by
shieldwave
0 (0 reviews)
Ensomedia Security powered by shieldwave.io
Finds malware, tampered files, known vulnerabilities, injected content and risky settings, and explains each fix in plain words.
Ensomedia Security powered by shieldwave.io ranks #49,296 among WordPress.org plugins with 0+ active installations, is #3,855 of 5,058 in the Security category, and was last updated Oct 28, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.4
v1.1.29
Current Version v1.1.29
Updated 1 week ago
Last Update on 28 Oct, 2026
Refreshed 1 week ago
Last Refreshed on
#3,855 of 5,058 in Security
Downloads -55.7% this week
Actively maintained
Rank
#49,296
—
No change
Active Installs
0+
-100%
KW Avg Position
125
0.2 worse
Downloads
1.3K
+23 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 10
0+
10+
21,728
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 5 more installs to reach 10+
Rank Changes
Current
#49,296
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.1.29
- Last Updated
- Oct 28, 2026
- Requires WP
- 6.2+
- Tested Up To
- 7.1.4
- PHP Version
- 7.4 or higher
- Author
- shieldwave
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#18
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#36
Frequently Asked Questions
Common questions about Ensomedia Security powered by shieldwave.io
A must-use loader checks requests before normal plugins load. The optional Load before WordPress setting adds a marked entry to .user.ini on PHP CGI/FastCGI hosts and refuses to replace another auto_prepend_file; the firewall screen shows whether early loading ran. Named password fields and authentication headers are not inspected. History stays on your site for up to 30 days and records metadata, not query strings or submitted values. Reducing protection, adding an exception, clearing history or lifting a block asks for your password or an authenticator code. If the firewall blocks you, replace wp-content/ensomedia-security-firewall.php with an empty PHP file and remove only the marked .user.ini entry, and keep the empty file until PHP's configuration cache expires. Without early loading, define SHIELDWAVE_FIREWALL_OFF in wp-config.php to turn the loader off. The firewall adds protection; it does not replace updates or fix vulnerable code. Its rules ship with plugin updates and are separate from the virtual patches and the malware feed.
No. All 25 checks, scheduled scans, email alerts and the vulnerability lookup work without one, with no limits.
Yes. Under ShieldWave > Settings > Toolbar, turn off "Show ShieldWave in the toolbar". The choice is per administrator. Visitors never see it.
It trusts the files WordPress.org can vouch for, needs real evidence before it calls something malware, and emails only about problems that are new or got worse. The goal is that every alert you get is one you would want.
The scanner found something unusual that is often harmless: for example a new PHP file in a premium plugin without an update. It is listed so someone who knows the site can look at it, and it never sends an email on its own. Problems under "Fix now" are the ones with clear evidence. A finding is about a file I changed on purpose. Open the item and press "Ignore". It stays out of the score and the alerts, and an ignored file comes back by itself if it changes again. Ignored items stay under the "Ignored" link below the to-do list, where "Restore" brings one back.
Scans and settings, and also sign-ins, new and deleted accounts, role changes, who edited, published or trashed a post or page, plugin and theme installs, updates, switches and removals, and changes to the site addresses, the administration email, "Anyone can register" and the new user role. A post is named by its title and number, never its text. Sign-ins and edits are written once per person in a short window, at most 300 a day together. The History screen filters by type and person, and the CSV export holds every entry.
No. The Backups check looks for a switched-on backup plugin, a few hosts that back up themselves and archives in the usual folders, and reads the date of the last backup from their settings and files without running them. It says so when the newest backup is older than 7 days. When it cannot read a date, it marks the check as not assessed and does not raise an alarm.
No. Scans never run while a visitor's page loads: they work in the background in steps of a few seconds, and later scans skip files that were clean and did not change. On a busy shared host you can choose the low scan speed in Settings.
It stays on the hour you chose, in the time zone set under Settings > General, and it follows a change of that time zone at once. On the one day a year the clocks skip the chosen hour, the scan runs right after the skipped hour. On the day an hour happens twice, it runs once, the first time the clock shows it.
Only when scans run: to WordPress.org for checksums, theme packages, plugin information and the list of WordPress releases, and to your own site. With the vulnerability lookup, live threat feed or AI second opinion on: to shieldwave.io, once an hour from WP-Cron and after scans. With an account connected: to shieldwave.io, also once an hour. With the breached password check: to api.pwnedpasswords.com. With Cloudflare Turnstile: to challenges.cloudflare.com. With edge rules and a Cloudflare token: to api.cloudflare.com. Each of those is off until you turn it on, and the External services section below lists exactly what is sent. Requests to your own site: the XML-RPC, debug output and exposed files checks request xmlrpc.php, the debug.log URL, backup files found on disk and the uploads folder; the HTTPS check asks for the home page over http and https and the security headers check once over https. "Check now" for PHP in uploads writes two harmless test files there, requests them and deletes them. After a file is moved to quarantine or replaced with its original, or after a security update, the plugin requests the home page and the login page to see that the site still answers. The check of what visitors and search engines see requests the home page and the WooCommerce checkout with a browser user agent, as Googlebot and with a Google search referrer. A running scan calls your own admin-ajax.php to continue in the background.
