Title: ITPS Shield Author: IT Pro Services Published: November 8, 2026 Last modified: November 8, 2026 --- Search plugins ![](https://ps.w.org/itps-shield/assets/banner-772x250.png?rev=3791446) ![](https://ps.w.org/itps-shield/assets/icon.svg?rev=3791446) # ITPS Shield By [IT Pro Services](https://profiles.wordpress.org/ahmedadmin/) [Download](https://downloads.wordpress.org/plugin/itps-shield.1.5.3.zip) * [Details](https://wordpress.org/plugins/itps-shield/#description) * [Reviews](https://wordpress.org/plugins/itps-shield/#reviews) * [Installation](https://wordpress.org/plugins/itps-shield/#installation) * [Development](https://wordpress.org/plugins/itps-shield/#developers) [Support](https://wordpress.org/support/plugin/itps-shield/) ## Description ITPS Shield locks down a WordPress site in a few clicks. Open **Settings ITPS Shield Security Audit**, press **Harden now**, and the plugin switches on every protection that is safe for any site. Server (.htaccess) rules are only written when you ask for them, and each one is tested and rolled back automatically if your server rejects it. The plugin never edits or deletes WordPress core files; the audit tells you what to fix by hand. #### HTTPS / SSL * Force HTTPS: every http:// request is redirected to https://, the admin and login use HTTPS, cookies are marked secure and browsers are told to upgrade insecure requests. * The SSL certificate is tested before Force HTTPS can be switched on, so you can’t lock the site into a broken HTTPS. * Optional mixed-content fixer and HSTS. #### Login protection * Custom login address: move wp-login.php to an address you choose. /wp-login.php and /wp-admin/ show “Not Found” to logged-out visitors. * Brute-force lockout per IP, applied after the password check so a correct password can’t bypass it, with email alerts and an unlock screen. * Login honeypot and real-browser check that stop scripted brute-force tools. * Generic login errors, strong-password enforcement, optional idle logout and maximum session length. * Email alerts when any account becomes an Administrator, or an administrator logs in from a new IP. #### Spam protection without CAPTCHA * Comments, WordPress and WooCommerce sign-ups, and contact forms: Contact Form 7, WPForms, Gravity Forms, Elementor Pro Forms, Fluent Forms, Formidable Forms and Ninja Forms. * Invisible honeypot, real-browser check and minimum fill time. Real visitors see nothing. * Sign-ups from disposable email addresses are refused; comments with too many links go to spam. * Disable comments site-wide in one click (comments, pingbacks, admin menus, comment blocks, comment feeds and the comments REST API). #### Firewall and attack surface * Request firewall for SQL injection, XSS, path traversal, stream wrappers, code injection, null bytes and probes for .env, .git and wp-config.php, plus vulnerability- scanner user agents. * XML-RPC and pingbacks disabled, user enumeration blocked (?author=N, REST /wp/ v2/users, oEmbed, user sitemap). * Optional REST API restriction for logged-out visitors with an allow-list. * Theme/plugin file editor disabled; optional block on installing or uploading plugins and themes from the dashboard (updates still work). #### Hide WordPress * Removes the generator tag, WordPress links and headers and the emoji script. * Replaces ?ver= on every core, theme and plugin file with a hash, so versions can’t be read but caches still refresh after updates. * Hides the plugin list in /wp-json/ and blocks plugin readme and changelog files, logs and backups in wp-content. * Your own site icon and name on the login page, and no WordPress logo as a fallback favicon. * Optional “Protected by ITPS Shield” page for blocked visitors (off by default; it includes a credit link). #### Server hardening * Security headers (nosniff, frame protection, referrer and permissions policy). * No PHP execution in uploads; optional root .htaccess hardening that also blocks readme.html, license.txt and wp-config-sample.php. * Every .htaccess file is tested with a real request after it is written and removed again if the server answers with an error. * The audit checks wp-config.php permissions and version-revealing files and explains how to fix them. #### Audit and monitoring * Security Audit with a score, per-check Fix buttons and a one-click Harden now. * Core file integrity scan against the official checksums from WordPress.org, plus detection of unknown PHP files in wp-admin and wp-includes. * Activity log, locked-IP list and IP allow-list (IPv4 / IPv6 addresses and IPv4 ranges). ITPS Shield has no external service, no account and no tracking. The only outside request is the core file scan, which downloads WordPress’s official checksums from api.wordpress.org when you run it. ## Screenshots [⌊Security Audit with score, Harden now and per-check Fix buttons.⌉⌊Security Audit with score, Harden now and per-check Fix buttons.⌉[ Security Audit with score, Harden now and per-check Fix buttons. [⌊Settings: HTTPS, login address, login protection and spam protection.⌉⌊Settings: HTTPS, login address, login protection and spam protection.⌉[ Settings: HTTPS, login address, login protection and spam protection. [⌊The optional "Protected by ITPS Shield" page.⌉⌊The optional "Protected by ITPS Shield" page.⌉[ The optional “Protected by ITPS Shield” page. [⌊Locked IPs: brute-force lockouts with one-click unlock.⌉⌊Locked IPs: brute-force lockouts with one-click unlock.⌉[ Locked IPs: brute-force lockouts with one-click unlock. [⌊Activity log of blocked attacks, login lockouts and spam.⌉⌊Activity log of blocked attacks, login lockouts and spam.⌉[ Activity log of blocked attacks, login lockouts and spam. [⌊The Security Audit after one click on "Harden now".⌉⌊The Security Audit after one click on "Harden now".⌉[ The Security Audit after one click on “Harden now”. ## Installation 1. Install through Plugins Add New, or upload the itps-shield folder to /wp-content/ plugins/. 2. Activate the plugin. Activation only saves the default settings; it does not write any files. 3. Go to Settings ITPS Shield and add your own IP address to the allow-list. 4. If the site is behind Cloudflare or a load balancer, enable “Trust proxy”. Otherwise leave it off. 5. Open the Security Audit tab and press “Harden now” (or “Install server rules” in the notice) to install the .htaccess rules. 6. Optional: set a custom login address in Settings and bookmark it. ## FAQ ### I forgot my custom login address Add `define( 'ITPS_SHIELD_DISABLE_LOGIN_URL', true );` to wp-config.php, log in at /wp-login.php, check the address in Settings ITPS Shield, then remove the line. The address is also emailed to the site admin whenever it changes. ### My login says “please enable JavaScript” The real-browser check needs JavaScript. Enable it, or add `define( 'ITPS_SHIELD_DISABLE_JS_CHECK', true );` to wp-config.php. ### I locked myself out with too many attempts Wait for the lockout to end, or log in from an IP on the allow-list. As a last resort, rename wp-content/plugins/itps-shield by FTP or your hosting file manager; the plugin deactivates. ### Does it work on Nginx? Yes. Everything except the .htaccess rules works on any server. On Nginx the Security Audit shows the equivalent server rules to add. ### Does it slow the site down? No. The checks are lightweight, run inside WordPress and make no external requests. The spam trap is a small inline script only for logged-out visitors. ### Will the spam protection block real visitors? Real visitors never see it. A submission is only refused when the hidden honeypot field is filled, the form was sent without a real browser, or it was sent within a few seconds of opening the page (adjustable). ## Reviews There are no reviews for this plugin. ## Contributors & Developers “ITPS Shield” is open source software. The following people have contributed to this plugin. Contributors * [ IT Pro Services ](https://profiles.wordpress.org/ahmedadmin/) [Translate “ITPS Shield” into your language.](https://translate.wordpress.org/projects/wp-plugins/itps-shield) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/itps-shield/), check out the [SVN repository](https://plugins.svn.wordpress.org/itps-shield/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/itps-shield/) by [RSS](https://plugins.trac.wordpress.org/log/itps-shield/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.5.3 * Custom login address: links and redirects are only rewritten when they point to this site’s own wp-login.php (same host, same path). URLs on other sites, and URLs that only mention wp-login.php in a query parameter, are no longer changed. * Stricter URL matching in the mixed-content fixer (only this site’s exact host), the sub-directory check and the REST API allow-list (whole namespaces only). #### 1.5.2 * Activation no longer writes any .htaccess file. The rules are installed from the plugin screen, and every location (site root, wp-content, uploads) is tested with a real request and rolled back if the server answers with HTTP 500. * IP allow-list: entries are validated strictly. IPv4 ranges need a whole-number prefix from 1 to 32; malformed ranges, /0 and other invalid entries are rejected with a notice and ignored if already saved. * The plugin no longer deletes readme.html, license.txt or wp-config-sample.php and no longer changes wp-config.php permissions. The audit explains how to do it, and “Harden root .htaccess” can block those files instead. #### 1.5.1 * Security: every value read from the request ($_SERVER, $_POST, $_GET) is now sanitized as it is read; firewall evidence is stored through esc_url_raw(). * The mixed-content fixer now uses the WordPress 6.9+ template enhancement output buffer instead of opening its own output buffer; older WordPress versions use content, block, widget and image URL filters. * Force HTTPS redirects now go through wp_safe_redirect(). #### 1.5.0 * Prepared for the WordPress.org plugin directory: scripts and styles are now enqueued, WordPress file APIs are used for file changes, and the “Protected by ITPS Shield” page (with its credit link) is now opt-in. * Tested with WordPress 7.1. #### 1.4.1 * Fix: the protection page uses the ITPS shield as its tab icon; /favicon.ico no longer falls back to the WordPress logo. #### 1.4.0 * New: comment, sign-up and contact-form spam protection, disposable email blocking, comment link limit. * New: disable comments site-wide. * New: login real-browser check. * New: “Protected by ITPS Shield” page for blocked visitors. #### 1.3.0 * New “Hide WordPress” options, block plugin/theme installs, maximum session length. #### 1.2.0 * New: one-click Harden now, security score and per-check Fix buttons. #### 1.1.0 * New: Force HTTPS, custom login URL, login honeypot, idle logout, admin alerts, REST restriction, core file scan. #### 1.0.0 * Initial release. ## Meta * Version **1.5.3** * Last updated **17 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [firewall](https://wordpress.org/plugins/tags/firewall/)[login security](https://wordpress.org/plugins/tags/login-security/) [security](https://wordpress.org/plugins/tags/security/)[spam](https://wordpress.org/plugins/tags/spam/) [ssl](https://wordpress.org/plugins/tags/ssl/) * [Advanced View](https://wordpress.org/plugins/itps-shield/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/itps-shield/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/itps-shield/reviews/) ## Contributors * [ IT Pro Services ](https://profiles.wordpress.org/ahmedadmin/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/itps-shield/)