Category: WordPress Security
Enable an efficient and performant firewall
A firewall is a filter. Specifically, the Really Simple Security firewall looks at requests coming into your site and blocks the ones that look like attacks — things like SQL injection attempts, cross-site scripting, and requests from known malicious IP addresses — before they ever reach WordPress. It runs cleanly in the background. You do not need to configure rules manually. Once it is active, it logs blocked requests so you can see exactly what it has caught. 404 Blocking
Disabling LLA (Limit Login Attempts) when you are locked out
Really Simple Security Pro includes Limit Login Attempts functionality to protect your site against brute force login attacks. Repeated attempts to login using incorrect credentials will be blocked automatically. However, it could be that you’ve accidentally triggered too many invalid Login Attempts yourself, and that you’re (temporarily) locked out of your WordPress Account as a result. Renaming the really-simple-ssl-pro folder in the wp-content/plugins/ directory will allow you to regain access to the site; but as this would deactivate the plugin entirely,
Suspected bots causing 404 errors
You might have received the following notice in your Really Simple Security Dashboard about suspected bots triggering large numbers of “404 Not Found” errors on your site: If your error logs are filling up with 404 errors and you cannot trace them to real users, you are almost certainly dealing with automated bot traffic. Bots scan WordPress sites constantly, looking for accessible configuration files, outdated plugins, or login pages to attack. Most of this traffic is harmless to your site’s
About File Change Detection
The File Change Detection feature (located under SSL & Security -> “Settings” -> Hardening -> File Change Detection) enables a daily scan to monitor if any changes have been made to files in WordPress Core, or files from Plugins or Themes on your site. If files are being modified without performing any updates, and without manually having modified those files via FTP this could indicate that your WordPress installation was infected by malware that targeted & modified those files on your server.
About Login Authentication and 2FA
Really Simple Security offers two login protection approaches. Two-Factor Authentication (2FA) requires a second verification step after entering your password, preventing unauthorized access even if your password is compromised. Method Pros Cons Email Easy setup, no additional apps needed Vulnerable if email account is compromised TOTP/Authenticator More secure, 2FA codes generated on separate device Requires app installation, risk of losing device access Passkey Login replaces passwords entirely with device-based authentication (fingerprint, facial recognition, or security key). Method Pros Cons Passkey