Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) vs SmartCloud Static Publisher

Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate. Really simple, Effective and Performant WordPress Security Really Simple Security is the most lightweight and easy-to-use security plugin for WordPress. It secures your WordPress website with SSL certificate generation, including proper 301 https redirection and SSL enforcement, scanning for possible vulnerabilities, Login Protection and implementing essential WordPress hardening features. We believe that security should have the absolute minimum effect on website performance, user experience and maintainability. Therefore, Really Simple Security is: Lightweight: Every security feature is developed with a modular approach and with performance in mind. Disabled features won’t load any redundant code. Easy-to-use: 1-minute configuration with short onboarding setup. Security Features Easy SSL Migration Migrates your website to HTTPS and enforces SSL in just one click. 301 redirect via PHP or .htaccess Secure cookies Let’s Encrypt: Install an SSL Certificate if your hosting provider supports manual installation. Server Health Check: Your server configuration is every bit as important for your website security. WordPress Hardening Tweak your configuration and keep WordPress fortified and safe by tackling potential weaknesses. Prevent code execution in the uploads folder Prevent login feedback and disable user enumeration Disable XML-RPC Disable directory browsing Username restrictions (block ‘admin’ and public names) and much more.. Vulnerability Detection Get notified when plugins, themes or WP core contain vulnerabilities and need appropriate action. Login Protection Allow or enforce Two-Factor Authentication (2FA) for specific user roles. Users receive a two-factor code via Email. Improve Security with Really Simple Security Pro Protect your site with all essential security features by upgrading to Really Simple Security Pro. Advanced SSL enforcement Mixed Content Scan & Fixer. Detect files that are requested over HTTP and fix them to HTTPS, both Front- and Back-end. Enable HTTP Strict Transport Security and configure your site for the HSTS Preload list. Firewall Really Simple Security Pro includes a performant and efficient WordPress firewall, to stop bots, crawlers and bad actors with IP and username blocks. 404 blocking – Blocks crawlers as they trigger unusual numbers of 404 errors. Region blocking – Only allow/block access to your site from specific regions. Automated and customisable Firewall rules. IP blocklist and allowlist. Security Headers Security headers protect your site visitors against the risk of clickjacking, cross-site-forgery attacks, stealing login credentials and malware. Independent of your Server Configuration, works on Apache, LiteSpeed, NGINX, etc. Protect your website visitors with X-XSS Protection, X-Content-Type-Options, X-Frame-Options, a Referrer Policy and CORS headers. Automatically generate your WordPress-tailored Content Security Policy. Vulnerability Measures When a vulnerability is detected in a plugin, theme or WordPress core you will get notified accordingly. With Vulnerability Measures, you can configure simple but effective measures to make sure that a critical vulnerability won’t remain unattended. Force update: An update process will be tried multiple times until it can be assumed development of a theme or plugin is abandoned. You will be notified during these steps. Quarantine: When a plugin or theme can’t be updated to solve a vulnerability, Really Simple Security can quarantine the plugin. Advanced Site Hardening Choose a custom login URL Automated File Permissions check and fixer Rename and randomize your database prefix Change the debug.log file location to a non-public folder Disable application passwords Control admin creation Disable HTTP methods, reducing HTTP requests Login Protection Secure your website’s login process and user accounts with powerful security measures. Two-Step verification (Email login) 2FA (two factor authentication) with TOTP Passwordless login with passkey login Enforce strong passwords and frequent password change Limit Login Attempts With Limit Login Attempts you can configure a threshold to temporarily or permanently block IP addresses or (non-existing) usernames. You can also throw a CAPTCHA after a failed login (hCaptcha or Google reCaptcha) Access Control Restrict access to your site for specific regions. Add specific IP addresses or IP ranges to the Blocklist or Allowlist. Useful Links Documentation Security Definitions Translate Really Simple Security Issues & pull requests Feature requests Love Really Simple Security? If you want to support the continuing development of this plugin, please consider buying Really Simple Security Pro, which includes some excellent security features and premium support. About Really Simple Plugins Our mission is to make complex WordPress requirements really easy. Really Simple Security is developed by Really Simple Plugins. For generating SSL certificates, Really Simple Security uses the le acme2 PHP Let’s Encrypt client library, thanks to ‘fbett’ for providing it. Vulnerability Detection uses WP Vulnerability, an open-source initiative by Javier Casares. Want to join as a collaborator? We’re on GitHub as well!

Static Publisher is a WordPress plugin + Node.js exporter workflow for deterministic static publishing. Static Publisher is part of the WP Suite product family by Smart Cloud Solutions, Inc. WP Suite keeps WordPress as the CMS and editing layer, while optional connected features can extend selected workflows into modular AWS-backed services for identity, AI, APIs, workflows, protected routes, and static delivery. The free Static Publisher features described here do not require a WP Suite account, subscription, or WP Suite-managed AWS backend; you control any AWS credentials and target infrastructure you configure for publishing. Project repository and extended documentation: https://github.com/smartcloudsol/static-publisher It is designed for setups where WordPress is the editor/origin and production is served from static hosting (for example S3 + CloudFront). The plugin provides: Admin UI for export configuration Runtime config generation in uploads Job queueing (publish, crawl, deploy, invalidate, retry-timeouts, single URL) Run status and log viewing The Node.js exporter provides: Sitemap-based discovery Playwright rendering for JS-heavy pages Asset capture from network + parsed sources Separate concurrency for page rendering, asset downloads, and final rewrite URL rewriting modes (absolute, root-relative, relative) S3 upload and CloudFront invalidation Detailed logging for crawl, deploy, and invalidate This plugin does not execute shell commands directly from PHP. Instead, it writes queue/config runtime files that an external Node runner executes. This shell-first design is intentional: rendered frontend pages can be exported by Playwright/Node while WordPress/PHP remains focused on queueing and configuration. This plugin is not affiliated with or endorsed by Amazon Web Services or the WordPress Foundation. All trademarks are property of their respective owners. Usage Notice SmartCloud Static Publisher does not require an external SaaS account to operate. The plugin itself only manages configuration and queue state in WordPress. Actual crawling and deployment are executed by your own Node runtime using this project’s exporter commands. This means: You control when and where exports run. You control AWS credentials and target infrastructure. WordPress/PHP does not proxy deployment traffic. The WordPress plugin ZIP does not bundle the Node.js exporter runtime; install @smart-cloud/publisher-exporter separately on the machine that processes queued jobs. Free and Premium Usage Notice SmartCloud Static Publisher is fully functional in Free mode and does not require a WP Suite account, subscription, trial period, or paid service to perform its core static publishing workflow. In Free mode, the plugin supports the complete static publishing flow: Configure source and target settings in WP Admin. Queue and run full crawl, publish, deploy, invalidate, retry-timeouts, and single-URL jobs. Export rendered WordPress pages using the separately installed Node.js exporter. Capture required assets discovered during browser rendering. Rewrite URLs according to the configured rewrite mode. Deploy exported files to the configured S3 bucket. Create CloudFront invalidations for the configured distribution. View current job status and standard run logs. Free mode includes S3 deployment and CloudFront invalidation. These are not paid-only features. Audit Logs is also part of the main Static Publisher navigation and is not gated behind a WP Suite subscription. The plugin package itself manages WordPress-side configuration, queue state, runtime files, and status/log access. Actual crawling and deployment are executed by the separately installed @smart-cloud/publisher-exporter CLI on the user’s own server, workstation, CI runner, or other queue-runner host. Optional WP Suite Pro features are not required for the plugin to work. They are additional workflow, convenience, and team/enterprise publishing features. Examples may include: Incremental crawl / incremental publish / scheduled workflows. Extra Deployment Targets and Scheduler Settings backed by linked WP Suite site configuration. Additional team/workspace-oriented configuration features. Extra Deployment Targets are selected by key at deploy time, while downloaded job configs keep only the base target plus an optional target override id. These optional Pro features may be visible in the plugin interface as upgrade-only controls, but they are separate from the fully functional free static publishing workflow described above. When no active WP Suite subscription is connected, SmartCloud Static Publisher remains usable for full static crawl/publish/deploy workflows. There is no time limit, export quota, forced trial expiry, or required payment for the core static publishing functionality. Server Prerequisites (Node + Playwright) The exporter requires both Node.js and Playwright browser binaries on the machine that executes queued jobs. Recommended Node setup is NVM + latest LTS: curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash export NVM_DIR="$HOME/.nvm" && . "$NVM_DIR/nvm.sh" && nvm ls-remote --lts && nvm install --lts && nvm use --lts Install the standalone exporter CLI package and Chromium browser binary: npm install -g @smart-cloud/publisher-exporter && publisher-exporter install-browsers Important: If cron runs under the same OS user that installed Node and Playwright, NVM plus the default user-scoped Playwright cache is fine. If cron runs as a different or non-login service user such as www-data, prefer an explicit HOME, a PATH that already contains publisher-exporter and node, plus a shared PLAYWRIGHT_BROWSERS_PATH. In crontab, prefer absolute paths instead of relying on $HOME expansion inside the PATH value. npx playwright install is not a global install; browser binaries are user-scoped by default (usually under ~/.cache/ms-playwright). If multiple users may run jobs, use PLAYWRIGHT_BROWSERS_PATH to point to a shared browser folder and grant proper permissions. If the shared browser directory lives under a protected system path, create it once with elevated privileges and make it writable by the same OS user that will run publisher-exporter install-browsers. The later cron job only needs read/execute access to that directory tree. For internal/self-signed TLS origins, enable Allow self-signed TLS certificates during crawl in the admin UI (config key: ignoreHttpsErrors). If you prefer a shared browser cache for a non-login service user such as www-data, create the shared directory once, hand it to the job user, then install browsers from the CLI package without keeping the browser cache root-owned: sudo mkdir -p /var/lib/playwright-browsers && sudo chown "$USER":"$USER" /var/lib/playwright-browsers && PLAYWRIGHT_BROWSERS_PATH=/var/lib/playwright-browsers /usr/bin/npx @smart-cloud/publisher-exporter install-browsers Run A Queued Job From Another Machine If the WordPress host cannot run Node, Playwright, or cron, you can replay a queued job from your own shell or CI machine. In the Job Queue panel click Download config next to the queued job and save the file as queued-job.json. Extract the nested publisherConfig object to publisher.config.json using one of the commands already included in the downloaded file under manualExecution.commands. Install @smart-cloud/publisher-exporter on that machine first. Optionally edit publisher.config.json locally, for example to change outputDir to a writable local folder. Run the exact command from manualExecution.commands.jobPosix or manualExecution.commands.jobPowerShell. If you also want to deploy from your own machine, continue with the provided deploySdk and invalidateSdk commands from the same manualExecution.commands block. Important: This is an out-of-band replay of the queued job and does not mark the WordPress queue item as completed automatically. If the original queued item should not run later on the server, remove or clean it up in WordPress after your manual replay. The WordPress plugin ZIP does not contain the exporter runtime. Install @smart-cloud/publisher-exporter separately on the machine that replays the downloaded job. Shared Runtime Across Two Hosts SmartCloud Static Publisher can run with WordPress on one machine and the queue runner on another, as long as both machines point to the same shared wp-content/uploads/smartcloud-static-publisher storage. Example: WordPress host sees the storage at /var/www/site/wp-content/uploads/smartcloud-static-publisher Queue runner host mounts the same storage at /mnt/site Queue runner uses STATIC_PUBLISHER_RUNTIME_DIR='/mnt/site/runtime' Recommended rules for this setup: Keep outputDir and logDir storage-relative in admin, for example export and logs, not machine-specific absolute paths. Use @storage-root in postCrawlCopyMap when the source files are already inside the shared publisher storage. Use @wp-root only when the queue runner host can also access the WordPress tree, and set STATIC_PUBLISHER_WP_ROOT (or WPSUITE_STATIC_PUBLISHER_WP_ROOT) on that host. @runtime points to the shared runtime folder itself. Example postCrawlCopyMap sources: @storage-root/shared-assets/ @wp-root/wp-content/uploads/smartcloud-static-publisher/ If you inspect the raw queue-runner-heartbeat.json, the runtimeDir and exporterDir values reflect the queue runner host paths. That is expected and does not break WordPress-side queue state handling. Machine-readable resources Plugin manifest: https://wpsuite.io/.well-known/ai-plugin.json OpenAPI spec (backend): https://wpsuite.io/.well-known/openapi.yaml External Services This plugin/workflow may integrate with the following external services, depending on configuration: Source WordPress origin and allowed asset hosts (required for crawl/export) What it is & what it’s used for: The configured source origin and allowed asset hosts are fetched during crawl/render to collect pages and assets for static export. What data is sent & when: Standard HTTP(S) requests from the exporter to source pages/assets. Request data typically includes normal browser request metadata (URL, headers, cookies/session context if your source site requires it). Where it goes: sourceOrigin and hostnames listed in allowedAssetHosts. Amazon S3 (optional; deploy command) What it is & what it’s used for: Object storage target for exported static files. What data is sent & when: Exported HTML/assets plus object metadata (content type, cache-control) when deploy runs. Where it goes / API usage: AWS S3 APIs via AWS SDK (PutObject, ListObjectsV2, DeleteObjects) to your configured bucket/region. Links: AWS Service Terms: https://aws.amazon.com/service-terms/ AWS Privacy: https://aws.amazon.com/privacy/ Amazon CloudFront (optional; invalidate command) What it is & what it’s used for: CDN invalidation after deployment. What data is sent & when: Invalidation path list and distribution identifier when invalidate runs. Where it goes / API usage: AWS CloudFront API via AWS SDK (CreateInvalidation) for your configured distribution. Links: AWS Service Terms: https://aws.amazon.com/service-terms/ AWS Privacy: https://aws.amazon.com/privacy/ WP Suite platform connection (optional; site/workspace linking & shared features) When it applies: When you use WP Admin → SmartCloud → Connect your Site to WP Suite to link this WordPress site to a WP Suite workspace, or to switch/disconnect later. What it’s used for: Storing and retrieving Pro feature configuration (e.g., API/chatbot/feature settings) and enabling an admin-side preview experience so you can try Pro features in WP Admin before enabling them on the live site. What data may be sent: Minimal account/session data required for authentication, and minimal site/workspace linking data required to associate a WordPress site with a workspace (e.g., site/workspace identifiers and the site’s URL/domain). Where it goes / how it’s called: Secure HTTPS requests from the browser to WPSuite.io services (e.g. wpsuite.io and api.wpsuite.io). Links: WPSuite.io Privacy Policy: https://wpsuite.io/privacy-policy WPSuite.io Terms of Use: https://wpsuite.io/terms-of-use Amazon Cognito (optional; authentication for WP Suite Hub and/or protected APIs) When it applies: When using the WP Suite Hub, users authenticate (sign in / sign up) before creating/selecting a workspace and linking a site. If a plugin is configured to access protected endpoints that rely on Cognito, authentication/token flows may also be used for those requests. What it’s used for: User authentication and token-based authorization for subsequent API calls (e.g., to WPSuite.io APIs). Links: AWS Service Terms: https://aws.amazon.com/service-terms/ AWS Privacy: https://aws.amazon.com/privacy/ Stripe (optional; subscription/purchase flow) When it applies: Only when the user opens the optional WP Suite subscription / purchase flow in the shared admin component. What it’s used for: Displaying hosted pricing/subscription UI for optional paid features. What data may be sent: Browser/session data required by Stripe to render the hosted purchase UI and process the purchase flow. Links: Terms: https://stripe.com/legal/consumer Privacy: https://stripe.com/privacy Example IAM Role Profiles Adjust values before use (YOUR_BUCKET, YOUR_PREFIX, YOUR_ACCOUNT_ID, YOUR_DISTRIBUTION_ID). Command-to-profile mapping: deploy -> deploy-only invalidate -> deploy+invalidate publish -> deploy+invalidate deploy-only policy (S3 only): { “Version”: “2012-10-17”, “Statement”: [ { “Sid”: “ListOnlyTargetPrefix”, “Effect”: “Allow”, “Action”: [“s3:ListBucket”], “Resource”: “arn:aws:s3:::YOUR_BUCKET”, “Condition”: { “StringLike”: { “s3:prefix”: [“YOUR_PREFIX/“] } } }, { “Sid”: “RWOnlyTargetPrefixObjects”, “Effect”: “Allow”, “Action”: [ “s3:GetObject”, “s3:PutObject”, “s3:DeleteObject”, “s3:AbortMultipartUpload”, “s3:ListBucketMultipartUploads”, “s3:ListMultipartUploadParts” ], “Resource”: “arn:aws:s3:::YOUR_BUCKET/YOUR_PREFIX/” } ] } deploy+invalidate policy (S3 + CloudFront invalidation): { “Version”: “2012-10-17”, “Statement”: [ { “Sid”: “ListOnlyTargetPrefix”, “Effect”: “Allow”, “Action”: [“s3:ListBucket”], “Resource”: “arn:aws:s3:::YOUR_BUCKET”, “Condition”: { “StringLike”: { “s3:prefix”: [“YOUR_PREFIX/“] } } }, { “Sid”: “RWOnlyTargetPrefixObjects”, “Effect”: “Allow”, “Action”: [ “s3:GetObject”, “s3:PutObject”, “s3:DeleteObject”, “s3:AbortMultipartUpload”, “s3:ListBucketMultipartUploads”, “s3:ListMultipartUploadParts” ], “Resource”: “arn:aws:s3:::YOUR_BUCKET/YOUR_PREFIX/” }, { “Sid”: “InvalidateSpecificDistribution”, “Effect”: “Allow”, “Action”: [“cloudfront:CreateInvalidation”], “Resource”: “arn:aws:cloudfront::YOUR_ACCOUNT_ID:distribution/YOUR_DISTRIBUTION_ID” } ] } Trademark Notice Amazon Web Services, AWS, Amazon S3, and Amazon CloudFront are trademarks of Amazon.com, Inc. or its affiliates. SmartCloud Static Publisher is an independent project and is not affiliated with, sponsored by, or endorsed by Amazon Web Services or the WordPress Foundation. Source & Build Public source code: The project source is maintained by Smart Cloud Solutions, Inc. Build and distribution: SmartCloud Static Publisher is shipped to WordPress.org as a pre-built distribution. Build steps and development notes are documented in the repository README.