Title: Maasters Security Shield Author: The Maasters Published: November 1, 2026 Last modified: November 1, 2026 --- Search plugins ![](https://ps.w.org/maasters-security-shield/assets/banner-772x250.png?rev=3778412) ![](https://ps.w.org/maasters-security-shield/assets/icon-256x256.png?rev=3778412) # Maasters Security Shield By [The Maasters](https://profiles.wordpress.org/themaasters/) [Download](https://downloads.wordpress.org/plugin/maasters-security-shield.1.1.6.zip) * [Details](https://wordpress.org/plugins/maasters-security-shield/#description) * [Reviews](https://wordpress.org/plugins/maasters-security-shield/#reviews) * [Installation](https://wordpress.org/plugins/maasters-security-shield/#installation) * [Development](https://wordpress.org/plugins/maasters-security-shield/#developers) [Support](https://wordpress.org/support/plugin/maasters-security-shield/) ## Description Maasters Security Shield provides configurable baseline hardening controls for WordPress sites. It is not a replacement for updates, backups, strong authentication, or a professional security review. ### Features * Baseline security headers: X-Frame-Options, X-Content-Type-Options, Referrer- Policy, and Permissions-Policy. * Optional HSTS on HTTPS responses, with configurable max-age and opt-in subdomain/ preload directives. * Content Security Policy in Disabled, Report Only, or Enforce mode. Report Only is recommended for initial testing. * Failed-login rate limiting with configurable attempt count and lockout duration. * Option to disable XML-RPC authentication and remove the X-Pingback header. * Option to hide WordPress generator/version output. * Option to redirect public author-enumeration query requests. * Capability-protected administration and sanitized settings. ### Important Notes * Back up your site and test on staging before enabling HSTS subdomains/preload or enforcing CSP. * CSP defaults are only a starting point; adapt directives for your theme, plugins, fonts, images, scripts, and third-party integrations. * Login attempts are grouped by the REMOTE_ADDR value. Visitors behind the same public IP can share a lockout. Forwarded proxy headers are intentionally not trusted automatically. * To disable the theme/plugin file editor, add `define( 'DISALLOW_FILE_EDIT', true);` to wp-config.php above the stop-editing line. This plugin does not modify wp- config.php. * Failed-login protection uses the visitor IP address to group attempts and stores attempt counters under an IP-derived transient key in WordPress’s database or object cache. It does not send this information to an external service. * Security headers are emitted only when headers have not already been sent. Other server layers or plugins may also set or override headers. ## Installation 1. Upload the `maasters-security-shield` folder to `/wp-content/plugins/` or install the ZIP through Plugins > Add New > Upload Plugin. 2. Activate the plugin. 3. Open **Maasters Shield** in the WordPress admin sidebar to configure protections. 4. Test changes on a staging site before enabling strict policies. ## FAQ ### Will this plugin make my site completely secure? No. It adds configurable hardening controls but cannot replace timely updates, strong authentication, reliable backups, least-privilege access, HTTPS, or a security review. ### Should I enable Content Security Policy enforcement immediately? No. Start with Report Only, test your pages and integrations, adjust the policy, and only consider Enforce mode after confirming legitimate resources are not blocked. ### When should I enable HSTS, includeSubDomains, or preload? Enable HSTS only when your site is consistently served over HTTPS. Include subdomains only when every affected subdomain supports HTTPS. The preload directive does not itself submit your domain to browser preload lists. ### Why can login protection affect multiple visitors? Failed attempts are counted by the connecting IP address in REMOTE_ADDR. Visitors sharing a public IP address may share the same rate limit. Proxy headers are not trusted automatically because they can be spoofed unless your server is configured to validate them. ### Does the plugin send data to a third party? No. It does not send telemetry or login-failure data to an external service. Login protection stores local attempt counters using an IP-derived transient key. ### How can I disable the theme and plugin file editor? Add `define( 'DISALLOW_FILE_EDIT', true );` to wp-config.php above the stop-editing line. Maasters Security Shield does not edit wp-config.php. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Maasters Security Shield” is open source software. The following people have contributed to this plugin. Contributors * [ The Maasters ](https://profiles.wordpress.org/themaasters/) [Translate “Maasters Security Shield” into your language.](https://translate.wordpress.org/projects/wp-plugins/maasters-security-shield) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/maasters-security-shield/), check out the [SVN repository](https://plugins.svn.wordpress.org/maasters-security-shield/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/maasters-security-shield/) by [RSS](https://plugins.trac.wordpress.org/log/maasters-security-shield/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.6 * Added a distinct `maassesh_` prefix to PHP declarations, constants, option and transient keys, settings groups, asset handles, error codes, and CSS selectors. * Migrated existing `mss_settings` options without losing saved configuration. * Preserved active login lockouts created with the previous transient prefix. #### 1.1.5 * Added the required translators comment for the login-lockout message placeholder. * Updated the readme and internationalization metadata for submission. #### 1.1.4 * Fixed login-lockout checks so existing authentication errors cannot bypass the rate limit. * Starts the configured lockout duration when the attempt threshold is reached and does not extend lockouts on each blocked retry. * Keeps HSTS and CSP behavior independent from the baseline header toggle. * Loads the admin stylesheet only on the Maasters Shield settings page. * Added FAQ and upgrade notice sections; improved privacy and policy documentation. #### 1.1.3 * Replaced the sidebar icon with a dedicated 20 x 20 PNG asset. #### 1.1.2 * Updated the sidebar icon handling and admin stylesheet rules. #### 1.1.1 * Moved the plugin to a branded top-level admin menu. * Added the brand logo to the dashboard header. * Updated author-enumeration handling to use WordPress query vars. #### 1.1.0 * Rebuilt the settings screen with functional security controls. * Added login protection settings and CSP modes. * Added configurable HSTS max-age with opt-in subdomain/preload directives. * Removed the obsolete X-XSS-Protection header and duplicate files. * Added settings validation and IP validation. #### 1.0.1 * Initial security hardening and settings foundation. ## Meta * Version **1.1.6** * Last updated **8 hours ago** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [hardening](https://wordpress.org/plugins/tags/hardening/)[login protection](https://wordpress.org/plugins/tags/login-protection/) [security](https://wordpress.org/plugins/tags/security/)[Security Headers](https://wordpress.org/plugins/tags/security-headers/) [xml-rpc](https://wordpress.org/plugins/tags/xml-rpc/) * [Advanced View](https://wordpress.org/plugins/maasters-security-shield/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/maasters-security-shield/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/maasters-security-shield/reviews/) ## Contributors * [ The Maasters ](https://profiles.wordpress.org/themaasters/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/maasters-security-shield/)