Wordfence Security
Endpoint firewall, malware scanner and login security plugin for WordPress, with paid tiers for real-time threat data and hands-on incident response.
80
Really Simple Security
SSL migration and lightweight hardening plugin (formerly Really Simple SSL) with vulnerability alerts, plus a Pro firewall, 2FA and security headers.
Free installs3M+WordPress.org, active
Est. Pro installs~240KLikely 120K–480K
Vendor claims5M+Vendor's own figure
Rating4.9/58,869 reviews
Price from$69/yrFreemium
Last updated26 Oct 2026Version 9.8.4
Overview
Really Simple Security began life as Really Simple SSL, the plugin many site owners install to move a site to HTTPS in one click. It has since grown into a general security plugin from Really Simple Plugins, while keeping its original WordPress.org slug and its focus on doing things with few settings.
What the free version covers
The free plugin enforces HTTPS with PHP or .htaccess 301 redirects, sets secure cookies, can help install a Let’s Encrypt certificate and runs a server health check. A set of hardening toggles prevents code execution in the uploads folder, hides login feedback, blocks user enumeration, disables XML-RPC and directory browsing, and stops the use of names like ‘admin’. It also warns you when installed plugins, themes or core have known vulnerabilities, and offers email-based two-factor authentication that you can enforce per role.
What Pro adds
- Firewall: 404-based crawler blocking, region blocking and IP allow and block lists with automated rules.
- Login protection: limit login attempts with hCaptcha or reCAPTCHA, TOTP 2FA, passkeys, strong-password enforcement and forced password changes.
- Headers and SSL: HSTS with preload, a mixed-content scanner and fixer, and automatically generated Content Security Policy plus other security headers.
- Vulnerability measures: force updates or quarantine vulnerable plugins, plus extra hardening such as a custom login URL and database prefix changes.
Pro renews at $69 a year for one site, with 5- and 25-domain plans and first-year discounts.
Limitations
There is no malware scanner, file integrity check or cleanup service, and the firewall works on access rules rather than inspecting requests for SQL injection or XSS payloads. Most of the login protections that rivals give away, such as limit login attempts and app-based 2FA, are behind the Pro licence.
Who should pick it
It suits site owners who want HTTPS, sensible hardening and vulnerability alerts with almost no configuration, and those who value automatic header and CSP generation. Pair it with a malware scanner if you need detection as well as prevention.
Best for: Site owners who want HTTPS, light hardening and vulnerability alerts with minimal setup, and can add a separate malware scanner.
Really Simple Security is the easiest way to get HTTPS and a sensible hardening baseline, and Pro's header, CSP and vulnerable-plugin automation are genuinely useful. It is not a complete suite, though: without malware scanning or a request-inspecting firewall it works best alongside another tool.
Pros
- One-click HTTPS migration and redirects
- Simple free hardening toggles with safe defaults
- Free vulnerability notifications for plugins, themes and core
- Pro auto-generates a Content Security Policy
- Pro can force-update or quarantine vulnerable plugins
- Pro includes passkeys and TOTP 2FA
Cons
- No malware scanner or file integrity monitoring
- Limit login attempts and CAPTCHA require Pro
- Free 2FA is email-only
- Firewall is rule-based, not a request-inspecting WAF
Key features
What Really Simple Security highlights on its WordPress.org page and its own website, split by version.
Free version WordPress.org
- One-click HTTPS migration
- 301 redirects via PHP or .htaccess
- Let's Encrypt certificate helper
- Secure cookie settings
- Block code execution in uploads
- Disable user enumeration
- Disable XML-RPC and directory browsing
- Block 'admin' and public usernames
- Vulnerability notifications
- Email two-factor authentication
- Enforce 2FA by user role
- Multisite network settings
Pro / paid adds From $69/yr
- Firewall with 404 crawler blocking
- Region blocking
- IP allow and block lists
- Limit login attempts with CAPTCHA
- TOTP two-factor authentication
- Passkey login
- Strong password and expiry rules
- HSTS with preload support
- Mixed content scanner and fixer
- Auto-generated Content Security Policy
- Force-update or quarantine vulnerable plugins
- Custom login URL
Feature checklist
16 of 26 features we track in Security Plugins, feature score 54/100
Firewall & blocking 5/7
Web application firewall Key
Filters malicious requests (SQL injection, XSS and similar) before they reach WordPress.
Pro firewall uses automated access rules (404s, regions, IPs) rather than payload inspection.
Partial Pro
Cloud / DNS-level firewall
Firewall runs on the vendor's network in front of your server, not inside WordPress.
Rules run on your own server.
Not included
Brute-force protection Key
Limits failed logins and locks out attackers guessing passwords.
Limit Login Attempts with configurable thresholds.
Paid version Pro
Login CAPTCHA
CAPTCHA or Turnstile on login, registration and password reset forms.
hCaptcha or reCAPTCHA with Limit Login Attempts.
Paid version Pro
Rate limiting & bot blocking
Throttles or blocks aggressive crawlers and bad bots.
404 blocking stops crawlers triggering unusual numbers of 404s.
Paid version Pro
Country blocking
Block or allow traffic by country.
Region blocking allows or blocks access by region.
Paid version Pro
Real-time IP blocklist
Blocks IPs known for attacks using shared threat intelligence.
Pro offers manual IP block/allow lists; no shared threat-intel feed.
Not included
Scanning & cleanup 2/6
Malware scanner Key
Scans files and database for malware, backdoors and injected code.
Does not scan files or database for malware.
Not included
File change detection
Compares core, plugin and theme files with originals and flags changes.
No comparison of files with originals.
Not included
Vulnerability alerts Key
Warns when installed plugins, themes or core have known vulnerabilities.
Notifies about vulnerable plugins, themes and core (WP Vulnerability data).
Included
Scheduled scans
Runs scans automatically on a schedule.
Vulnerability checks recur automatically; there are no malware scans.
Partial
Off-site scanning
Scans run on the vendor's servers so they don't slow your site.
No vendor-side scanning service.
Not included
Malware removal
One-click or expert cleanup of infected sites.
No cleanup tool or service.
Not included
Login security 4/5
Two-factor authentication Key
Second login factor via authenticator app, email or similar.
Free email 2FA enforceable per role; TOTP is Pro.
Included
Passkeys / WebAuthn
Passwordless login with passkeys or hardware security keys.
Passkey (WebAuthn) login in Pro.
Paid version Pro
Password policies
Enforce strong passwords, expiry or breached-password checks.
Enforce strong passwords and periodic password changes.
Paid version Pro
Custom login URL
Move or hide the wp-login.php / wp-admin login page.
Custom login URL is part of advanced hardening.
Paid version Pro
Session management
View and end active user sessions, limit concurrent logins.
No active session viewer or concurrent-login limits.
Not included
Hardening 4/5
One-click hardening
Disable XML-RPC, file editing, user enumeration and similar weak points.
Disable XML-RPC, user enumeration, directory browsing, uploads code execution.
Included
SSL / HTTPS tools
Enforce HTTPS, fix mixed content and redirects.
One-click HTTPS, 301 redirects, secure cookies; mixed-content fixer in Pro.
Included
Security headers
Set HSTS, CSP, X-Frame-Options and other HTTP security headers.
HSTS, X-Frame-Options, Referrer-Policy and auto-generated CSP.
Paid version Pro
Virtual patching
Firewall rules that block exploits for known plugin vulnerabilities before an update is available.
No exploit-blocking rules for specific vulnerabilities.
Not included
Auto-update vulnerable plugins
Automatically updates plugins with known vulnerabilities.
Can force updates or quarantine vulnerable plugins and themes.
Paid version Pro
Monitoring & management 1/3
Activity log Key
Records logins, changes and admin actions for auditing.
No audit trail of admin and content changes.
Not included
Security alerts
Email or app alerts for attacks, lockouts and scan results.
Sends notifications when vulnerabilities are found.
Included
Multi-site dashboard
Manage security for many sites from one dashboard.
Only a multisite network settings page; no multi-site dashboard.
Not included
Pricing
Free
$0On WordPress.org
Personal
$69per year1 site
First year $49.
Professional
$119per year5 sites
First year $99.
Agency
$209per year25 sites
First year $199; includes the multisite plugin.
Prices are list prices from the vendor's site, checked 14 Oct 2026. Many vendors discount the first year.
How many sites use Really Simple Security?
Free installs from WordPress.org, the vendor's own claim, and our estimate of paid installs.
Free version (WordPress.org)
3M+
Active installations reported by WordPress.org.
Vendor claim
5M+
Sites/users claimed on the vendor's website. source
Estimated Pro / paid installs
~240K
Our estimate, see method below.
How we estimated this: About 3.5M free installs x 5.6% (the usual share of free sites that also run the paid version when some key features are paid, lower for very large free bases) gives 200K. The vendor claims 5M+ sites in total. Taking away about 3.5M free installs leaves 1.5M, and 80% of that is 1.2M. Vendor totals are loose, so we only move our figure part of the way toward it, from 200K to 240K. Likely range: 120K to 480K. This counts sites running the paid version, including sites whose licence has lapsed. Estimates are rough and based on public figures as of 14 Oct 2026.
Stats & health
Weekly downloads
1,228,062 downloads last week, 223.1M all time
Rating breakdown
| Version | 9.8.4 |
|---|---|
| Last updated | 26 Oct 2026 (8 days ago) |
| Tested up to | WordPress 7.1.4 |
| Requires | WordPress 6.6+, PHP 7.4+ |
| Support threads (2 months) | 8 of 8 resolved |
| On WordPress.org since | 15 Mar 2015 |
Company & policy
| Refund policy | 30-day money-back (source, 5 Oct 2026) |
|---|
Really Simple Security compared
Defender Security/Really Simple Security
Patchstack/Really Simple Security
Really Simple Security/WP Cerber Security
Limit Login Attempts Reloaded/Really Simple Security
MalCare Security/Really Simple Security
Really Simple Security/Shield SecurityReally Simple Security/Wordfence Security
Really Simple Security/Kadence Security (formerly Solid Security)
Really Simple Security/Sucuri Security
All-In-One Security (AIOS)/Really Simple Security
Jetpack Protect/Really Simple Security Alternatives to Really Simple Security
Sucuri Security
Free auditing, file integrity and remote scanning plugin from Sucuri that connects to its paid cloud firewall and malware cleanup platform.
87
Defender Security
WPMU DEV's WordPress security plugin with malware scanning, AntiBot firewall, 2FA with passkeys, hardening and audit logs; Pro adds scheduled scans.
79
Shield Security
Automated WordPress security plugin with firewall, silentCAPTCHA bot detection, 2FA and audit log; ShieldPRO adds malware and vulnerability scanning.
84
MalCare Security
Cloud-scanning WordPress security plugin with a plugin-level firewall, login protection and paid one-click malware cleanup, for site owners and agencies.
80
Kadence Security (formerly Solid Security)
Login-focused WordPress security plugin (formerly Solid Security / iThemes Security) with 2FA, brute-force protection and Patchstack virtual patching in Pro.
77
FAQ
Is Really Simple Security free?
Yes. Really Simple Security has a free version on WordPress.org. Paid plans start at $69/yr.
How many sites use Really Simple Security?
WordPress.org reports 3M+ active installations of the free version. The vendor claims 5M+ sites in total. We estimate around 240K sites run the paid version.
Does Really Simple Security have web application firewall?
Yes: partial (Pro). Pro firewall uses automated access rules (404s, regions, IPs) rather than payload inspection.
Does Really Simple Security have brute-force protection?
Yes: paid version (Pro). Limit Login Attempts with configurable thresholds.
Does Really Simple Security have malware scanner?
No: not included. Does not scan files or database for malware.
Does Really Simple Security have vulnerability alerts?
Yes: included. Notifies about vulnerable plugins, themes and core (WP Vulnerability data).
Does Really Simple Security have two-factor authentication?
Yes: included. Free email 2FA enforceable per role; TOTP is Pro.
Does Really Simple Security have activity log?
No: not included. No audit trail of admin and content changes.
Is Really Simple Security the same as Really Simple SSL?
Yes. It is the same plugin (WordPress.org slug really-simple-ssl), renamed as it expanded from SSL migration into general security.
Does it scan for malware?
No. It detects known vulnerabilities in plugins, themes and core, but it does not scan files for malware or offer cleanup.
Which features need Pro?
The firewall, limit login attempts and CAPTCHA, TOTP 2FA and passkeys, security headers and HSTS, mixed-content fixing, custom login URL and automatic handling of vulnerable plugins.
Can I use it alongside another security plugin?
Generally yes, as long as you avoid enabling overlapping features such as two login limiters or two sets of redirects or headers.
Last updated 5 Oct 2026. Spotted something wrong? Suggest an edit.