list, or enabling 2FA when your site cannot deliver email codes.
- Open an FTP or file manager connection to <your WordPress root>/wp-content/plugins/wp-simple-firewall/.
- Create a file in that folder called forceoff.
- Load any page on your site — Shield will switch off.
Delete forceoff from the server once you are back in.
Screenshots
Security overview with current site status, important recommendations, and recent security events.
Tagged
Plugins that share its tags
WordPress login security with brute force protection, Two-factor authentication (2FA/MFA), firewall, IP/country blocking, and login monitoring
- Installs
- 1+ million
- Rating
- 4.8 (1.5K)
- Updated
- 38 days ago
#346 by installs
BBQ Firewall – Fast & Powerful Firewall Security
The fastest firewall plugin for WordPress. Protect against a wide range of threats with minimal performance impact.
- Installs
- 100,000+
- Rating
- 4.9 (160)
- Updated
- 3 months ago
#882 by installs
Security Plugin, Firewall & Malware Scanner with Auto Removal
Protect WordPress from malware, hackers, brute-force attacks & suspicious traffic. Includes firewall, login security, 2FA & vulnerability checks.
- Installs
- 40,000+
- Rating
- 4.8 (397)
- Updated
- 4 days ago
Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate.
- Installs
- 3+ million
- Rating
- 4.9 (8.9K)
- Updated
- 5 days ago
#51 by installs
Security Optimizer – The All-In-One Protection Plugin
Secure your WordPress site from brute-force attacks, threats, malware, and bots. Free to use and easy to set up.
- Installs
- 1+ million
- Rating
- 4.5 (157)
- Updated
- 17 days ago
Where this page's numbers come from
Read from the WordPress.org plugin API on , when WordPress 7.1.4 was the current release. WordPress.org rounds active installs into buckets. These are the directory's figures, not my verdict, and I haven't tested this plugin. The author takes donations at their donate page.