Wordfence Security
Endpoint firewall, malware scanner and login security plugin for WordPress, with paid tiers for real-time threat data and hands-on incident response.
80
Shield Security
Automated WordPress security plugin with firewall, silentCAPTCHA bot detection, 2FA and audit log; ShieldPRO adds malware and vulnerability scanning.
Free installs30K+WordPress.org, active
Est. Pro installs~2.8KLikely 1.4K–5.6K
Vendor claims30K+Vendor's own figure
Rating4.8/51,039 reviews
Price from$149/yrFreemium
Last updated27 Oct 2026Version 22.3.4
Overview
Shield Security (WordPress.org slug wp-simple-firewall) is a security plugin that aims to block, repair and report with little manual input. It scores visitors with an offense system: failed logins, firewall hits and bot-check failures add points, and an IP that crosses the threshold is blocked automatically. Everything runs on your own server; there is no external proxy.
Free version
The free plugin is unusually complete. It includes firewall request blocking, automatic IP blocking with daily CrowdSec-sourced blocklists, and silentCAPTCHA, an invisible bot check based on behaviour and timing rather than puzzles or third-party APIs. Login security covers email, authenticator-app and YubiKey 2FA, a hidden login URL, password policies and user session management. It also locks down XML-RPC and the REST API, blocks user enumeration, checks WordPress core files against official checksums with automatic repair, flags unrecognised files and abandoned plugins, and keeps a full activity log plus traffic log.
ShieldPRO
The paid Plus plan adds an AI-based malware scanner, plugin and theme file scanning against WordPress.org originals, a vulnerability scanner with instant alerts and optional automatic updates of affected plugins, traffic rate limiting, passkeys and backup login codes, security headers including CSP, spam protection for contact forms and WooCommerce, the ShieldBACKUPS off-site backups, MainWP integration, WP-CLI, white labelling and site-to-site settings sync. An Enterprise tier with longer backup retention is listed as coming soon.
Limitations
Shield does not offer country blocking (its own blog points users to a separate plugin), has no cloud firewall, no virtual patching and no hands-on malware removal service. Scans run on your server. ShieldPRO pricing is high for a single site compared with plugins like Wordfence or Solid Security, although multi-site tiers scale reasonably.
Shield fits technically minded owners who want strong, automatic protection in the free version, and agencies on MainWP who want white-labelled security with backups in one plugin.
Best for: Owners and agencies who want a feature-rich free security plugin with automatic blocking and solid login security.
Shield gives away more login and hardening features than most free security plugins, and its silentCAPTCHA and automatic IP blocking work with little setup. The gaps are geo-blocking, virtual patching and malware scanning in the free tier, and ShieldPRO is pricey for one site, so it makes most sense for multi-site buyers.
Pros
- Free version includes 2FA, hidden login URL, session management and full audit log
- silentCAPTCHA blocks bots without visible challenges or external services
- Automatic offense-based IP blocking with CrowdSec blocklists
- Core file integrity checks with automatic repair in the free plugin
- PRO bundles malware scanning, vulnerability alerts and off-site backups
- MainWP integration, WP-CLI and white label for agencies
Cons
- No country or geo-blocking
- Malware and vulnerability scanning require ShieldPRO
- No virtual patching or managed malware cleanup
- Single-site PRO price is high relative to competitors
- Scans run on your own server
Key features
What Shield Security highlights on its WordPress.org page and its own website, split by version.
Free version WordPress.org
- Firewall request blocking
- Automatic offense-based IP blocking
- silentCAPTCHA invisible bot detection
- Daily CrowdSec IP blocklists
- 2FA via email, app or YubiKey
- Hide the WordPress login URL
- Password policies and session management
- XML-RPC and REST API lockdown
- Core file scanning with auto-repair
- Full activity and traffic logs
- Comment spam blocking
Pro / paid adds From $149/yr
- AI-based malware scanner
- Plugin and theme file scanning
- Vulnerability scanner with instant alerts
- Auto-update vulnerable plugins
- Traffic rate limiting
- Passkeys and backup login codes
- Security headers and CSP
- Contact form and WooCommerce spam protection
- ShieldBACKUPS off-site backups
- MainWP integration and WP-CLI
- White label and settings sync
Feature checklist
21 of 26 features we track in Security Plugins, feature score 84/100
Firewall & blocking 5/7
Web application firewall Key
Filters malicious requests (SQL injection, XSS and similar) before they reach WordPress.
Firewall rules block malicious requests in the free plugin.
Included
Cloud / DNS-level firewall
Firewall runs on the vendor's network in front of your server, not inside WordPress.
All protection runs on your own server; no vendor proxy.
Not included
Brute-force protection Key
Limits failed logins and locks out attackers guessing passwords.
Failed logins add offense points and trigger automatic IP blocks.
Included
Login CAPTCHA
CAPTCHA or Turnstile on login, registration and password reset forms.
Invisible silentCAPTCHA protects login and registration without a puzzle.
Included
Rate limiting & bot blocking
Throttles or blocks aggressive crawlers and bad bots.
Per-IP traffic rate limiting and DoS protection are ShieldPRO features.
Paid version Plus
Country blocking
Block or allow traffic by country.
Shield has no geo-blocking; its blog recommends a separate plugin.
Not included
Real-time IP blocklist
Blocks IPs known for attacks using shared threat intelligence.
Daily CrowdSec-backed IP blocklists in free; advanced CrowdSec intelligence on Plus.
Included
Scanning & cleanup 5/6
Malware scanner Key
Scans files and database for malware, backdoors and injected code.
AI-based scanner for known and unknown PHP malware requires ShieldPRO.
Paid version Plus
File change detection
Compares core, plugin and theme files with originals and flags changes.
Core files checked against official checksums free; plugin/theme file checks need PRO.
Included
Vulnerability alerts Key
Warns when installed plugins, themes or core have known vulnerabilities.
Vulnerability scanning of installed plugins and themes is a ShieldPRO feature.
Paid version Plus
Scheduled scans
Runs scans automatically on a schedule.
Scans run automatically in the background; PRO allows more frequent scans.
Included
Off-site scanning
Scans run on the vendor's servers so they don't slow your site.
Scans run on the site's own server.
Not included
Malware removal
One-click or expert cleanup of infected sites.
Free auto-repairs core files; PRO repairs plugins/themes and deletes malware. No expert cleanup.
Paid version Plus
Login security 5/5
Two-factor authentication Key
Second login factor via authenticator app, email or similar.
Email codes, authenticator apps and YubiKey OTP in the free plugin.
Included
Passkeys / WebAuthn
Passwordless login with passkeys or hardware security keys.
Passkey and WebAuthn login plus backup codes are ShieldPRO features.
Paid version Plus
Password policies
Enforce strong passwords, expiry or breached-password checks.
Password policies are listed in the free tier.
Included
Custom login URL
Move or hide the wp-login.php / wp-admin login page.
Free option to hide the WordPress login URL.
Included
Session management
View and end active user sessions, limit concurrent logins.
User session management is available free; user suspension is PRO.
Included
Hardening 3/5
One-click hardening
Disable XML-RPC, file editing, user enumeration and similar weak points.
Locks down XML-RPC and REST API and blocks user enumeration.
Included
SSL / HTTPS tools
Enforce HTTPS, fix mixed content and redirects.
No HTTPS enforcement or mixed-content tools in the feature list.
Not included
Security headers
Set HSTS, CSP, X-Frame-Options and other HTTP security headers.
Security headers and Content Security Policy are PRO features.
Paid version Plus
Virtual patching
Firewall rules that block exploits for known plugin vulnerabilities before an update is available.
No virtual patching rules for specific plugin vulnerabilities are offered.
Not included
Auto-update vulnerable plugins
Automatically updates plugins with known vulnerabilities.
Vulnerability scanner can auto-upgrade affected plugins once a fix is released.
Paid version Plus
Monitoring & management 3/3
Activity log Key
Records logins, changes and admin actions for auditing.
Full activity log and traffic monitoring free; third-party plugin logging on Enterprise.
Included
Security alerts
Email or app alerts for attacks, lockouts and scan results.
Security reports in free; instant vulnerability alerts with PRO.
Included
Multi-site dashboard
Manage security for many sites from one dashboard.
Multi-site management via MainWP integration and settings sync is PRO.
Paid version Plus
Pricing
Free
$0On WordPress.org
Plus
$149per year1 site
Also $29/month. 3 sites $249, 5 $299, 10 $399, 25 $699, 50 $999, 100 $1,299 per year.
Plus (10 sites)
$399per year10 sites
Same features as Plus 1-site; includes MainWP integration and white label.
Enterprise
$199per year1 site
Listed as coming soon; up to $1,549/yr for 100 sites. Longer backup retention and more frequent backups.
Prices are list prices from the vendor's site, checked 14 Oct 2026. Many vendors discount the first year.
How many sites use Shield Security?
Free installs from WordPress.org, the vendor's own claim, and our estimate of paid installs.
Free version (WordPress.org)
30K+
Active installations reported by WordPress.org.
Vendor claim
30K+
Sites/users claimed on the vendor's website. source
Estimated Pro / paid installs
~2.8K
Our estimate, see method below.
How we estimated this: The vendor figure (30K+) is within WordPress.org's rounding of the free installs, so it says nothing about paid sites. About 35K free installs x 8% (the usual share of free sites that also run the paid version when some key features are paid) gives 2.8K. Likely range: 1.4K to 5.6K. This counts sites running the paid version, including sites whose licence has lapsed. Estimates are rough and based on public figures as of 14 Oct 2026.
Stats & health
Weekly downloads
16,256 downloads last week, 12.9M all time
Rating breakdown
| Version | 22.3.4 |
|---|---|
| Last updated | 27 Oct 2026 (6 days ago) |
| Tested up to | WordPress 7.2 |
| Requires | WordPress 5.7+, PHP 7.4+ |
| Support threads (2 months) | 1 of 1 resolved |
| On WordPress.org since | 9 Jul 2013 |
Company & policy
| Refund policy | Money-back guarantee (duration not stated) (source, 5 Oct 2026) |
|---|
Shield Security compared
Shield Security/Wordfence Security
Shield Security/Kadence Security (formerly Solid Security)
Shield Security/Sucuri Security
All-In-One Security (AIOS)/Shield Security
Really Simple Security/Shield Security
Jetpack Protect/Shield Security
Defender Security/Shield Security
Patchstack/Shield Security
Shield Security/WP Cerber Security
Limit Login Attempts Reloaded/Shield Security
MalCare Security/Shield Security Alternatives to Shield Security
Sucuri Security
Free auditing, file integrity and remote scanning plugin from Sucuri that connects to its paid cloud firewall and malware cleanup platform.
87
Defender Security
WPMU DEV's WordPress security plugin with malware scanning, AntiBot firewall, 2FA with passkeys, hardening and audit logs; Pro adds scheduled scans.
79
MalCare Security
Cloud-scanning WordPress security plugin with a plugin-level firewall, login protection and paid one-click malware cleanup, for site owners and agencies.
80
Kadence Security (formerly Solid Security)
Login-focused WordPress security plugin (formerly Solid Security / iThemes Security) with 2FA, brute-force protection and Patchstack virtual patching in Pro.
77
WP Cerber Security
Self-distributed WordPress security plugin with firewall, anti-spam, malware scanner, 2FA and custom login URL; PRO adds GEO rules and scheduled scans.
69
FAQ
Is Shield Security free?
Yes. Shield Security has a free version on WordPress.org. Paid plans start at $149/yr.
How many sites use Shield Security?
WordPress.org reports 30K+ active installations of the free version. The vendor claims 30K+ sites in total. We estimate around 2.8K sites run the paid version.
Does Shield Security have web application firewall?
Yes: included. Firewall rules block malicious requests in the free plugin.
Does Shield Security have brute-force protection?
Yes: included. Failed logins add offense points and trigger automatic IP blocks.
Does Shield Security have malware scanner?
Yes: paid version (Plus). AI-based scanner for known and unknown PHP malware requires ShieldPRO.
Does Shield Security have vulnerability alerts?
Yes: paid version (Plus). Vulnerability scanning of installed plugins and themes is a ShieldPRO feature.
Does Shield Security have two-factor authentication?
Yes: included. Email codes, authenticator apps and YubiKey OTP in the free plugin.
Does Shield Security have activity log?
Yes: included. Full activity log and traffic monitoring free; third-party plugin logging on Enterprise.
Is Shield Security free?
Yes, the core plugin is free on WordPress.org with firewall, bot detection, 2FA, audit logging and core file scanning. ShieldPRO adds malware and vulnerability scanning, backups and agency tools.
Does Shield block countries?
No. Shield relies on IP reputation and automatic blocking; for country blocking you need a separate geo-blocking plugin or a CDN rule.
What is silentCAPTCHA?
An invisible bot check that uses timing, form interaction and request signals instead of a visible puzzle or a third-party CAPTCHA service.
Does it work with MainWP?
Yes, MainWP integration is part of ShieldPRO, along with import/export and site-to-site settings sync.
Last updated 5 Oct 2026. Spotted something wrong? Suggest an edit.