Yes, under Fully Static mode: no public request reaches the WordPress runtime at all — only static files and a narrow set of Shield services are reachable. It's the strictest of the three protection modes, and it isn't the right fit for every site.
Under this mode, there is zero public WordPress endpoint left reachable — no wp-login, no REST API, no plugin AJAX routes, nothing. Only the static release itself and Static Shield's own narrow services respond to public requests.
Administrators reach WordPress through a private, authenticated path rather than the public one — permanently via a trusted IP, or on demand via Vault Mode (Pro).
Brochure sites, blogs, and anything without forms, search, or e-commerce that needs to stay reachable for anonymous visitors are the clearest fit — this is the mode with the largest attack-surface reduction.
The moment a site needs even one publicly reachable dynamic feature — a contact form, site search, a shopping cart — Fully Static is too strict on its own. Static + Bridges or Hybrid mode exist for exactly that case.
Static Shield Lite is free to install and inspects your actual WordPress install, not just the public surface.
Get Static Shield
Tulapp