Active installationsNewAdoption metric — not a quality score
WordPress.org ratingNo WordPress.org ratings yet
Official packageDirect from WordPress.org
Repository metrics are context, not quality scores. Active installations measure adoption and can strongly reflect a plugin’s age and historical popularity. Ratings, recent updates and “Tested up to” metadata also do not guarantee modern code, error-free operation, security, feature completeness or suitability for a particular site. Why active installs don’t tell the whole story →
WP PlugIndex currently records Maasters Security Shield version 1.1.6 as active, updated 8h ago and tested up to WordPress 7.1.
Overview
About this plugin
Maasters Security Shield provides configurable baseline hardening controls for WordPress sites. It is not a replacement for updates, backups, strong authentication, or a professional security review.
Features
Baseline security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
Optional HSTS on HTTPS responses, with configurable max-age and opt-in subdomain/preload directives.
Content Security Policy in Disabled, Report Only, or Enforce mode. Report Only is recommended for initial testing.
Failed-login rate limiting with configurable attempt count and lockout duration.
Option to disable XML-RPC authentication and remove the X-Pingback header.
Option to hide WordPress generator/version output.
Option to redirect public author-enumeration query requests.
Capability-protected administration and sanitized settings.
Important Notes
Back up your site and test on staging before enabling HSTS subdomains/preload or enforcing CSP.
CSP defaults are only a starting point; adapt directives for your theme, plugins, fonts, images, scripts, and third-party integrations.
Login attempts are grouped by the REMOTE_ADDR value. Visitors behind the same public IP can share a lockout. Forwarded proxy headers are intentionally not trusted automatically.
To disable the theme/plugin file editor, add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php above the stop-editing line. This plugin does not modify wp-config.php.
Failed-login protection uses the visitor IP address to group attempts and stores attempt counters under an IP-derived transient key in WordPress’s database or object cache. It does not send this information to an external service.
Security headers are emitted only when headers have not already been sent. Other server layers or plugins may also set or override headers.
WordPress.org metadata
Plugin tags
Topics listed for this plugin in the WordPress.org directory.
login protection
security headers
xml rpc
hardening
Compatibility & maintenance
Compatibility & maintenance
Tested with WP 7.1
Marked as tested with the current WordPress 7.1 release.
Current WordPress releaseWordPress 7.1
WordPress.org Tested up to7.1
Minimum requirementsWordPress 5.8 · PHP 7.4
Update activity1 Nov 20268h ago
“Tested up to” is directory metadata supplied by the plugin author. WP PlugIndex does not turn an older declaration into a claim that the plugin is incompatible.
Changes recorded by WP PlugIndex
Recent tracked changes
No tracked version or compatibility changes have been recorded by WP PlugIndex yet.
Tracking & source
WP PlugIndex tracks public WordPress.org directory metadata and records selected version, compatibility and availability changes as they are detected.
