← Integrations

Static Shield + Really Simple Security

Really Simple Security's HTTPS enforcement and security headers are fixed, request-independent values that map directly onto static host or CDN edge configuration — no live check needed. Login-attempt rate limiting, where the installed tier includes it, stays dynamic since it can only see attempts that actually reach wp-login.php. Its hidden/renamed login URL, forced 2FA, and vulnerability scanning are all admin-side, private concerns unaffected by serving mode.

Recommended mode

Hybrid

Static behavior

HTTPS redirection and a fixed set of security response headers (HSTS, X-Content-Type-Options, Referrer-Policy, and similar) are the same on every request, so they translate directly into the static host or CDN's own edge/header configuration.

Dynamic behavior

Login-attempt rate limiting, where the installed tier/version includes it, only ever sees attempts that actually reach wp-login.php through WordPress — under Fully Static or Zero-WordPress/Vault Mode it protects little of the real traffic despite still appearing "active" in the plugin's own dashboard.

Bridges & routes

None — nothing here is a narrow, bridgeable endpoint. The header/HTTPS behavior is static host config, and rate limiting, where present, is a dynamic, whole-route concern rather than something a single bridge route can front.

Setup

No special setup — detected automatically once active.

Limitations

Its hidden/renamed login URL does the same job as Static Shield's own Admin Access Gateway — and the same job again if the separate WPS Hide Login plugin is also active. Running more than one login-hardening layer at once can produce conflicting redirects, a login URL that stops resolving, or an admin getting locked out after deactivating one while the other still expects its own rewrite to be in place; pick a single layer for this site. Login-attempt rate limiting isn't bundled in every tier/version and hasn't been behaviorally validated against a real install — there's no free/test license available to confirm it, so this is a documented starting point, not a guarantee.