← Documentation

Using the Static Shield plugin

What actually happens when you install Static Shield, the three protection modes, and the Pro features that go further once a static release is live.

Install and activate

Static Shield installs like any WordPress plugin. Once active, its own admin menu is organised into tabs: Overview, Plugins (compatibility), Dynamic Content Scan, Fingerprint Shield, Attack Surface, Access & Isolation, Server Integration, Shield Preview, Static Search, and Site DNA. Overview is the starting point — it walks through setup in order.

Choose a protection mode

Static Shield builds a static release of your site, then decides how strictly to isolate the live WordPress backend behind it. There are three modes:

Before switching modes, the Dynamic Content Scan and Plugins tabs help you see which parts of your site actually need to stay dynamic (forms, search, WooCommerce, membership areas) so you don't pick a stricter mode than your site can support.

Publish

Publishing builds a new static release in the background and swaps it in once it's ready — your current release keeps serving visitors the entire time, so there's no downtime while a build runs. Shield Preview lets you check a candidate release before it goes live.

Keeping wp-admin access

Isolating the public site doesn't mean losing access to WordPress itself. The Access & Isolation tab is where the admin access path, trusted IPs, and the two Pro isolation features live:

• Zero-WordPress Mode — default-deny at the edge: once active, only static files and the specific routes you've approved are publicly reachable, everything else is blocked before it reaches WordPress. Requires a static release, adequate coverage, and an Attack Surface scan first — the tab walks through that readiness checklist.
• Vault Mode — a stricter, separate mode for temporarily opening admin access on demand (e.g. from a specific IP, for a limited time) rather than leaving it permanently reachable. It has the same readiness requirements as Zero-WordPress Mode.

Server cron

Under strict isolation, wp-cron.php triggered over real HTTP is one of the things that can end up blocked along with everything else — which matters for scheduled tasks, subscription renewals, and queued emails (this doesn't affect WP-CLI cron). The Access & Isolation tab includes a how-to for replacing the HTTP trigger with a real server cron job, for Linux crontab or common hosting control panels.

Server Integration

The Server Integration tab detects which webserver is actually serving your site (Apache, LiteSpeed, nginx, Caddy, or IIS) and generates the matching configuration rules for enforcing isolation at the edge, since each webserver expects a different rule syntax.

Fingerprint Shield, Static Search, and Site DNA

Fingerprint Shield reduces the markers that reveal a site is running WordPress in the first place. Static Search lets on-site search keep working against the static release without a live WordPress request per query. Site DNA tracks what changed between releases, so you can see exactly what a publish actually changed before or after it goes live.