NETSENSAI Shield offers a range of security features, including:<\/p>\n\n
Changing the login URL to reduce brute force attack risks.<\/p>\n\n
Disabling the REST API (WP API JSON) for non-logged-in users.<\/p>\n\n
Disabling XML-RPC to prevent unauthorized access.<\/p>\n\n
Disabling the WordPress file editor to avoid accidental or malicious changes.<\/p>\n\n
Disabling Application Passwords to block unauthorized API access.<\/p>\n\n
Applying advanced HTTP security headers (e.g., HSTS, X-Frame-Options, Content-Security-Policy).<\/p>\n\n
Integration with W3 Total Cache:<\/p>\n\n
Permanently disable .htaccess writes by W3TC<\/p>\n\n
Runtime disabling of Page Cache UI<\/p>\n\n
One-time full cache flush on first admin page load<\/p>\n\n
Automatic cache flush on Secure Options save<\/p>\n\n
Physical cleanup and permanent disable via the W3TC API<\/p>\n\n
Suppression of Site Health REST API availability notices for non-logged-in users (removes false Site Health errors while maintaining full API blocking).<\/p>\n\n
In addition, the plugin provides helpful user feedback:<\/p>\n\n
Email notifications when the login URL changes \u2013 sends a localized HTML email (Polish or English) with your old and new login links, change date and the plugin logo, so you remember to update your bookmarks.<\/p>\n\n
Admin popup when disabling the WP API JSON \u2013 displays a friendly modal warning that disabling the REST API may break plugins like WooCommerce or contact forms. The popup includes a purchase link to upgrade to the PRO version if you need this feature without losing functionality.<\/p>\n\n
Scoped styling \u2013 the custom colour for the \u201cSave changes\u201d button is now limited to the Secure Options page, so other admin pages keep the default WordPress look.<\/p>\n\n
Promotional banner assistant \u2013 notifies administrators of summer discount codes and NETSENSAI Shield PRO features.<\/p>\n\n
The free version provides both core and advanced Level 3 security functionalities. A PRO version offers extended support, additional features, and automatic protection enhancements.<\/p>\n\n\n
Download NETSENSAI Shield from the WordPress.org repository or upload the plugin files to \/wp-content\/plugins\/netsensai-shield\/.<\/p>\n\n
Activate the plugin on the WordPress Admin Dashboard under Plugins.<\/p>\n\n
Navigate to Settings > Secure Options and configure as needed.<\/p>\n\n\n
Go to Settings > Secure Options and enter your preferred path in the Change Login URL field.<\/p><\/dd>\n
It reduces exposure of your site\u2019s data via the REST API for non-logged-in users.<\/p><\/dd>\n
Disabling XML-RPC helps protect against brute force attacks targeting that protocol.<\/p><\/dd>\n
It prevents code modifications via the dashboard, reducing the risk of malicious changes.<\/p><\/dd>\n
The plugin can apply:<\/p>\n\n
Strict-Transport-Security (HSTS)<\/p>\n\n
X-Frame-Options<\/p>\n\n
X-Content-Type-Options<\/p>\n\n
Content-Security-Policy (CSP)<\/p>\n\n
Referrer-Policy<\/p>\n\n
Permissions-Policy<\/p><\/dd>\n
On activation or settings save, NETSENSAI Shield clears the W3TC cache, disables the Page Cache UI to prevent conflicts, and blocks future .htaccess writes by W3TC.<\/p><\/dd>\n
The plugin removes the default REST API availability test in Site Health for guest users, while still enforcing your REST API blocking settings.<\/p><\/dd>\n\n<\/dl>\n\n\n
Security: Fixed potential access to the default password reset endpoint ( Critical bugfix: prevents homepage from being replaced by login screen when custom login slug is empty or invalid. Update strongly recommended.<\/p>\n\n Improved custom login URL handling in all WordPress login flows:<\/p>\n\n These changes make the password reset and email confirmation flows fully compatible with NETSENSAI Shield\u2019s custom login URL feature.<\/p>\n\n Added promotional banner assistant notifying of available discount codes and linking to the PRO version.<\/p>\n\n Improved styling of the \"Save changes\" button to keep it scoped only to the Secure Options page.<\/p>\n\n Minor UI adjustments and JavaScript animation for consistent dismissal effects.<\/p>\n\n Added localized email notifications: when you change the custom login URL, the plugin sends a friendly HTML email (in Polish or English) detailing the old and new login links, including the change date and logo.<\/p>\n\n Added WP API JSON warning modal: enabling the \u201cDisable WP API JSON\u201d option now triggers a popup explaining that the REST API is needed for WooCommerce and form plugins, and provides a link to purchase the PRO version for a safe disablement.<\/p>\n\n Scripts and styles now enqueue only on Settings \u2192 Secure Options (hook_suffix check).<\/p>\n\n assets\/script.js is versioned via filemtime() to bust cache on each update.<\/p>\n\n Removed legacy, unconditional enqueue\u2014eliminates console errors about missing toggle IDs.<\/p>\n\n Streamlined admin enqueue logic into a single ns_shield_admin_enqueue_assets() function.<\/p>\n\n Fixed custom login URL in password reset flow:<\/p>\n\n Password reset emails now include the correct custom-slug link with full query parameters.<\/p>\n\n \u201cSet new password\u201d form action and hidden fields (login, rp_key) now function under the custom URL without 404 errors.<\/p>\n\n Disabled WP canonical redirects on the custom login page to preserve login\/key parameters.<\/p>\n\n Removed all error_log() debug hooks.<\/p>\n\n Streamlined site_url and login_form_action filters to catch every wp-login.php occurrence.<\/p>\n\n Fixed readme parsing by removing Markdown syntax from the License URI and ensuring a plain URL.<\/p>\n\n Updated short description to fit 150-character limit.<\/p>\n\n Removed calls to error_log() flagged by Plugin Check.<\/p>\n\n Minor formatting cleanup in readme; bumped version to 1.4.2.<\/p>\n\n Compliance updates for WordPress.org (tags, description length); bumped version to 1.4.1.<\/p>\n\n Added integration with W3 Total Cache (cache flushing, UI disable, .htaccess protection) and hides Site Health errors related to the REST API for non-logged-in users.<\/p>\n\n Restored Level 3: Advanced Security features in free version. Improved popup behavior, translations added, Plugin Check compatibility enhanced.<\/p>\n\n Level 3 features were temporarily moved to PRO; version 1.3 restores them.<\/p>","raw_excerpt":"Hardens and protects your site by locking down login, REST API, XML\u2011RPC, file editor, and applying HTTP security headers.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/pt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/223326","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/pt.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/pt.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=223326"}],"author":[{"embeddable":true,"href":"https:\/\/pt.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/rgierlicki"}],"wp:attachment":[{"href":"https:\/\/pt.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=223326"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/pt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=223326"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/pt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=223326"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/pt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=223326"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/pt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=223326"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/pt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=223326"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}wp-login.php?action=lostpassword<\/code>) by enforcing redirect to the custom login URL.\nSecurity: Improved handling of \u201ccheckemail\u201d and other password recovery states to prevent false positives and direct access to wp-login.php<\/code>.\nSecurity: Enhanced server variable sanitization and escaping for full WordPress Coding Standards (WPCS) compliance.\nImprovement: Refactored login guard logic for better stability and compatibility with LiteSpeed and custom rewrites.<\/p>\n\n1.4.8<\/h4>\n\n
1.4.7<\/h4>\n\n
\n
?checkemail=confirm<\/code>) \u2013 users are redirected to the custom login slug instead of hitting 404.<\/li>\nnetwork_site_url()<\/code> calls \u2013 ensures compatibility with Multisite and plugins using network context.<\/li>\n1.4.6<\/h4>\n\n
1.4.5<\/h4>\n\n
1.4.4<\/h4>\n\n
1.4.3<\/h4>\n\n
1.4.2<\/h4>\n\n
1.4.1<\/h4>\n\n
1.4<\/h4>\n\n
1.3<\/h4>\n\n
1.2<\/h4>\n\n