LynBro Plugins
/ Shield
LynBro Plugins
/ Shield
Lynbro Shield does the security basics with no account and no outside service: the headers, HTTPS with HSTS, a small firewall against injection probes, and the hardening switches every site needs. Its status screen checks the live site and shows which protections are actually in effect.
Free. No account and no outside service — every rule runs on your own server.
firewall rules on the address, the query string and form posts — plus the well-known scanner tools.
HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and a safe base Content-Security-Policy are written to .htaccess, so the images, scripts and stylesheets your server hands out without WordPress get them as well. Where .htaccess cannot be written, they are sent from PHP instead.
A setting that is switched on is not the same as a header that arrives. The status screen checks the live site and shows which protections are really in place.
The journal keeps each refusal with the rule that fired, the IP address and the request, so a false alarm is something you can see and undo with one button — not a mystery.
No "Pro" tier, no nag screens. The features other plugins paywall are here from day one.
HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and a safe base Content-Security-Policy.
Refuses SQL injection, script injection, path traversal, code execution and probes for secret files in the address, the query string and form posts, and the well-known scanner tools.
Form posts from signed-in editors in wp-admin and through the block editor’s routes are not inspected, so saving a post is never mistaken for an attack.
An address that keeps trying is blocked for a while, and can be unblocked from the journal.
File editor off, no PHP in uploads, readme, license, install and xmlrpc hidden, no folder listings, no version number, application passwords off.
HSTS tells browsers to use HTTPS only, and the site’s own addresses are kept on https.
No comment forms, no comments shown, no Comments menu or Discussion settings, no comment REST and XML-RPC routes, no comment feeds, no pingbacks. Stored comments are kept.
Visitors cannot create an account; the sign-up page leads to the login form.
Every refusal with the rule that fired, the IP and the request, and a button to unblock.
No. Everything Lynbro Shield does runs on your own server.
The headers are then sent from PHP instead.
Form posts from signed-in editors in wp-admin and through the block editor’s routes are not inspected, so your own editing is not refused.
No. Stored comments are kept; they are simply not shown, and nothing new can be posted. Both optional switches — comments and self-registration — are off by default.
A strict script policy needs to know every outside script your particular site uses. Getting that wrong breaks pages, so it is left to you.
No. Malware scanning and file integrity are a separate job, and this plugin does not pretend to do it.
That is Lynbro Login Guard. Shield pairs with it, with Lynbro Antispam Guard for forms and with Lynbro Activity Log for who did what.