Maasters Security Shield

Maasters Security Shield provides configurable baseline hardening controls for WordPress sites. It is not a replacement for updates, backups, strong authentication, or a professional security review.

Features

• Baseline security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
• Optional HSTS on HTTPS responses, with configurable max-age and opt-in subdomain/preload directives.
• Content Security Policy in Disabled, Report Only, or Enforce mode. Report Only is recommended for initial testing.
• Failed-login rate limiting with configurable attempt count and lockout duration.
• Option to disable XML-RPC authentication and remove the X-Pingback header.
• Option to hide WordPress generator/version output.
• Option to redirect public author-enumeration query requests.
• Capability-protected administration and sanitized settings.

Important Notes

• Back up your site and test on staging before enabling HSTS subdomains/preload or enforcing CSP.
• CSP defaults are only a starting point; adapt directives for your theme, plugins, fonts, images, scripts, and third-party integrations.
• Login attempts are grouped by the REMOTE_ADDR value. Visitors behind the same public IP can share a lockout. Forwarded proxy headers are intentionally not trusted automatically.
• To disable the theme/plugin file editor, add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php above the stop-editing line. This plugin does not modify wp-config.php.
• Failed-login protection uses the visitor IP address to group attempts and stores attempt counters under an IP-derived transient key in WordPress’s database or object cache. It does not send this information to an external service.
• Security headers are emitted only when headers have not already been sent. Other server layers or plugins may also set or override headers.