Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) Review - In-Depth Analysis
Enhance your site's security with features like Two-Factor Authentication, Login Protection, and Vulnerability Detection. Simple and effective WordPress hardening.
Performance Overview
User Rating
4.9/5 (based on 8868+
reviews)
Active Installations
3,000,000+
Update Frequency
Below Average
It is calculated using the weighted average of same category
plugins.
Security Score
7.21 / 10
(High Risk)
It is calculated using the weighted average of all versions.
What It Does
Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate.
Really Simple Security is the most lightweight and easy-to-use security plugin for WordPress. It secures your WordPress website with SSL certificate generation, including proper 301 https redirection and SSL enforcement, scanning for possible vulnerabilities, Login Protection and implementing essential WordPress hardening features.
We believe that security should have the absolute minimum effect on website performance, user experience and maintainability. Therefore, Really Simple Security is lightweight, easy-to-use, and offers a 1-minute configuration with short onboarding setup.
Security features include easy SSL migration, WordPress hardening, vulnerability detection, and login protection. The Pro version offers advanced features like a firewall, security headers, and advanced site hardening measures.
Comparing to Alternatives
Really Simple Security occupies a fairly specific niche combining SSL enforcement with broader hardening features like two-factor authentication and vulnerability alerts, so it doesn't have a close direct competitor covering the exact same scope.
Strengths
- Extremely high overall satisfaction with 97.3% of ratings at 5 stars
- Simple setup for SSL migration and basic security hardening
- Combines SSL, login security, and vulnerability alerts in one plugin
- Actively maintained with frequent updates addressing reported issues
Weaknesses
- A history of several vulnerabilities, including one rated critical
- Some advanced features like IP/country blocking reported as ineffective by at least one user
- Premium support tools have had functional bugs reported
User Sentiment Analysis
With 8,863 ratings and a 4.9/5 average, sentiment is overwhelmingly positive—only 1.2% of reviews fall into the 1-2 star range. Recent reviews echo this, with most users praising ease of use and reliable SSL/security support, though a small but vocal minority report technical breakdowns or billing frustrations.
Positive highlights
- "Simple to use and full of excellent advice on security items" — adodscp
- "Has kept my site secure for a long time" — canoot
- "Gott sei Dank über 200000 Spams abgeblockt!" — drhcweiss
- "Easy to set up and works fine for basic protection" — tatianaan
- "Muy buen aliado para proteger mis sitios web. Trabaja 24/7" — ctwchile
Common complaints
- Reports of instability requiring constant reinstallation to function
- IP and country blocking features reportedly not working as advertised
- Broken .htaccess causing site crashes on some installations
- Vulnerability alert emails flagging medium-risk issues with no available fix, seen as noise rather than useful
- Aggressive security behavior reportedly hiding pages from search engines, harming SEO rankings
- A billing dispute with no resolution from support after weeks of waiting
Weaknesses
- History of seven known vulnerabilities including a critical authentication bypass and a high-severity 2FA bypass
- Some users report the plugin's aggressive defaults can cause site-breaking side effects like SEO harm or .htaccess corruption
- Premium support and advanced blocking features have had reported bugs
Who Should Use This?
Best for
Site owners looking for an easy way to enforce SSL and add baseline security hardening—like login protection and vulnerability scanning—without a steep learning curve will likely be well served, especially given the plugin's strong overall reputation.
Not ideal for
Users running mission-critical or SEO-sensitive sites should proceed cautiously and keep the plugin updated, given its history of significant vulnerabilities (including a critical authentication bypass) and occasional reports of aggressive security defaults interfering with site visibility or stability.
Pricing & Value
Free version includes
The free version covers core SSL enforcement, basic hardening measures, and security recommendations, which is enough for many users seeking straightforward protection.
Pro version (49 - 199 USD / year)
The Pro version typically adds two-factor authentication, advanced vulnerability detection and automated fixes, IP/country blocking, and premium support, aimed at users wanting more comprehensive, hands-off protection.
Final Verdict
Really Simple Security enjoys strong user goodwill, reflected in its 4.9-star average and overwhelmingly positive reviews praising its simplicity and reliability for SSL and general hardening. However, its vulnerability history—including a critical authentication bypass and a high-severity 2FA bypass—means it demands prompt updating, and a handful of negative reviews point to real reliability and support issues that shouldn't be dismissed.
With no direct alternative covering the same combined SSL-plus-security scope, it remains a reasonable default choice, particularly for users sticking to the free tier's core functionality. Those considering Pro or handling sensitive, high-traffic sites should weigh the security track record and stay vigilant with updates and testing after installation.
Other Notable Features
Here are a few other notable features of this free
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) plugin.
FAQ
For more detailed explanations and documentation on all Really Simple Security features, please search the Knowledge Base
All features that made Really Simple SSL the most powerful and easy-to-use SSL generation and redirect plugin are still part of Really Simple Security. The plugin is developed with a modular approach: if you don’t want to use the full set of security features, the unused code will not be loaded and won’t have any effect on your site’s performance.
In our experience, security solutions for WordPress are often hard to configure, trigger many false positives and have a significant impact on site performance. We have been receiving requests from our users to simplify WordPress security for years, so that has become our mission!
You couldn’t make us happier! Really Simple Security is GPL licensed and co-created by the WordPress community. All feedback is highly appreciated and has always helped us to better understand users’ needs. For code contributions or suggestions, we’re on GitHub. For suggestions, please open a support ticket You can also express your appreciation by leaving a review.
Most mixed content issues are caused by URLs in CSS or JS files. For detailed instructions on how to find mixed content read this article.
We added the possibility to generate a Free SSL Certificate with Let’s Encrypt in our Really Simple Security Wizard. We have an updated list available for all possible integrations here. Please leave feedback about another integration, incorrect information, or you need help.
If you are experiencing redirect loops on your site, try these instructions. This can sometimes happen during the migration to HTTPS or due to conflicting redirect rules.
Yes. There is a dedicated network settings page where you can control settings for your entire network, at once.
Under Login Protection, you can configure minimum strength settings and require users to change their passwords after a defined interval. Disabling weak password usage is a best practice.
You can set a custom login URL under Advanced Site Hardening, which helps prevent brute force login attacks and bots targeting wp-login.php.
Yes. The plugin enforces HTTPS and handles all necessary redirects, optionally using .htaccess or PHP.
Really Simple Security and WordFence greatly overlap in term of functionality. If you like to use specific features from both plugins, we strongly recommend not to enable similar features twice. The benefit of Really Simple Security is that disabled features don’t load any code, so won’t have an impact on site performance.
Contributors and developers
“Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)”
is open source software. The following people have
contributed to this plugin.
