by
Adnan Ali
0 (0 reviews)
Stillward Security
Lightweight, safe-by-default WordPress security. Hardens your site without interfering with normal behaviour. Aggressive features are opt-in.
Stillward Security ranks #28,991 among WordPress.org plugins with 20+ active installations, is #1,582 of 5,058 in the Security category, and was last updated Sep 30, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.4
v2.3.3
Current Version v2.3.3
Updated 1 month ago
Last Update on 30 Sep, 2026
Refreshed 1 week ago
Last Refreshed on
#1,582 of 5,058 in Security
Top 50% by installs
Rank
#28,991
—
No change
Active Installs
20+
-9.1%
KW Avg Position
123
1 worse
Downloads
164
+6 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 30
20+
30+
6,246
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 3 more installs to reach 30+
Rank Changes
Current
#28,991
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 2.3.3
- Last Updated
- Sep 30, 2026
- Requires WP
- 5.0+
- Tested Up To
- 7.1.4
- PHP Version
- 7.2 or higher
- Author
- Adnan Ali
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#18
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#36
Frequently Asked Questions
Common questions about Stillward Security
That is the one thing it is built not to do. Only non-breaking hardening is on after activation. Every feature that can change how your site behaves -- the request firewall, Content-Security-Policy, HSTS, the strict MIME whitelist, the custom login URL and XML-RPC blocking -- is off until you turn it on yourself.
Three gates must all pass before anything is removed: The file must contain an exact marker unique to the malware family this scanner targets. The generic "looks obfuscated" heuristic can only report, never remove, because licence loaders and minified libraries look identical. The file must sit in a location this family actually drops into, and must not be part of a real plugin, theme or WordPress core. An infected real file is reported for reinstalling, never erased. wp-config.php is never deleted. This plugin's own folder, and other security and backup plugins, are skipped. Everything removed is copied into the plugin's own database table first -- never onto disk -- and can be downloaded again from the Malware Shield tab.
No. It never edits, strips or re-encodes a submitted request. It runs in log-only mode by default and blocks only if you switch it to Block mode.
Only if nothing depends on it. Leave it enabled if you use Jetpack, the WordPress mobile app, or any service that publishes to your site remotely.
One, and only WordPress.org's own API. When the Malware Shield inspects a file in wp-includes, wp-admin or the web root, it asks WordPress's built-in get_core_checksums() for the official checksum manifest of your WordPress version, so it can tell a file WordPress genuinely ships from one an attacker planted. That request goes to api.wordpress.org -- the same endpoint WordPress itself uses for updates -- and carries only your WordPress version number and locale. Nothing about your site, its content or its users is sent. The manifest
instead of judging them. There is no telemetry, no analytics, no third-party service and no registration. Everything else the plugin records stays in your own database.
Uninstall removes its options, its log and quarantine tables and its scheduled tasks, on every site in a multisite network. Accounts you demoted through the account scanner are deliberately left as they are -- silently restoring an administrator during an uninstall would be dangerous.
