DawsonyWeb – Security Shield
Setup and everyday use.

Install the plugin

In WordPress, open Plugins → Add New Plugin and search for DawsonyWeb – Security Shield. Choose Install Now, then Activate.

Alternatively, download the free ZIP using the button on this page. In Plugins → Add New Plugin → Upload Plugin, select the ZIP, install it and activate. You do not need an account or a licence key.

Start with the site’s requirements

Open Security Shield and review the Dashboard, Comments, API & REST, Spam Rules and Activity Log tabs. Save changes on the tab you edit.

Before enabling restrictions, check which APIs your editor, mobile apps, shop and integrations use. Test on staging first and keep a record of changes so you can reverse a restriction if needed.

Open Integration Checks for guidance, then Run REST checks. Guest and signed-in probes show HTTP results without changing settings. They cover the REST post-type endpoint only. Test checkout, forms, product reviews, XML-RPC apps and external services separately.

Understand blocked requests

Open Activity Log and read What to check beside each event. The explanation identifies a relevant restriction; Settings opens the matching tab. REST restrictions now leave an event with the blocking reason.

The log can help diagnose legitimate traffic, but it is not a full security audit. Test the actual affected form, editor or integration, review the rule and keep hosting protection, backups and updates in place.

Control comments and spam

Use Comments to choose whether comments should remain available. Disabling comments hides existing comments from the front end rather than deleting them.

Spam controls include a honeypot, minimum comment length, link limits, keywords and a login requirement. Choose limits that allow the kind of comments you want to receive, then test a normal submission.

Restrict APIs carefully

The API & REST tab includes XML-RPC and REST restrictions. Disabling XML-RPC may affect mobile publishing and integrations such as Jetpack.

Full REST restrictions can break the block editor, headless sites and connected applications. Guest restrictions can also affect public forms and shop integrations. Test those flows after saving. Hiding guest user routes does not remove every possible source of public author information.

IP rules and rate limits

Enter exact IPv4 or IPv6 addresses one per line in the blocklist. The plugin uses the server’s REMOTE_ADDR value. On a proxy or CDN setup, verify that this contains the visitor address before relying on IP rules.

Comment rate limits use a fixed window. The default is three attempts per 60 seconds. Requests above the limit receive a 429 response. These controls are not a replacement for a hosting firewall or traffic protection service.

Review activity and maintain the site

When logging is enabled, the local activity log keeps up to 200 entries, including IP address, time and event details. Treat this as site visitor data and clear it when it is no longer needed.

Continue normal WordPress, theme and plugin updates and maintain backups. Security Shield does not scan for malware or guarantee that a site cannot be compromised.

Updates and support

Updates are delivered through the normal WordPress plugin update screen. Back up your site before updating and test changes on staging where possible. You can enable automatic updates from the Plugins screen if that suits your maintenance process.

If you need help, include the plugin version, WordPress version and the steps needed to reproduce the issue. Remove private customer details, passwords and keys from any screenshot or diagnostic report.