What Really Simple Security does on your WordPress site
Really Simple Security, formerly Really Simple SSL, is developed by the Dutch company Really Simple Plugins. Its core job is still moving a site to HTTPS: it detects the certificate, sends every http address to https with a 301 redirect (in PHP or in the .htaccess file), turns on secure cookies and fixes mixed content on the fly, meaning images or scripts still loaded over http. On hosting that allows manual certificate installation, it can also generate a Let’s Encrypt certificate.
The plugin has grown into a lightweight security suite, managed from the “Security” menu. The free version adds hardening checkboxes (code execution blocked in the uploads folder, XML-RPC disabled, user enumeration blocked, and more), vulnerability detection powered by the open WP Vulnerability database, and two-factor authentication with a code sent by email, which you can enforce per role. The developer describes it as modular: a disabled feature doesn’t load its code.
Pro adds a firewall (blocking bursts of 404 errors, region blocking, IP lists), limit login attempts with a CAPTCHA, TOTP authenticator apps and passkeys, security headers including HSTS and Content Security Policy, a full mixed content scan, and automatic measures for vulnerable plugins (forced update, quarantine). The Personal license costs $69 per year for one site ($49 for the first year with the advertised discount).
Which sites Really Simple Security suits best
- Sites moving to HTTPS that want clean redirects and fixed mixed content without editing files (see our guide to HTTPS on WordPress).
- Blogs and small business sites looking for basic hardening and vulnerability alerts, without a firewall or heavy scans.
- Multi-author sites that want to require two-factor authentication for some roles without buying a license.
It’s a weaker fit if you want a free web application firewall and malware scanning: neither the free version nor Pro advertises file scanning of that kind, while Wordfence includes it for free. It also overlaps with any full security suite you already run: two two-factor modules or two login limiters get in each other’s way.
Really Simple Security strengths and limitations
Strengths
- Near-automatic HTTPS migration. The 301 redirect, secure cookies and the mixed content fixer take a few clicks.
- Free, readable hardening. Each measure is an explained checkbox you can turn off if it causes trouble.
- Free vulnerability alerts. A plugin, theme or core version with a known flaw is flagged, including by email.
- Free two-factor authentication. Email codes can be enforced per role, with a grace period so users can get set up.
Limitations
- No firewall or login limiting on the free plan. Both brute force defenses are Pro only.
- Free two-factor is email only. Authenticator apps and passkeys need Pro, and codes depend on your site’s email actually being delivered.
- Security headers are paid. HSTS, Content Security Policy and the other headers can only be configured in Pro.
- No file scanning. There is no advertised malware scan or file integrity check.
- Repeated flaws in two-factor login. A critical bug in 2024, then several bypasses fixed in 2026.
The Really Simple Security settings we recommend
Labels from the version 9.8 interface, under Security > Settings. Take a backup before changing the redirect or hardening options, and test on a staging site first if you run a store.
| Setting | Recommended value | Why |
|---|---|---|
| Redirect method Security > Settings > SSL > Redirection | “301 PHP redirect”, or “301 .htaccess redirect” on Apache after reading the instructions | .htaccess skips PHP, but an unusual server setup can break the site. If your host already redirects, keep its redirect. |
| Mixed content fixer SSL > Mixed content | On | It rewrites http addresses in your pages. Then check the browser padlock. |
| Enable vulnerability scanning Vulnerabilities > Vulnerability scan | On | You hear about a known flaw in an installed plugin before a bot finds it. |
| Notifications by email and Email address General > Email | On, with an inbox someone reads daily | Without email, alerts stay inside the dashboard. |
| Enable Two-Factor Authentication, then Enforce secure authentication for: Login Protection > Login Authentication | On; enforced for administrators and editors, with a grace period | Turn it on for your own account first and confirm site emails arrive (not in spam). |
| Disable the built-in file editors Hardening > Basic | On | A stolen admin account can no longer edit code from the dashboard. |
| Prevent code execution in the public ‘Uploads’ folder Same screen | On | A PHP file dropped through an upload flaw won’t run. On Nginx the plugin can’t add the rule itself: paste the code it shows into your server config. |
| Disable user enumeration and Prevent login feedback Same screen | On | Usernames are no longer exposed through ?author= URLs, the public REST API and login error messages. |
| Disable XML-RPC Same screen | On only if nothing uses it | Jetpack, the WordPress mobile app and some publishing tools need it (see XML-RPC on WordPress). |
- An http address (home page, post, image) reaches https in a single 301 redirect.
- The plugin dashboard shows no unresolved vulnerability.
- You logged in again from a private window with the emailed code.
- The plugin runs version 9.8.3 or later, with auto-updates turned on.
Really Simple Security vulnerabilities and the minimum version to run
The most serious flaw, CVE-2024-10924 (November 2024), let anyone without an account log in as any user, administrators included, in versions 9.0.0 to 9.1.1.1 when two-factor authentication was enabled; it was fixed in 9.1.2. More two-factor bypasses followed in 2026, including CVE-2026-8293 (fixed in 9.5.10.1) and CVE-2026-89080 (fixed in 9.8.1), which required already knowing the password, and CVE-2026-82519 (fixed in 9.8.2), exploitable with a low-privilege account. CVE-2026-88798, fixed in 9.8.3, let attackers grow one of the plugin’s options without limit. So run at least 9.8.3 and turn on auto-updates: our timeline of Really Simple Security vulnerabilities covers each fix.
The mixed content fixer adds a data-rsssl attribute to the body tag, a marker that gives the plugin away to bots; WP Masquerade removes it, even in the free version, which makes the plugin harder to spot but doesn’t replace updates. To see how it stacks up against competitors, read our comparison of WordPress security plugins.
What WP Masquerade hides for Really Simple Security
Free version Handled by the free version of WP Masquerade
Really Simple Security is one of the 50 most used plugins known to the free version. Pro goes further by renaming its files.
Free version
- marker attribute
With Pro
- folder name
- tag IDs
Still visible
No known trace
Really Simple Security FAQ
Are Really Simple SSL and Really Simple Security the same plugin?
Yes. The plugin kept its really-simple-ssl slug on wordpress.org and updates normally; only the name changed as security features were added.
Do I still need it once my site runs on HTTPS?
If your host already redirects to https and your content no longer contains http addresses, the SSL part isn’t essential anymore. Keep the plugin if you use its alerts or its two-factor login.
Can I use it alongside Wordfence?
Yes, as long as you don’t turn on the same feature twice: pick one two-factor system and one login limiter. The HTTPS features don’t overlap with Wordfence.
My site is stuck in a redirect loop after activation. What now?
Switch the redirect method back to “301 PHP redirect”, or remove the lines the plugin added to .htaccess. Behind a proxy or Cloudflare, make sure the proxy’s SSL mode also encrypts the connection to your server.