Skip to content
PluginCanary

Shield Security

Shield Security - Smart Bot Blocking, Brute-Force Login Protection & File Scanning
by Paul · 30,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 27 Oct 2026, 105 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for Shield Security
Ownership100
Maintenance100
Security70
SupportNo data
Reputation70

How the score works

Quick answers

Is Shield Security still maintained?
Yes. Last release 27 Oct 2026, 105 releases in the last 24 months. 27 Oct 2026 · wordpress.org
Who owns Shield Security, and has it changed hands?
No change recorded. Main committer paultgoodchild since Aug 2015. 4 Nov 2026 · SVN log
Was Shield Security removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Shield Security safe?
12 known vulnerabilities, all fixed (latest in 22.3.4). Not on the exploited list. 30 Oct 2026 · Wordfence Intelligence
Is the latest Shield Security update safe to install?
No ownership change before 22.3.4. No one-star spike after it. 27 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
paultgoodchild5 Aug 2015 to 4 Nov 2026, 2002 commits

1 committer recorded. No ownership change since 2015.

Maintenance

Last release
8 days ago
Releases, 24 months
105
Tested up to
7.2 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for Shield Security
Q1 202442
Q2 20242
Q3 202411
Q4 202426
Q1 20255
Q2 20259
Q3 20252
Q4 20251
Q1 202619
Q2 202627
Q3 20269
Q4 20267

Last release 27 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 2.0 (2 reviews). Lifetime: 4.8.

Average rating per quarter for Shield Security
Q4 20235.0
Q1 20245.0
Q2 20245.0
Q3 20245.0
Q1 20255.0
Q2 20254.5
Q3 20255.0
Q1 20261.0
Q2 20264.0
Q3 20263.0
Q4 20263.0

Average rating fell from 5.0 to 3.0 between Q4 2023 and Q4 2026.

Rating distribution
5 star969
4 star26
3 star12
2 star9
1 star23
Latest low reviews

Security record

5 vulnerabilities in 24 months (12 on record), all patched (latest fixed in 22.3.4).

Show 12 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026Shield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log7.2<= 22.3.222.3.4Patched before disclosure
18 Feb 2026Shield Security <= 21.0.8 - Cross-Site Request Forgery to SQL Injection6.5<= 21.0.821.0.10Patched before disclosure
18 Feb 2026Shield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter6.1<= 21.0.821.0.10Patched before disclosure
18 Feb 2026Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches <= 21.0.9 - Missing Authorization to Authenticated (Subscriber+) Email MFA Update4.3<= 21.0.921.0.10Patched before disclosure
15 Jan 2026Shield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator4.3<= 21.0.921.0.10Patched before disclosure
5 Aug 2024Shield Security - Smart Bot Blocking & Intrusion Prevention Security <= 20.0.5 - Reflected Cross-Site Scripting6.1<= 20.0.520.0.6Patched before disclosure
1 Jun 2024Shield Security - Smart Bot Blocking & Intrusion Prevention Security <= 19.1.13 - Cross-Site Request Forgery4.3<= 19.1.1019.1.11192
5 Feb 2024Shield Security - Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion9.8<= 18.5.918.5.10Patched before disclosure
16 Jan 2024Shield Security <= 18.5.7 - Unauthenticated Stored Cross-Site Scripting via getColumnContent_Page7.2<= 18.5.718.5.814
25 Apr 2023Shield Security <= 17.0.17 - Unauthenticated Stored Cross-Site Scripting7.2< 17.0.1817.0.18280
25 Apr 2023Shield Security <= 17.0.17 - Missing Authorization4.3< 17.0.1817.0.18280
19 Jan 2022Shield Security <= 13.0.5 - Admin+ Stored Cross-Site Scripting5.5<= 13.0.513.0.6Patched before disclosure

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 1 support threads resolved in the last 2 months.

Momentum

30,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Shield Security
4 May 2026851
11 May 20261,791
18 May 202639,123
25 May 202630,345
1 Jun 20263,856
8 Jun 202611,943
15 Jun 202620,666
22 Jun 20263,019
29 Jun 20262,835
6 Jul 20262,877
13 Jul 20262,390
20 Jul 20262,111
27 Jul 20262,070
3 Aug 20261,945
10 Aug 20261,709
17 Aug 20261,692
24 Aug 20262,261
31 Aug 20262,263
7 Sep 202611,242
14 Sep 202621,188
21 Sep 202619,356
28 Sep 202614,623
5 Oct 202625,619
12 Oct 202610,726
19 Oct 20264,350
26 Oct 202616,910
2 Nov 202613,363

Weekly downloads over the last 4 weeks are 13% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Disable WP REST APIScore 100 · 30,000+AntiVirusScore 100 · 30,000+Protect UploadsScore 100 · 30,000+CloudSecure WP SecurityScore 98 · 100,000+WP fail2banScore 98 · 60,000+

Facts

Version22.3.4
AuthorPaul
Added9 Jul 2013
Last updated27 Oct 2026
Active installs30,000+
Requires WordPress5.7
Tested up to7.2
Requires PHP7.4
CategorySecurity & Privacy > Security Scanning & Malware Protection
Tags2FA, bots, firewall, security, Activity Log

Other plugins by this author: Flexible SSL for CloudFlare, iControlWP, cPanel Manager (from iControlWP), CDNJS for WordPress, Mandate App Security

Questions

Is Shield Security still maintained?

Yes. Last release 27 Oct 2026, 105 releases in the last 24 months.

Who owns Shield Security, and has it changed hands?

No change recorded. Main committer paultgoodchild since Aug 2015.

Was Shield Security removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Shield Security safe?

12 known vulnerabilities, all fixed (latest in 22.3.4). Not on the exploited list.

Is the latest Shield Security update safe to install?

No ownership change before 22.3.4. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue