Every plugin feature Static Shield knows about is classified into one of six modes. The mode answers a single question: when a visitor triggers this feature, does the request reach WordPress — and if so, how much of it?
Modes are set per feature, not per plugin. A plugin's overall classification — Full Static, Static + Bridge, Hybrid Supported — is a rollup of its features' modes, not the other way round. You will see them in the Plugins tab, in the Mode column of an expanded component, and in the Override dropdown beside it.
No request reaches WordPress.
Fully prerendered at build time and served from disk. No PHP executes, no database query runs, WordPress is never involved. This is the goal state for most page content.
No request reaches WordPress — one small part resolves in the browser.
The page is static, but one small piece genuinely differs per visitor: a "dynamic island" resolved client-side rather than by a server round-trip.
The core Log In/Out block is the textbook case — its link text and destination depend on
the viewer's own login state, which the browser can determine by checking for the
WordPress logged-in cookie. Native search behaves the same way once Static Search is on:
served from the prebuilt index instead of a live ?s= query.
One narrow, approved path reaches WordPress.
An explicitly approved endpoint that does reach WordPress, exposing only the single path the feature needs rather than the whole application. Bridges are rate-limited — 20 requests per minute by default for core features.
Comment submission is one. WP-Cron is another, and a good illustration of why bridges exist at all: WordPress's built-in pseudo-cron only ever runs because a visitor's page load triggers it. On a site where visitors never reach PHP, scheduled events — publishing a future-dated post, subscription renewals, backup jobs — simply stop firing, with no error anywhere.
The full WordPress application is reachable on this path.
The request falls through to WordPress. The feature works exactly as it always did, and the entire WordPress surface is reachable on that path. This is the largest attack surface of the six, and it is used deliberately: when Static Shield cannot safely narrow something, it says Dynamic rather than guessing and quietly breaking the feature.
Reachable, but only by you.
Answers only for an allowlisted admin address or path, via the Admin Access Gateway. The
public internet gets nothing. wp-login.php and wp-admin become
Private once the gateway is on; so does WP-Cron once offloaded to a real system cron.
Refused for everyone.
Nothing serves it, publicly or privately. XML-RPC is the common example — a legacy
authentication endpoint frequently targeted for brute-force and amplification, which most
sites do not need. Author enumeration via ?author=N is another: it reveals
valid usernames for credential-guessing and has no static-site use case.
This is the part worth understanding, because it explains why an override changes a plugin's verdict:
| Mode | Counts as | Effect on the plugin's classification |
|---|---|---|
| Static | Static | Pushes toward Full Static |
| Static Fragment | Bridged | Pushes toward Static + Bridge |
| Shield Bridge | Bridged | Pushes toward Static + Bridge |
| Dynamic | Dynamic | Pulls down to Hybrid Supported |
| Private | Resolved | Excluded from the ratio entirely |
| Blocked | Resolved | Excluded from the ratio entirely |
Two consequences follow from that table, and both surprise people:
There is also a seventh internal mode, Unknown, which is not offered as an override. It means no adapter has classified that feature. Unknown on half or more of a plugin's features makes it Experimental; fewer makes it Partially Supported. Those are the rows highlighted for review.
Least exposed to most:
Blocked → Private → Static → Static Fragment → Shield Bridge → Dynamic
The Override dropdown (a Pro feature) lets you set a mode yourself when the adapter's classification is wrong for your site — which is exactly what a low confidence score is telling you to look at.
An override changes how Static Shield treats a feature, not what the feature needs. Forcing something to Static or Blocked because it looks better in the matrix will break it if it genuinely required a live request. And because Private and Blocked are excluded from the classification ratio, that same override also improves the score — so the wrong choice can look like an improvement. Change a mode because you know what the feature does, not because you want a greener row.
After an override, use Shield Preview and the Dynamic Content Scan to confirm the feature still behaves — the preview builds a candidate without touching your live site, which is the safe place to find out you were wrong.
Tulapp