Description
NETSENSAI Shield offers a range of security features, including:
- Changing the login URL to reduce brute force attack risks.
- Disabling the REST API (WP API JSON) for non-logged-in users.
- Disabling XML-RPC to prevent unauthorized access.
- Disabling the WordPress file editor to avoid accidental or malicious changes.
- Disabling Application Passwords to block unauthorized API access.
- Applying advanced HTTP security headers (e.g., HSTS, X-Frame-Options, Content-Security-Policy).
-
Integration with W3 Total Cache:
- Permanently disable
.htaccesswrites by W3TC, - Runtime disabling of Page Cache UI,
- One-time full cache flush on first admin page load,
- Automatic cache flush on Secure Options save,
- Physical cleanup and permanent disable via the W3TC API.
- Permanently disable
- Suppression of Site Health REST API availability notices for non-logged-in users (removes false Site Health errors while maintaining full API blocking).
The free version provides both core and advanced Level 3 security functionalities. A PRO version offers extended support, additional features, and automatic protection enhancements.
Installation
- Download NETSENSAI Shield from the WordPress.org repository or upload the plugin files to
/wp-content/plugins/netsensai-shield/. - Activate the plugin on the WordPress Admin Dashboard under Plugins.
- Navigate to Settings > Secure Options and configure as needed.
FAQ
-
How do I change the WordPress login URL?
-
Go to Settings > Secure Options and enter your preferred path in the Change Login URL field.
-
How does disabling WP API JSON improve security?
-
It reduces exposure of your site’s data via the REST API for non-logged-in users.
-
Why disable XML-RPC?
-
Disabling XML-RPC helps protect against brute force attacks targeting that protocol.
-
What is the effect of disabling the file editor?
-
It prevents code modifications via the dashboard, reducing the risk of malicious changes.
-
What headers are included in Level 3 security?
-
The plugin can apply:
- Strict-Transport-Security (HSTS)
- X-Frame-Options
- X-Content-Type-Options
- Content-Security-Policy (CSP)
- Referrer-Policy
- Permissions-Policy
-
How does the W3 Total Cache integration work?
-
On activation or settings save, NETSENSAI Shield clears the W3TC cache, disables the Page Cache UI to prevent conflicts, and blocks future
.htaccesswrites by W3TC. -
How does suppression of the Site Health REST API notice work?
-
The plugin removes the default REST API availability test in Site Health for guest users, while still enforcing your REST API blocking settings.
Reviews
Contributors & Developers
“NETSENSAI Shield” is open source software. The following people have contributed to this plugin.
Contributors
“NETSENSAI Shield” has been translated into 1 locale. Thank you to the translators for their contributions.
Translate “NETSENSAI Shield” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.4.3
- Fixed readme parsing by removing Markdown syntax from the License URI and ensuring a plain URL.
- Updated short description to fit 150-character limit.
- Removed calls to error_log() flagged by Plugin Check.