�� | � � �7 �J � �J $ 1K
VK aK qK �K �K �K �K @ �K
�K �K �K 4 L J 8L �L 7 �L �L
�L �L �L ! M +M BM VM \M cM jM
rM }M 0 �M & �M �M �M N 1N >N QN ZN " pN � �N � JO h �O I =P T �P C �P � Q � �Q l <R T �R �R ! S =S YS $ zS �S �S �S
�S �S ! T $T AT � ]T � )U �U �U �U D �U ! :V \V vV �V P �V �V �V �V � W [ �W d �W L `X _ �X 2
Y @Y + DY pY vY � �Y b HZ �Z �Z ' �Z $ �Z $ ![ F[ m Y[ S �[ T \ � p\ O �\ 2 E] $ x] # �] �] �] ! �] ( ^ & .^ U^ g^ �^ �^ �^ ? �^ k _ r_ _ ^ �_ � �_ M �` �` A a \a � da � �a
�b H �b �b ~ �b wc �c K �c �c �c �c m �c ld : }d �d ! �d �d e )e � He �e �e �e f f 4f Mf 3 if �f �f % �f g g . 5g # dg �g �g �g & �g �g h S .h �h �h " �h c �h 0i . :i ii ; si * �i �i
�i � j �j # �j �j k "k
,k 7k @k G Sk � �k 4l Cl [ Vl ( �l �l & �l ( m , Am nm �m �m ) �m �m
n n � n
o !o *o =o Zo uo �o � �o E fp �p �p �p �p �p q "
q P 0q �q ! �q �q �q �q �q �q r P #r tr �r �r �r �r �r �r �r s s ! 9s [s ts }s �s < �s �s �s �s # t (t 1t Gt ` Vt � �t �u � �u | Sv �v �v ^ �v
Hx Vx nx 3 �x �x o �x " Dy gy xy �y �y �y I �y z .z Bz Zz jz �z �z U �z ! { 9{ % E{ A k{ �{ �{ �{ �{ �{ � | �| � �| ! h} m �}
�} + ~ + 2~ ) ^~ �~ �~ �~ $ �~ �~ �~
[ & g � � � $� >� $ ^� �� �� �� �� � ր . \� �� �� �� ā 2 Ӂ � � � �� � � ,� H�
f� 4 q� � �� b 1� �� �� � �� g� �� j �� , �� e (� � �� � B� � � �� �� Ӎ � ��
� � 5 &� 6 \� F ��
ڎ � � � ԏ � r �� � h� Y � B n� � �� d z� c ߒ @ C� k �� � � 5 �� �� ؔ S � u G�
�� ˕ ە � �� � (� @� M� b� x�
�� - �� �� ٖ - � � )� ' 2� - Z� �� �� �� + �� � G � I P� e �� < �
=� H�
e� p� ��
�� �� � �� � G� �
�� � � � 0� � ?�
H� S� d� k� |� �� L �� � � � � � � ,� � � ˞ מ � � � � �
+� 9� M� l� U �� � . �� %� E� # _� �� �� , �� j ͠ 8� % X� ~� 5 �� ! ġ ' � � � 7� Q� V� v� � �� F� K�
^� l� C �� � ǣ I� � M� � � � � :� � U� � d �� a� $ f� �� �� Ŧ � � � � � *� :� M� Z `� 6 �� 1 � H $� ] m� 8 ˨ t � M y� I ǩ � � [ �� � 3 � / E� G u� N �� ( � : 5� o p� � � K b� ~ �� I -� - w� " �� Ȯ � Z � \�
l� w� J �� ѯ � ��
� � 3� D� ~ T� 5 Ӱ � � � :� б 2 � � $� - � m 7� � �� 5 A� w� 2 ��
�� ʴ ִ 5 ߴ � � � 8 �� � � �� �� � �� �� $ �� % ɸ � � � [ $� �� j �� ) � � /� B� N� b X� ( �� # � $ � ! -� O� U� Z� `� p� 2 �� " �� � �� " � =� U� $ i� ` �� � � "� = /� b m� н ٽ � ! � d "� T �� G ܿ $� 6� 0 E� v� + {� 0 �� 8 � � # � ( >� ) g� ) �� �� � �� �� � 3� � :� � � P 3� �� �� �� �� # �� $ � +� F� + e� ! �� # �� ��
�� Y �� G� Q� a� t� �� �� �� �� � �� { p� � �� z �� L $� 8 q� g �� 6 � I� � X� � �� � �� F &� 5 m� o �� e � P y� F �� G � D Y� > �� ? �� % � y C� F �� ' � - ,� + Z� 1 �� � �� � G� H �� ; � H [� � �� % C� + i� �� � �� � d� I D� � �� | � p ��
� @ .� # o� � �� Z ,� R �� N �� 6 )� `� � z� � � 4� a �� � O� ; �� � � � �� z �� Y
� V d� : �� x �� T o� �� L �� � (� q � � �� � � � �� ( j� N �� ? �� R "� D u� l �� '� � �� �� �� G �� s �� 7 P� �� O �� y �� j� ' �� �� �� . �� �� b � ] }� Y �� 5� � T� P � g� l� 5 �� - �� z �� g� �� d �� �
� w '� B �� �� b� g� q� �� ' �� �� T �� � 2� E� R� d� i� x� �� �� 5 �� �� �� � (� @� W� o� " �� �� �� � �� Z� O c� T �� / � 3 8� � l� +� ! G� i� ~� �� �� < � P �� i P� �� � � �� � ) � 6 � | B� � �� � �� 3 7� W k� & � g � � R� � /� � � ^ u� G � I � G f� M �� H �� E� � e� �� F ? _ d � � Q � \ � : ? � z l @ n & � # � = � # 8 > \ 5 � C � ( > # ^ 2 � � � # i 0 � � � � ~ ; 7 [ s ` � x 0 [ � j
9 p
�
�
�
�
�
2 �
�
. ! 8 Z x � � � � � � � � � n � }
$ -
R ] m � � � � @ �
� � � 4 � J 4 7 � �
� � � ! ' > R X _ f
n y 0 � & � � � - : M V " l � � � F h � I 9 T � C � � � � l 8 T � � ! 9 U $ v � � �
� � ! � = � Y � % � � � D � " 6 Y s � P � � � � � [ � d � L ] _ � 2
= + A m s � � b E � � ' � $ � $ C m V S � T � m O � 2 B $ u # � � � ! � ( ! & +! R! d! }! �! �! ? �! k " o" |" ^ �" � �" M �# �# A $ Z$ � b$ � �$
�% H �% �% ~ �% u& �& K �& �& �& �& m �& j' : {' �' ! �' �' ( '( � F( �( �( �( �( ) 2) K) 3 g) �) �) % �) * * . 3* # b* �* �* �* & �* �* + S ,+ �+ �+ " �+ c �+ ., . 8, g, ; q, * �, �,
�, � - �- # �- �- . .
*. 5. >. G Q. � �. 2/ A/ [ T/ ( �/ �/ & �/ ( 0 , ?0 l0 �0 �0 ) �0 �0 1 1 � 1 2 2 (2 ;2 X2 s2 �2 � �2 E d3 �3 �3 �3 �3 �3 4 " 4 P .4 4 ! �4 �4 �4 �4 �4 �4 5 P !5 r5 �5 �5 �5 �5 �5 �5 �5 �5 6 ! 76 Y6 r6 {6 �6 < �6 �6 �6 �6 # 7 &7 /7 E7 ` T7 � �7 �8 � �8 | Q9 �9 �9 ^ �9
F; T; l; 3 �; �; o �; " B< e< v< �< �< �< I �< = ,= @= X= h= �= �= U �= ! > 7> % C> A i> �> �> �> �> �> � ? �? � �? ! f@ m �@
�@ + A + 0A ) \A �A �A �A $ �A �A �A
B B [ $B g �B �B C "C <C $ \C �C �C �C �C � �C . ZD �D �D �D �D 2 �D E � E �E F F *F FF
dF 4 oF � �F b /G �G �G � �G eH �H j �H , �H e &L � �N � @O � �O �P �P �P �P �P Q Q 5 $Q 6 ZQ F �Q
�Q �Q � �Q �R �R r �R � fS Y T B lT � �T d xU c �U @ AV k �V � �V 5 �W �W �W S �W u EX
�X �X �X �X �X
Y &Y >Y KY `Y vY
�Y - �Y �Y �Y - �Y Z 'Z ' 0Z - XZ �Z �Z �Z + �Z �Z G [ I N[ e �[ < �[
;\ F\
c\ n\ �\
�\ �\ � �\ � E] �]
�]
^ ^ � .^ _ =_
F_ Q_ b_ i_ z_ �_ M �_ �_ ` ` ` ` � +` � a �a �a �a �a �a b b
*b 8b Lb kb U �b �b . �b $c Dc # ^c �c �c , �c j �c 7d % Wd }d 5 �d ! �d ' �d
e e 6e Pe Ue ue � �e Ef Jf
]f kf C �f � �f Hg � Lg �g �g h h 9h � Th �h d �h `i $ ei �i �i �i �i �i j j j )j 9j Lj Z _j 6 �j 1 �j H #k ] lk 8 �k t l M xl I �l � m [ �m �m 3 n / Dn G tn N �n ( o : 4o o oo � �o K ap ~ �p I ,q - vq " �q �q �q Z r [r
kr vr J �r �r �r �r s s 2s Cs ~ Ss 5 �s t t � 9t �t 2 �t � #u - v m 6v � �v & @w gw # mw
�w �w �w 5 �w �w � �w 8 }x �x � �x [z � |z ^{ $ v{ % �{ �{ �{ �{ [ �{ R| j Z| ) �| �| } } } b *} ( �} # �} $ �} ! �} !~ '~ ,~ 2~ B~ 2 ]~ " �~ �~ �~ " �~ ' $ ; ` ` � � � = � b ?� �� �� �� ! Ҁ d � T Y� G �� �� � 0 � H� + M� 0 y� 8 �� � # � ( � ) 9� ) c� �� �� Ʉ ΄ � � � � ޅ � P � V� w� �� �� # �� $ ؆ �� � + 7� ! c� # �� ��
�� Y �� � #� 3� H� i� ~� �� �� � �� { D� � �� z }� L �� 8 E� g ~� 6 � � � ,� � nj � j� F �� 5 A� o w� e � P M� F �� G � D -� > r� ? �� % � y � F �� ' ؑ - � + .� 1 Z� � �� � � H �� ; � H /� � x� % � + =� i� � � � 8� I � � b� | � p p� � @ � # C� � g� Z � R [� N �� 6 �� 4� � N� � � � a �� � #� ; �� � � � �� z c� Y ޟ V 8� : �� x ʠ T C� �� L �� � �� q � � ]� � � � �� ( >� N g� ? �� R �� D I� l �� �� � {� T� ^� G h� s �� 7 $� \� O t� y ī >� ' Y� �� �� . �� ͬ b � ] Q� Y �� � � (� P � ;� @� 5 \� - �� z �� ;� W� d q� ְ ް w �� B s� �� 6� ;� E� d� ' m� �� T �� � � � &� 8� =� L� _� t� 5 �� �� ʳ � �� � +� C� " V� y� �� � �� .� O 7� T �� / ܶ 3 � � @� �� ! � =� R� p� |� < �� P Ӹ i $� �� � �� �� �� ) �� 6 ߺ | � � �� � c� 3 � W ?� & �� g �� � &� � � � �� ^ I� G �� I � G :� M �� H � � � 9� �� G �� ? 4� d t� � �� Q e� \ �� : � � O� l �� @ C� & �� # �� = �� #
� > 1� 5 p� C �� ( �� � # 3� 2 W� � �� # >� 0 b� � �� � S� ; � [ H� ` �� x � [ ~� j �� 9 E� � �� �� �� �� 2 �� �� �� �� � !
� /� M� d� m� y� �� �� �� �� �� �� � ; � T . � ' P 6 q N + � I Y � $ � 6 � � H � � 7 � 0 ; � % d � t � m O J � L # ~ j � J k ^ � d h � j F � p � � W � c � D m U � � � � � 1 k � = � � � - � > � � 6 � ) N � � � G � . [ � & � � � z { x $ C � " P � � r w _ � � ] y � \ s � ? � V v [ � � m � � Q � f e S F " G � � � � � � R � ' O Y � � I m � � � � x R � f
� ! � � � � � � t * � O > ^ Z � % � � � � � � g | � � � � � � � � � F E 8 -
� � * ~ � W � � : � p " � � � ` � 4 � 5 D � " , � N 6 � � ( � i � � q T S � � � � � e � � � - � o � d � � � � � � � � � Z � � r ~ X � � 4 � e � � o � j � . � � � A V < P b � 4 � ! c � � = q � % Y 1 * � � , � 3 k � � i / s ! ) w � � � S � � � � � � a � � E 8 � ] ! � � � � � > � . � U � 7 � � } � � : � � � l � c A p | j c � � � < � P U = x � � 8 b y � � a � � X � � � �
� � � B H � K � � � � ' � � 7 � � @ 1 � h � � � \ � � � n z , 3 �
u � * 0 J � � � � � � � � � � � � \ i W & o � � 8 � � l A � \ � ` � @ , � M � � � � E � � � � S � � s ) � � { # t � e � $ 9 W � 3 l � : � X � � � 4 L b z w � R u 7 � d � q � M � - � 9 | g � | { � � X u < � � [ L B 9 � + � 2 p
� � � � h � � v � � 5 � � + � n � 0 B � � � w � � � Q � f � @ �
� � � �
H Y 5 � 3 � � Q � � G � � r D � K � s ? � � � ` � Z � � � � l T 0 N Z u � � � h k V H � � 2 � � � & / � � � � ; � } � I _ ) v r � � 2 z � @ o � b � g ( � � < � ] / T � { � i � ^ C � ^ � + A ( � M � E � � # y 5 � # � � � � ' > M � K K ? � � � � � } J � � I U � �
n D � � � n � g � � % � � a 1 ; Q � t ` _ � � � � � / C � � $ a R y � 2 L G � v ( F & � � [ � ] V � f _ x O � : ? B � � C = � 9 Please note that you can always save and finish the wizard later, use our %sdocumentation%s for additional information or log a %ssupport ticket%s if you need our assistance. %1$s ‹ %2$s — WordPress %d seconds %d:%02d minutes %d:%02d:%02d hours %s day %s days %s hour %s hours %s is a singleton class and you cannot create a second instance. %s minutes %s month %s months %s unused code remaining. %s unused codes remaining. %s vulnerability has been detected. %s vulnerabilities have been detected. %s week %s: %s vulnerability found %s: %s vulnerabilities found (opens in a new tab) (recommended) (unknown) .htaccess does not exist .htaccess in uploads not writable .htaccess not writable .htaccess redirect. 1 day 1 hour 1 year 2 years 30 minutes 301 .htaccess redirect 301 .htaccess redirect (read instructions first) 301 .htaccess redirect is not enabled. 301 PHP redirect 301 SSL redirect enabled 301 redirect to https set. 404 Blocking 48 hours (default) 6 months 8 hours (recommended) A %s vulnerability is found in %s. A correctly configured Content Security Policy can protect your visitors from the most common web attacks. It all starts with denying and upgrading insecure requests on your website. A debug.log is publicly accessibile and has a standard location. This will change the location to a randomly named folder in /wp-content/ A definition of a site url or home url was detected in your wp-config.php, but the file is not writable. A firewall rule was enabled, but /the wp-content/ folder is not writable. A firewall rule was enabled, but the firewall does not seem to get loaded correctly. A firewall rule was enabled, but the wp-config.php is not writable. A lockout will occur if an IP address exceeds the threshold within the given timeframe. Select ‘%s’ if you want to disable 404 blocking. A networkwide SSL activation process has been started, but has not been completed. Please go to the SSL settings page to complete the process. A verification code has been sent to the email address associated with your account to verify functionality. A verification code has been sent to the email address associated with your account. API login for user disabled. Able to create destination folder About Cross Origin Policies About Essential Security Headers About HTTP Strict Transport Security About Hardening About Limit Login Attempts About Vulnerabilities About XML-RPC About notifications About the Content Security Policy About the Mixed Content Scan About the Permission Policy According to our information, your hosting provider does not allow any kind of SSL installation, other then their own paid certificate. For an alternative hosting provider with SSL, see this %sarticle%s. According to our information, your hosting provider supplies your account with an SSL certificate by default. Please contact your %shosting support%s if this is not the case. Action Activate Activate SSL Activate SSL per site or install a wildcard certificate to fix this. Activate networkwide to fix this. Activate your license key Activating plugin... Active Add additional domains which can embed your website, if needed. Comma seperated. Advanced Advanced Hardening Advanced WordPress Hardening Advanced hardening features complement the basic hardening functions by protecting your site against advanced threats and attacks. Advanced hardening features to protect your site against sophisticated threats and attacks. After completing the installation, you can continue to the next step to complete your configuration. After enabling this feature, you can submit your site to %shstspreload.org%s After this number of failed login attempts the user and IP address will be temporarily blocked. Alias domain check is not relevant for a subdomain All All recommended hardening features enabled. Allow Allow grace period Allow only necessary third party resources to be loaded on your website, thus preventing common attacks. Use our unique learning mode to automatically configure your Content Security Policy. Allow visitors that might accidentally exceed the threshold to unblock themselves using a Captcha. Allow your domain to be embedded Allowed Allows you to enter a custom login URL. An SSL certificate has been detected An error occurred, please try again. An error occurred: An option that requires the .htaccess file in the uploads directory is enabled, but the file is not writable. An option that requires the .htaccess file is enabled, but the file does not exist. An option that requires the .htaccess file is enabled, but the file is not writable. As a security precaution, the username ‘admin’ has been changed on %s. From now on, you can login with '%s' or an email address. As your order will be regenerated, you'll need to update your DNS text records. Attempting to install certificate using AutoSSL... Attempting to install certificate... Attempting to set DNS txt record... Authenticate Authentication Code: Authentication code is incorrect. Authentication codes will be sent to %s. Authentication provider not specified. Authenticator App Authenticator App (TOTP) Authenticator app Authorization not completed yet. Automated Measures Automatic certificate detection is not possible on your server. Automatic renewal of your certificate was not possible. The SSL certificate should be %srenewed%s manually. Backup Codes Basic Because the $_SERVER["HTTPS"] variable is not set, your website may experience redirect loops. Below you will find the instructions for different hosting environments and configurations. If you start the process with the necessary instructions and credentials the next steps will be done in no time. Below you will find your login code for %1$s. It's valid for 15 minutes. %2$s Block the username 'admin' Block user registrations when login and display name are the same Blocked Blocked IP addresses will be automatically unblocked after the above-configured interval. In the table below you can instantly unblock IP addresses. Blocked usernames will be automatically unblocked after the above-configured interval. In the table below you can instantly unblock usernames. Blocklists Browser features are plentiful, but most are not needed on your website. Bundle not available yet... By default, WordPress shows if a username or email address exists when a login fails. This will change it to generic feedback. CPanel host CPanel password CPanel recognized. Possibly the certificate can be installed automatically. CPanel username Cancel Captcha Captcha has not yet been verified, you need to complete the process of a Captcha to verify it's availability. Captcha provider Certificate already generated. It was renewed if required. Certificate not created. Challenge directory not writable. Change debug.log file location Change passwords every Changed debug.log location to: Changing redirect methods should be done with caution. Please make sure you have read our instructions beforehand at the right-hand side. Cheatin’ uh? Check again Check manually Check your %slicense%s. Checking SSL certificate... Checking alias domain... Checking certs directory... Checking challenge directory reachable over http... Checking challenge directory... Checking for subdomain setup... Checking for website configuration... Checking host... Checking if CURL is available... Checking if Terms & Conditions are accepted... Checking if plugin folder exists... Checking key directory... Checking permissions... Checking server software... Choose new username to replace 'admin' Choose the max-age for HSTS Choose your provider Click the button below to confirm your email address, or copy the following URL: %s CloudWays API key CloudWays user email Codes only available for 5 minutes Complete email validation and enable notifications to make sure you will receive security warnings. Completed Complianz - Consent Management as it should be Component Components will be quarantined if the update process fails. Compromised password for %s has been reset Compromised password reset Configuration Configure your Cookie Notice, Consent Management and Cookie Policy with our Wizard and Cookie Scan. Supports GDPR, DSGVO, TTDSG, LGPD, POPIA, RGPD, CCPA and PIPEDA. Configured for HTTP challenge Consent Management as it should be. Content Security Policy Content Security Policy Headers Continent Continents Continue Continue to renew. Control and monitor the use of XML-RPC on your site with learning mode. Control browser features that could allow third parties to misuse data collected by microphone, camera, GEO Location etc, when enabled for your website. Copy setup key Copyright warning! Could not automatically add TXT record. Please proceed manually, following the steps below. Could not copy code execution test file. Could not copy text: Could not create test folder and file. Could not find code execution test file. Could not reach challenge directory over %s. Could not rename folder! Could not retrieve server list Could not test certificate Could not verify TXT record for domain %s Could not verify alias domain. Count Country Crawlers might scan your site looking for possible exploits. One way to detect this is the fact that they trigger more 404 (not found) errors than legitimate visitors would. Below you can set the threshold and lockout duration for 404 blocking. Creating account... Critical Critical (default) Cross Origin Embedder Policy Cross Origin Opener Policy Cross Origin Resource Policy Custom login URL Customize login attempts, intervals, and temporary lockouts according to your preferences to regulate the level of security on your website during authentication. No additional settings required DNS records were not verified yet. Please complete the previous step. DNS token not retrieved. DNS verification Dashboard Dashboard - Test Notification Date Debug.log Delete all data on plugin deletion Depending on your hosting provider, %1$smanual installation%2$s may be required. Description Destination folder already exists Details Detected File Changes Detected status of your setup. Direct Admin URL DirectAdmin host DirectAdmin password DirectAdmin recognized. Possibly the certificate can be installed automatically. DirectAdmin username Directive Directories Disable Disable "anyone can register" Disable HTTP methods Disable OCSP stapling Disable XML-RPC Disable application passwords Disable directory browsing Disable the built-in file editors Disable user enumeration Disabled Dismiss Dismiss all notifications Do you want to store these credentials for renewal purposes? Domain Don't ask again Don't show again Don't use Two-Factor Authentication Download Download Backup Codes Download Codes Due to a change in challenge type, the order had to be reset. Please start at the previous step. During the grace period users can configure their Two-Factor method. When the grace period ends, users for which 2FA is enforced won’t be able to login unless 2FA is correctly configured. The grace period is also applied to new users. E-mail login Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate generation. Elevate your security with our Premium Support! Our expert team ensures simple, hassle-free assistance whenever you need it. Email Email Verification Email Verification sends a verification code to the user’s email address. This method provides protection against leaked or weak passwords, though it is less secure than other 2FA methods. If a user’s email inbox is compromised, one could still get access to the user account. It is not recommended to allow Email Verification for administrators. Email address Email address not valid Email could not be sent. Email could not be sent. No message or subject set. Email notification error Email notifications are only sent for important updates, security notices or when certain features are enabled. Email sent! Please check your mail Email validation Email validation completed Email verification Email verification error Enable Enable .htaccess only if you know how to regain access in case of issues. Enable 301 .htaccess redirect Enable 301 redirect Enable Custom login URL Enable Firewall Enable Limit Login Attempts Enable Permissions Policy Enable Two-Factor Authentication Enable a .htaccess redirect or PHP redirect in the settings to create a 301 redirect. Enable compromised password check Enable for: Enable open source blocklist API etc. Enable the Vulnerability scan to detect possible vulnerabilities. Enable vulnerability scanning Enabled Enabling auto renew... Enforce for: Enforce frequent password change Enforce secure password policies for your users by requiring strong passwords, and expiring passwords after a period of your choosing. Enforce strong passwords Enforcing 2FA ensures that all users with the selected roles must login using Two-Factor Authentication. It is strongly recommended to at least enforce 2FA for Administrators. Enter a backup verification code. Enter a custom login URL. This allows you to log in via this custom URL instead of /wp-admin or /wp-login.php Error code %s Error enabling auto renew for Let's Encrypt Error occurred when retrieving the webpage. Errors were reported during installation. Essential Security Headers Essential WordPress hardening Essential security Essential security headers installed Event Event Log Event Logs Every three hours Example: If you want to change your login page from /wp-admin/ to /control/ answer: control Experience all powerful features of Really Simple Security Pro using this %slimited time discount%s: %s Failed retrieving access token Failed retrieving account. Failed to activate plugin Failed to create a login nonce. Failed to gather package information Failed to install plugin Feature Feedback in plugin overview File Change Detection File Change Detection generates a snapshot of every .php and .js file. On a daily basis, each file is then compared to this snapshot. File missing. Please retry the previous steps. File permissions check Files not created yet... Firewall Firewall Rules For more information, please read this %sarticle%s Force update From now on, the debug.log won’t be publicly accessible whenever wp-debugging is enabled. The debug log will be stored in a randomly named folder in /wp-content/. This prevents possible leakage of sensitive debugging information. GDPR/CCPA Privacy Suite General General Settings Generate Verification Codes Generating SSL certificate... Generation Get Login Protection with Really Simple Security Pro Get detailed insights into visitors' behaviour with Burst Statistics, the privacy-friendly analytics dashboard from Really Simple Plugins. Get notified of important changes, updates and settings. Recommended when using security features. Go to activation Go to installation HSTS forces browsers always to load a website via HTTPS. It prevents unnecessary redirects and prevents manipulation of data originating from communication with your website. HTTP Strict Transport Security Hardening Hardening features limit the possibility of potential weaknesses and vulnerabilities which can be misused. Hello %1$s, an unusually high number of failed login attempts have been detected on your account at %2$s.
These attempts successfully entered your password, and were only blocked because they failed to enter your second authentication factor. Despite not being able to access your account, this behavior indicates that the attackers have compromised your password. The most common reasons for this are that your password was easy to guess, or was reused on another site which has been compromised.
To protect your account, your password has been reset, and you will need to create a new one. For advice on setting a strong password, please read %3$s
To pick a new password, please visit %4$s
This is an automated notification. If you would like to speak to a site administrator, please contact them directly. Hello, this is a notice from your website to inform you that an unusually high number of failed login attempts have been detected on the %1$s account (ID %2$d). Those attempts successfully entered the user's password, and were only blocked because they entered invalid second authentication factors. To protect their account, the password has automatically been reset, and they have been notified that they will need to create a new one. If you do not wish to receive these notifications, you can disable them with the `two_factor_notify_admin_user_password_reset` filter. See %3$s for more information. Thank you Here you can configure vulnerability detection, notifications and measures. To learn more about the features displayed, please use the instructions linked in the top-right corner. Here you can see which users have configured Two-Factor Authentication. The reset button will trigger the 2FA onboarding for the selected user(s) again and allow the configured grace period. Here you control the users that are automatically, and temporarily blocked. You can also add or remove users manually. We recommend blocking ‘admin’ as username as a start. Hi Hide the remember me checkbox Hide your WordPress version High-risk High-risk (default) Hosting Hosting provider I agree to the Terms & Conditions from Let's Encrypt. I don't know, or not listed, proceed with installation I have read and understood the risks to intervene with these measures. IP Address IP Addresses IP Addresses can be allowed, blocked or will show up when your settings add them to a temporary blocklist. If you want to add your IP to the allowlist, please read the article provided at the right-hand side for instructions. IP Blocklist IP address overview If the number of failed login attempts is exceeded within this timeframe, the IP address and user will be blocked. If the username 'admin' currently exists, you can rename it here. Please note that you can no longer use this username, and should use the new username or an email address If there's a vulnerability, you will also get feedback on the themes and plugin overview. If this is not the case, don't add this alias to your certificate. If this option is set to true, the mixed content fixer will fire on the init hook instead of the template_redirect hook. Only use this option when you experience problems with the mixed content fixer. If unexpected file changes have occurred, this could be an indication that your site is compromised. If you are the owner of this account, please check your email for instructions on regaining access. If you entered your DNS records before, they need to be changed. If you recognize the detected changes, you can add the files to the exclude list, or ignore them just once. If your site is only intended for users to login from specific geographical regions, you can entirely prevent logins from certain continents or countries. Implement Two-Factor Authentication or Passkey login. Import and insert file Improve security - Upgrade Improve security by requiring strong passwords and forced periodic password changes Improve the default WordPress password strength check. You can also enforce frequent password changes for user roles. Include alias Include preload Include subdomains Install Install %sManually%s. Install Authentication app: Install SSL certificate Installation Installation failed. Installation finished Installed Installing Installing SSL certificate using PLESK API... Installing SSL certificate... Installing plugin... Instantly configure these essential features. Instructions Interval Invalid Two Factor Authentication code. Invalid Two Factor Authentication secret key. Invalid license. Invalid login details. Invalid provider Invalid two-factor authentication provider. Invalid verification code. It is not possible to install Let's Encrypt on a localhost environment. It is not possible to install Let's Encrypt on a subfolder configuration. It is not possible to install Let's Encrypt on a subsite. Please go to the main site of your website. Keep your site secure by monitoring unexpected file changes. Key copied Lax - 10 errors in 2 seconds Learn more Learn more about our features! Leave a review Let's Encrypt Let's Encrypt. Letʼs Encrypt is a free, automated and open certificate authority brought to you by the nonprofit Internet Security Research Group (ISRG). Leveraging your SSL certificate with HSTS is a staple for every website. Force your website over SSL, mitigating risks of malicious counterfeit websites in your name. License invalid License valid Limit Attempts Limit Login Attempts Limit Login Attempts protects your site from login attempts by unauthorized users. When you enable Limit Login Attempts, all login attempts are logged and repeated attempts to login with invalid credentials will be blocked automatically. Limit logged in session duration Location Locked-out Lockout duration Log In Login Protection Login attempts Login credentials incorrect Login credentials incorrect. Please check your login credentials for cPanel. Login status Logs Low-risk Low-risk Low-risk (default) Maintain peace of mind with our simple, but effective automated measures when vulnerabilities are discovered. When needed Really Simple Security will force update or quarantaine vulnerable components, on your terms! Many vulnerabilities are exploited by injecting a user with administrator capabilities outside of the native WordPress creation process. Under advanced hardening you can prevent this from happening. Maybe later Measures Medium-risk Method Missing license. Mixed Content Fixer Mixed Content Scan Mixed content Mixed content fixer Mixed content fixer - back-end Mixed content fixer - init hook Mixed content fixer not enabled. Enable the option to fix mixed content on your site. Mixed content in %s Mixed content in CSS/JS file from other domain Mixed content in PHP file in %s Mixed content in post: %s Mixed content in the postmeta table Mixed content scan More info Multiple %s vulnerabilities have been found. No 301 redirect is set. Enable the WordPress 301 redirect in the settings to get a 301 permanent redirect. No 301 redirect to SSL enabled. No SSL certificate has been detected. No SSL detected No SSL detected. Use the retry button to check again. No known vulnerabilities detected No recommended redirect rules detected. No redirect No subdomain setup detected. No valid list of domains. None Normal - 10 errors in 5 seconds Not recognized server. Not sure if you're using XML-RPC, or want to restrict unauthorized use of XML-RPC? With learning mode you can see exactly which sources use XML-RPC, and you can revoke where necessary. Note Notification by %s Notifications Notifications by email OCSP not supported, the certificate will be generated without OCSP. OCSP stapling is configured as enabled by default. You can disable this option if this is not supported by your hosting provider. Off On Apache you can use a .htaccess redirect, which is usually faster, but may cause issues on some configurations. Read the instructions in the sidebar first. Once every 5 minutes Once every day Once every week One click SSL optimization One day (for testing only) One of the most powerful features, and therefore the most complex are the Cross-Origin headers that can isolate your website so any data leaks are minimized. One year Only enable this if you experience mixed content in the admin environment of your WordPress website. Open Order ID mismatch, regenerate order. Order successfully created. Order successfully retrieved. Package information retrieved Password Reset Password Security Password security Passwords Permanent Permanent block Permission denied. Permissions Policy Please %sconsider upgrading to Pro%s to enjoy all simple and performant security features. Please activate it manually on your hosting dashboard. Please activate it on your dashboard %smanually%s Please add the following lines to your .htaccess, or set it to writable: Please adjust the CAA records via your DNS provider to allow Let’s Encrypt SSL certificates Please change your email address %shere%s and try again. Please check if the advanced-headers.php file is included in the wp-config.php, and exists in the wp-content folder. Please check if the non www version of your site also points to this website. Please check if the www version of your site also points to this website. Please check if your REST API is loading correctly. Your site currently is using the slower Ajax fallback method to load the settings. Please check the vulnerabilities overview for more information and take appropriate action. Please complete %smanually%s Please complete manually in your hosting dashboard. Please complete the following step(s) first: %s Please configure your %sCaptcha settings%s before enabling this setting Please create a folder 'rsssl' in the uploads directory, with 644 permissions. Please double check your DNS txt record. Please enter the code generated by your authenticator app. Please make sure to configure a method, access to your account will be denied if no method is configured today. Please make sure to configure a method, access to your account will be denied if no method is configured within the next %s days. Please refresh the SSL status if a certificate has been installed recently. Please scan the QR code or manually enter the key, then enter an authentication code from your app in order to complete setup. Please set the wp-config.php to writable until the rule has been written. Please set the wp-content folder to writable: Please start at the previous step. Please take appropriate action. Please verify your email Please wait %s before trying again, as this is the expiration of the DNS record currently. Plesk admin URL Plesk host Plesk password Plesk recognized. Possibly the certificate can be installed automatically. Plesk username Plesk username and password Plugin activated Plugin installed Powered by WordPress Preferred Method Premium Support Prevent clickjacking and other malicious attacks by restricting sources that are permitted to embed content from your website. Prevent code execution in the public 'Uploads' folder Prevent login feedback Prevent session hijacking Prevent usage of passwords that have been included in a databreach. This securely verifies part of the hashed password via the Have I Been Pwned API. Privacy-friendly analytics tool. Protect your login form with Limit Login Attempts. Protect your site against brute force login attacks by limiting the number of login attempts. Enabling this feature will temporary lock-out a username and the IP address that tries to login, after the set number of false logins. Protect your site with a performant Firewall. Protect your website against brute-force attacks with a captcha. Choose between Google reCAPTCHA or hCaptcha. Protecting your website visitors from malicious attacks and data breaches should be your #1 priority, start with the essentials with Really Simple Security Provider LabelBackup Verification Codes (Single Use) Provider LabelEmail Provider LabelTime Based One-Time Password (TOTP) Quarantine Quarantined Re-check Read about our journey towards Really Simple Security Read more Really Simple Plugins is also the author of the below privacy-focused plugins, including consent management, legal documents and analytics! Really Simple SSL is now %1$sReally Simple Security!%2$s Really Simple Security Pro Really Simple Security allows you to limit the default logged in session duration. By default, WordPress will keep users logged in for 48 hours, or even 14 days when clicking the ‘remember me’ checkbox. An attacker could possibly steal the logged in cookie and gain access to a user’s account. Limiting the logged in duration to 8 hours will greatly reduce the risk of session hijacking. Really Simple Security dashboard Really Simple Security will send email notifications and security warnings from your server. We will send a test email to confirm that email is correctly configured on your site. Look for the confirmation button in the email. Receive a code by email Recommended by Really Simple Plugins Recommended security headers enabled. Recovery Mode — %s Redirect method Redirection Redirects your site to https with a SEO friendly 301 redirect if it is requested over http. Regions Rename admin user enabled: Please choose a new username of at least 3 characters, which is not in use yet. Rename and randomize your database prefix Renew certificate Renew installation Resend Code Reset Key Restrict access from specific countries or continents. You can also allow only specific countries. Restrict creation of administrator roles Retrieving Cloudways server data... Retrieving DNS verification token... Retrieving package information... Retry Risk Rules SSL Status Test SSL activation in progress SSL certificate should be generated and installed. SSL certificate will expire on %s. SSL is enabled networkwide. SSL is enabled on your site. SSL is not enabled on your network SSL is not enabled yet. SSL is not enabled. SSL is not yet enabled on this site. SSL is now activated. Follow the three steps in this article to check if your website is secure. SSL successfully installed on %s Save and continue Scan results Searching for link to SSL installation page on your server... Secret key is configured and registered. It is not possible to view it again for security reasons. Security Security Headers Security Headers Test Security configuration completed! Security configuration not completed yet. You still have %s task open. You still have %s tasks open. Security through obscurity. Your site is no longer using the default wp_ prefix for database tables. The process has been designed to only complete and replace the tables after all wp_ tables are successfully renamed. In the unlikely event that this does lead to database issues on your site, please navigate to our troubleshooting article. See which recommended security headers are not present on your website. Selected provider Self (Default) Self-hosted and privacy-friendly analytics tool. Send Serve encrypted and authenticated responses Set permissions to 644 to enable SSL generation. Set your wp-config.php to writable and reload this page. Settings Settings update: .htaccess redirect Settings update: Database prefix changed Settings update: Debug.log file relocated Settings update: Username 'admin' renamed Site wide - Test Notification Site-wide, admin notification Skip Skip (%1$d %2$s remaining) Skip (Only today remaining) Source Start login protection by adding an additional layer during authentication. This will leave authentication less dependent on just a single password. Want to force strong passwords? Check out Password Security. Status Stop editing the .htaccess file Store for renewal purposes. If not stored, renewal may need to be done manually. Strict - 10 errors in 10 seconds Strong Password policy Submit Successfully added TXT record. Successfully generated certificate. Successfully installed Let's Encrypt Successfully installed SSL Successfully retrieved account Successfully retrieved server id and app id Successfully verified DNS records Successfully verified alias domain. Support System status TOTP requires users to authenticate using a third-party app such as Google Authenticator. Temporary Temporary block Terms & Conditions Terms & Conditions are accepted. Terms and Conditions Test not found. Test notification email error Test notifications Test notifications can be used to test email delivery and shows how vulnerabilities will be reported on your WordPress installation. The 'force-deactivate.php' file has to be renamed to .txt. Otherwise your ssl can be deactivated by anyone on the internet. The .htaccess redirect has been enabled on your site. If the server configuration is non-standard, this might cause issues. Please check if all pages on your site are functioning properly. The .htaccess redirect rules selected by this plugin failed in the test. Set manually or dismiss to leave on PHP redirect. The 301 .htaccess redirect is the fastest and most reliable redirect option. The 301 redirect with .htaccess to HTTPS is now enabled. The DISALLOW_FILE_EDIT constant is defined and set to false. You can remove it from your wp-config.php. The DNS response for %s was %s, while it should be %s. The Essentials The Event Log shows all relevant events related to limit login attempts. You can filter the log using the dropdown on the top-right to only show warnings. The Event Log shows all relevant events related to the Firewall and IP lockouts. You can filter the log using the dropdown on the top-right to only show warnings. The Hosting Panel software was not recognized. Depending on your hosting provider, the generated certificate may need to be installed manually. The IP address will see a locked out screen for the selected duration. The PHP function CURL has successfully been detected. The PHP function CURL is not available on your server, which is required. Please contact your hosting provider. The SSL certificate has been renewed, and requires manual %sinstallation%s in your hosting dashboard. The Terms & Conditions were not accepted. Please accept in the general settings. The Two-Factor Authentication setup for TOTP failed. Please try again. The Two-Factor Authentication setup for email failed. Please try again. The URL you use to access your DirectAdmin dashboard. Ends on :2222. The URL you use to access your Plesk dashboard. Ends on :8443. The URL you use to access your cPanel dashboard. Ends on :2083. The authentication code is not valid. The automatic installation of your certificate has failed. Please check your credentials, and retry the %sinstallation%s. The certificate installation was rate limited. Please try again later. The certs directory is not created yet. The certs directory was successfully created. The challenge directory is not created yet. The challenge directory was successfully created. The code to block code execution in the uploads folder cannot be added automatically on nginx. Add the following code to your nginx.conf file: The content security policy has many options, so we always recommend starting in ‘learning mode’ to see what files and scripts are loaded. The daily scan will report any detected file changes in the table below. The email address was not set. Please set the email address The following directories do not have the necessary writing permissions. The following information is attached when you send this form: license key, scan results, your domain, .htaccess file, debug log and a list of active plugins. The key directory is not created yet. The key directory was successfully created. The key is not valid. The lightweight Firewall can be used to lockout malicious traffic from your site. You can configure generic rules below, or block specific IP addresses by adding them to the Blocklist. The mixed content fixer could not be detected due to a cURL error: %s. cURL errors are often caused by an outdated version of PHP or cURL and don't affect the front-end of your site. Contact your hosting provider for a fix. The mixed content fixer is active, but was not detected on the frontpage. The non-www version of your site does not point to this website. This is recommended, as it will allow you to add it to the certificate as well. The onboarding wizard will help to configure essential security features in 1 minute! Select your hosting provider to start. The order is invalid, possibly due to too many failed authorization attempts. Please start at the previous step. The preferred method is not set. The required directories have the necessary writing permissions. The selected provider is not valid. The settings below determine how strict your site will be protected. You can leave these settings on their default values, unless you experience issues. The snapshots will be updated after WordPress, plugins or themes are activated or updated. The system is not ready for the DNS verification yet. Please run the wizard again. The system is not ready for the installation yet. Please run the wizard again. The used domain for your email address is not allowed. The user ID is not valid. The user and IP address will be temporarily unable to login for the specified duration. You can block IP addresses indefinitely via the IP addresses block. The user object is not valid. The value, WP_DEBUG_LOG, has been added to this website’s configuration file. This means any errors on the site will be written to a file which is potentially available to all users. The wp-config.php file is not writable, and needs to be edited. Please set this file to writable. The www version of your site does not point to this website. This is recommended, as it will allow you to add it to the certificate as well. There are existing keys, the order had to be cleared first. There have been too many failed two-factor authentication attempts, which often indicates that the password has been compromised. The password has been reset in order to protect the account. These notifications are set to the minimum risk level that triggers a notification. For example, the default site-wide notification triggers on high-risk and critical vulnerabilities. These security headers are the fundamental security measures to protect your website visitors while visiting your website. They might be misused if you don’t actively tell the browser to disable these features. This adds extra requirements for strong passwords for new users and updated passwords. This appears to be an invalid license key for this plugin. This email address is used to create a Let's Encrypt account. This is also where you will receive renewal notifications. This email is confirmation that any security notices are likely to reach your inbox. This email was sent to This feature allows you to block visitors from your website based on country This feature depends on multiple standard background processes. If a process fails or is unavailable on your system, detection might not work. We run frequent tests for this purpose. We will notify you accordingly if there are any issues. This is a multisite configuration with subdomains. You should generate a wildcard certificate on the root domain. This is a security feature implemented by web browsers to control how web pages from different origins can interact with each other. This is the vulnerability overview. Here you will find current known vulnerabilities on your system. You can find more information and helpful, actionable insights for every vulnerability under details. This leads to issues when activating SSL networkwide since subdomains will be forced over SSL as well while they don't have a valid certificate. This list shows all individually blocked IP addresses. On top the top-right you can filter between permanent blocks and temporary blocks. By default, blocks are only temporary, as attackers and bots will frequently alter between IP addresses. However, you can manually configure permanent blocks. This option is handled by the Content Security Policy/frame-ancestors setting. This setting will block attempts to assign administrator roles outside the native user creation process by WordPress. This might include other plugins that create, edit or assign roles to users. If you need to create an administrator in a third-party plugin, temporarily disable this setting while you make the changes. This site requires you to secure your account with a second authentication method. This will include both the www. and non-www. version of your domain. This will limit or fully disable HTTP requests that are not needed, but could be used with malicious intent. This will permanently change your database prefixes and you can NOT rollback this feature. Please make sure you have a back-up. This will send emails about vulnerabilities directly from your server. Make sure you can receive emails by the testing a preview below. If this feature is disabled, please enable notifications under general settings. Threshold Time left To ensure all traffic passes through SSL, please enable a 301 redirect. To safely enable SSL on your server configuration, you should add the following line of code to your wp-config.php. Token not generated. Please complete the previous step. Token not received yet. Token successfully retrieved. Click the refresh button if it's not visible yet. Too many invalid verification codes, you can try again in %s. This limit protects your account against automated attacks. Trigger Captcha on lockout Trigger captcha on failed login attempt Trusted Trusted IP addresses Trying to create directory in root of website. Two years (required for preload) Two-Factor Authentication adds an extra layer of security to your account. You can enable it here. Two-Factor Authentication for TOTP failed. No Authentication code provided, please try again. Two-Factor Authentication is mandatory for your account, so you need to make a selection. Two-Factor Backup Codes for %s Two-Factor authentication allows users to login using a second authentication method, other than their e-mail address and password. It is one of the most powerful ways to prevent account theft. Two-Factor: You are out of backup codes and need to <a href="%s">regenerate!</a> Type Unable to connect to cPanel Unable to enable Backup Codes provider for this user. Unable to enable TOTP provider for this user. Unable to save Two Factor Authentication code. Please re-scan the QR code and enter the code provided by your application. Unauthorized administrators Unset X-Powered-By header Update Really Simple SSL Pro: the plugin needs to be updated to the latest version to be compatible. Upgrade Uploads folder not writable. Usage of the title attribute on the login logo is not recommended for accessibility reasons. Use the link text instead. Use an authenticator app on your mobile device to generate a code. Use your authenticator app like Google Authenticator to scan the QR code below, then paste the provided Authentication code. %s User User role User roles for password change Username Username 'admin' has been changed to %s Users Users trying to enter via /wp-admin or /wp-login.php will be redirected to this URL. Validating license... Verification Code: Verify email Verify your email View View Dashboard View settings page View vulnerabilities Visit Dashboard Visit the plugins overview or %srenew your license%s. Vulnerabilities Vulnerabilities Overview Vulnerabilities detected Vulnerability Alert: %s Vulnerability Measures Vulnerability detection Vulnerability scan Vulnerability scanning is enabled. Vulnerability: %s Warning Warning: There has been %1$s failed login attempt on your account without providing a valid two-factor token. The last failed login occurred %2$s ago. If this wasn't you, you should reset your password. Warning: %1$s failed login attempts have been detected on your account without providing a valid two-factor token. The last failed login occurred %2$s ago. If this wasn't you, you should reset your password. Warnings We detected suspected bots triggering large numbers of 404 errors on your site. We have detected administrator roles where the login and display names are the same. We have detected the %s plugin on your website. We have not detected any known hosting limitations. We have tried to make our Wizard as simple and fast as possible. Although these questions are all necessary, if there’s any way you think we can improve the plugin, please let us %sknow%s! We think you will like this Welcome to Really Simple Security Why Premium Support? Why did I receive this email? Widget area Widget with mixed content Will run a frequent update process on vulnerable components. WordPress 301 redirect enabled. We recommend to enable a 301 .htaccess redirect. Write these down! Once you navigate away from this page, you will not be able to view these codes again. XML-RPC XML-RPC is a mechanism originally implemented into WordPress to publish content without the need to actually login to the backend. It is also used to login to WordPress from devices other than desktop, or the regular wp-admin interface. XML-RPC with Learning Mode Yes (don't set header) You already have a valid SSL certificate. You already have free SSL on your hosting environment. You can add any non-existing username to this table, to instantly block IP addresses that try common usernames like "admin". You can choose to automate the most common actions for a vulnerability. Each action is set to a minimum risk level, similar to the notifications. Please read the instructions to learn more about the process. You can easily block countries, or entire continents. You can act on the event log below and see which countries are suspicious, or exclude all countries but your own. You can find your Plesk username and password in %s You can find your api key %shere%s (make sure you're logged in with your main account). You can follow these %sinstructions%s. You can indefinitely block known abusive IP addresses, to completely prevent them from trying to login. You can prevent IP addresses from being temporarily blocked by adding them to this list. This can be convenient if you share an IP address with other site users. Usernames that trigger false logins will still be blocked. You can prevent usernames from being temporarily blocked by adding them to this list. The IP address that triggers false logins will still be blocked. You can protect your account with a second authentication layer. Please choose one of the following methods, or click %s if you don’t want to use Two-Factor Authentication. You can reset the report and generate a new snapshot, for example if you made changes via FTP. You have %s critical vulnerability You have %s critical vulnerabilities You have %s high-risk vulnerability You have %s high-risk vulnerabilities You have %s low-risk vulnerability You have %s low-risk vulnerabilities You have %s medium-risk vulnerability You have %s medium-risk vulnerabilities You have %s open hardening feature. You have %s open hardening features. You have changed your login URL You have enabled a feature on %s. We think it's important to let you know a little bit more about this feature so you can use it without worries. You have logged in successfully. You have set a 301 redirect to SSL. This is important for SEO purposes You may need to login in again, have your credentials prepared. You run a Multisite installation with subdomains, but your site doesn't have a wildcard certificate. You run a Multisite installation with subfolders, which prevents this plugin from fixing your missing server variable in the wp-config.php. You should have the www domain pointed to the same website as the non-www domain. You will have to re-scan the QR code on all devices as the previous codes will stop working. You will receive an email warning if changes are detected. You're using a feature where email is an essential part of the functionality. Please validate that you can send emails on your server. Your 2FA grace period expired. Please contact your site administrator to regain access and to configure 2FA. Your Key and Certificate directories are not properly protected. Your SSL certificate will expire soon. Your certificate is valid until: %s Your certificate will be renewed and installed automatically. Your certificate will expire on %s. Your certificate will expire on %s. You can renew it %shere%s. Your domain meets the requirements for Let's Encrypt. Your hosting environment does not allow automatic SSL installation. Your license is not active for this URL. Your license key expired on %s. Your license key has been disabled. Your license key has reached its activation limit. Your login URL has changed to {login_url} to prevent common bot attacks on standard login URLs. Learn more about this feature, common questions and measures to prevent any issues. Your login confirmation code for %s Your password was compromised and has been reset Your password was reset because of too many failed Two Factor attempts. You will need to <a href="%s">create a new password</a> to regain access. Please check your email for more information. Your server provides shell functionality, which offers additional methods to install SSL. If installing SSL using the default methods is not possible, you can install the shell add on. Your site is set to log errors to a potentially public file Your site uses Divi. This can require some additional steps before getting the secure lock. Your site uses Elementor. This can require some additional steps before getting the secure lock. Your site uses plain permalinks, which causes issues with the REST API. Please use a different permalinks configuration. Your verification code expired, click “Resend Code” to receive a new verification code. Your website's ip address is blocked. Please add your domain's ip address to the security policy in CPanel Your wp-config.php has to be edited, but is not writable. attempts critical day days eg. %s forbidden - number in author name not allowed = %s hCaptcha hCaptcha secret key hCaptcha site key high-risk https://really-simple-plugins.com https://really-simple-ssl.com https://wordpress.org/ low-risk medium-risk no response not set reCaptcha secret key reCaptcha site key reCaptcha v2 recommended site← Go to %s PO-Revision-Date: 2024-09-17 07:31:18+0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Plural-Forms: nplurals=2; plural=n != 1;
X-Generator: GlotPress/4.0.1
Language: en_CA
Project-Id-Version: Plugins - Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) - Stable (latest release)
Please note that you can always save and finish the wizard later, use our %sdocumentation%s for additional information or log a %ssupport ticket%s if you need our assistance. %1$s ‹ %2$s — WordPress %d seconds %d:%02d minutes %d:%02d:%02d hours %s day %s days %s hour %s hours %s is a singleton class and you cannot create a second instance. %s minutes %s month %s months %s unused code remaining. %s unused codes remaining. %s vulnerability has been detected. %s vulnerabilities have been detected. %s week %s: %s vulnerability found %s: %s vulnerabilities found (opens in a new tab) (recommended) (unknown) .htaccess does not exist .htaccess in uploads not writable .htaccess not writable .htaccess redirect. 1 day 1 hour 1 year 2 years 30 minutes 301 .htaccess redirect 301 .htaccess redirect (read instructions first) 301 .htaccess redirect is not enabled. 301 PHP redirect 301 SSL redirect enabled 301 redirect to https set. 404 Blocking 48 hours (default) 6 months 8 hours (recommended) A %s vulnerability is found in %s. A correctly configured Content Security Policy can protect your visitors from the most common web attacks. It all starts with denying and upgrading insecure requests on your website. A debug.log is publicly accessibile and has a standard location. This will change the location to a randomly named folder in /wp-content/ A definition of a site url or home url was detected in your wp-config.php, but the file is not writable. A firewall rule was enabled, but /the wp-content/ folder is not writable. A firewall rule was enabled, but the firewall does not seem to get loaded correctly. A firewall rule was enabled, but the wp-config.php is not writable. A lockout will occur if an IP address exceeds the threshold within the given timeframe. Select ‘%s’ if you want to disable 404 blocking. A networkwide SSL activation process has been started, but has not been completed. Please go to the SSL settings page to complete the process. A verification code has been sent to the email address associated with your account to verify functionality. A verification code has been sent to the email address associated with your account. API login for user disabled. Able to create destination folder About Cross Origin Policies About Essential Security Headers About HTTP Strict Transport Security About Hardening About Limit Login Attempts About Vulnerabilities About XML-RPC About notifications About the Content Security Policy About the Mixed Content Scan About the Permission Policy According to our information, your hosting provider does not allow any kind of SSL installation, other then their own paid certificate. For an alternative hosting provider with SSL, see this %sarticle%s. According to our information, your hosting provider supplies your account with an SSL certificate by default. Please contact your %shosting support%s if this is not the case. Action Activate Activate SSL Activate SSL per site or install a wildcard certificate to fix this. Activate network-wide to fix this. Activate your license key Activating plugin... Active Add additional domains which can embed your website, if needed. Comma separated. Advanced Advanced Hardening Advanced WordPress Hardening Advanced hardening features complement the basic hardening functions by protecting your site against advanced threats and attacks. Advanced hardening features to protect your site against sophisticated threats and attacks. After completing the installation, you can continue to the next step to complete your configuration. After enabling this feature, you can submit your site to %shstspreload.org%s After this number of failed login attempts the user and IP address will be temporarily blocked. Alias domain check is not relevant for a subdomain All All recommended hardening features enabled. Allow Allow grace period Allow only necessary third party resources to be loaded on your website, thus preventing common attacks. Use our unique learning mode to automatically configure your Content Security Policy. Allow visitors that might accidentally exceed the threshold to unblock themselves using a Captcha. Allow your domain to be embedded Allowed Allows you to enter a custom login URL. An SSL certificate has been detected An error occurred, please try again. An error occurred: An option that requires the .htaccess file in the uploads directory is enabled, but the file is not writable. An option that requires the .htaccess file is enabled, but the file does not exist. An option that requires the .htaccess file is enabled, but the file is not writable. As a security precaution, the username ‘admin’ has been changed on %s. From now on, you can login with '%s' or an email address. As your order will be regenerated, you'll need to update your DNS text records. Attempting to install certificate using AutoSSL... Attempting to install certificate... Attempting to set DNS txt record... Authenticate Authentication Code: Authentication code is incorrect. Authentication codes will be sent to %s. Authentication provider not specified. Authenticator App Authenticator App (TOTP) Authenticator app Authorisation not completed yet. Automated Measures Automatic certificate detection is not possible on your server. Automatic renewal of your certificate was not possible. The SSL certificate should be %srenewed%s manually. Backup Codes Basic Because the $_SERVER["HTTPS"] variable is not set, your website may experience redirect loops. Below you will find the instructions for different hosting environments and configurations. If you start the process with the necessary instructions and credentials, the next steps will be done in no time. Below you will find your login code for %1$s. It's valid for 15 minutes. %2$s Block the username 'admin' Block user registrations when login and display name are the same Blocked Blocked IP addresses will be automatically unblocked after the above-configured interval. In the table below you can instantly unblock IP addresses. Blocked usernames will be automatically unblocked after the above-configured interval. In the table below you can instantly unblock usernames. Blocklists Browser features are plentiful, but most are not needed on your website. Bundle not available yet... By default, WordPress shows if a username or email address exists when a login fails. This will change it to generic feedback. cPanel host cPanel password cPanel recognised. Possibly the certificate can be installed automatically. cPanel username Cancel Captcha Captcha has not yet been verified, you need to complete the process of a Captcha to verify it's availability. Captcha provider Certificate already generated. It was renewed if required. Certificate not created. Challenge directory not writable. Change debug.log file location Change passwords every Changed debug.log location to: Changing redirect methods should be done with caution. Please make sure you have read our instructions beforehand at the right-hand side. Cheatin’ uh? Check again Check manually Check your %slicence%s. Checking SSL certificate... Checking alias domain... Checking certs directory... Checking challenge directory reachable over http... Checking challenge directory... Checking for subdomain setup... Checking for website configuration... Checking host... Checking if cURL is available... Checking if Terms & Conditions are accepted... Checking if plugin folder exists... Checking key directory... Checking permissions... Checking server software... Choose new username to replace 'admin' Choose the max-age for HSTS Choose your provider Click the button below to confirm your email address, or copy the following URL: %s CloudWays API key CloudWays user email Codes only available for 5 minutes Complete email validation and enable notifications to make sure you will receive security warnings. Completed Complianz - Consent Management as it should be Component Components will be quarantined if the update process fails. Compromised password for %s has been reset Compromised password reset Configuration Configure your Cookie Notice, Consent Management and Cookie Policy with our Wizard and Cookie Scan. Supports GDPR, DSGVO, TTDSG, LGPD, POPIA, RGPD, CCPA and PIPEDA. Configured for HTTP challenge Consent management as it should be. Content Security Policy Content Security Policy Headers Continent Continents Continue Continue to renew. Control and monitor the use of XML-RPC on your site with learning mode. Control browser features that could allow third parties to misuse data collected by microphone, camera, GEO Location etc, when enabled for your website. Copy setup key Copyright warning! Could not automatically add TXT record. Please proceed manually, following the steps below. Could not copy code execution test file. Could not copy text: Could not create test folder and file. Could not find code execution test file. Could not reach challenge directory over %s. Could not rename folder! Could not retrieve server list Could not test certificate Could not verify TXT record for domain %s Could not verify alias domain. Count Country Crawlers might scan your site looking for possible exploits. One way to detect this is the fact that they trigger more 404 (not found) errors than legitimate visitors would. Below you can set the threshold and lockout duration for 404 blocking. Creating account... Critical Critical (default) Cross Origin Embedder Policy Cross Origin Opener Policy Cross Origin Resource Policy Custom login URL Customize login attempts, intervals, and temporary lockouts according to your preferences to regulate the level of security on your website during authentication. No additional settings required DNS records were not verified yet. Please complete the previous step. DNS token not retrieved. DNS verification Dashboard Dashboard - Test Notification Date Debug.log Delete all data on plugin deletion Depending on your hosting provider, %1$smanual installation%2$s may be required. Description Destination folder already exists Details Detected File Changes Detected status of your setup. Direct Admin URL DirectAdmin host DirectAdmin password DirectAdmin recognised. Possibly the certificate can be installed automatically. DirectAdmin username Directive Directories Disable Disable "anyone can register" Disable HTTP methods Disable OCSP stapling Disable XML-RPC Disable application passwords Disable directory browsing Disable the built-in file editors Disable user enumeration Disabled Dismiss Dismiss all notifications Do you want to store these credentials for renewal purposes? Domain Don't ask again Don't show again Don't use Two-Factor Authentication Download Download Backup Codes Download Codes Due to a change in challenge type, the order had to be reset. Please start at the previous step. During the grace period users can configure their Two-Factor method. When the grace period ends, users for which 2FA is enforced won’t be able to login unless 2FA is correctly configured. The grace period is also applied to new users. E-mail login Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate generation. Elevate your security with our Premium Support! Our expert team ensures simple, hassle-free assistance whenever you need it. Email Email Verification Email Verification sends a verification code to the user’s email address. This method provides protection against leaked or weak passwords, though it is less secure than other 2FA methods. If a user’s email inbox is compromised, one could still get access to the user account. It is not recommended to allow Email Verification for administrators. Email address Email address not valid Email could not be sent. Email could not be sent. No message or subject set. Email notification error Email notifications are only sent for important updates, security notices or when certain features are enabled. Email sent! Please check your mail Email validation Email validation completed Email verification Email verification error Enable Enable .htaccess only if you know how to regain access in case of issues. Enable 301 .htaccess redirect Enable 301 redirect Enable Custom login URL Enable Firewall Enable Limit Login Attempts Enable Permissions Policy Enable Two-Factor Authentication Enable a .htaccess redirect or PHP redirect in the settings to create a 301 redirect. Enable compromised password check Enable for: Enable open source blocklist API etc. Enable the Vulnerability scan to detect possible vulnerabilities. Enable vulnerability scanning Enabled Enabling auto renew... Enforce for: Enforce frequent password change Enforce secure password policies for your users by requiring strong passwords, and expiring passwords after a period of your choosing. Enforce strong passwords Enforcing 2FA ensures that all users with the selected roles must login using Two-Factor Authentication. It is strongly recommended to at least enforce 2FA for Administrators. Enter a backup verification code. Enter a custom login URL. This allows you to log in via this custom URL instead of /wp-admin or /wp-login.php Error code %s Error enabling auto renew for Let's Encrypt Error occurred when retrieving the webpage. Errors were reported during installation. Essential Security Headers Essential WordPress hardening Essential security Essential security headers installed Event Event Log Event Logs Every three hours Example: If you want to change your login page from /wp-admin/ to /control/ answer: control Experience all powerful features of Really Simple Security Pro using this %slimited time discount%s: %s Failed retrieving access token Failed retrieving account. Failed to activate plugin Failed to create a login nonce. Failed to gather package information Failed to install plugin Feature Feedback in plugin overview File Change Detection File Change Detection generates a snapshot of every .php and .js file. On a daily basis, each file is then compared to this snapshot. File missing. Please retry the previous steps. File permissions check Files not created yet... Firewall Firewall Rules For more information, please read this %sarticle%s Force update From now on, the debug.log won’t be publicly accessible whenever wp-debugging is enabled. The debug log will be stored in a randomly named folder in /wp-content/. This prevents possible leakage of sensitive debugging information. GDPR/CCPA Privacy Suite General General Settings Generate Verification Codes Generating SSL certificate... Generation Get Login Protection with Really Simple Security Pro Get detailed insights into visitors' behaviour with Burst Statistics, the privacy-friendly analytics dashboard from Really Simple Plugins. Get notified of important changes, updates and settings. Recommended when using security features. Go to activation Go to installation HSTS forces browsers always to load a website via HTTPS. It prevents unnecessary redirects and prevents manipulation of data originating from communication with your website. HTTP Strict Transport Security Hardening Hardening features limit the possibility of potential weaknesses and vulnerabilities which can be misused. Hello %1$s, an unusually high number of failed login attempts have been detected on your account at %2$s.
These attempts successfully entered your password, and were only blocked because they failed to enter your second authentication factor. Despite not being able to access your account, this behavior indicates that the attackers have compromised your password. The most common reasons for this are that your password was easy to guess, or was reused on another site which has been compromised.
To protect your account, your password has been reset, and you will need to create a new one. For advice on setting a strong password, please read %3$s
To pick a new password, please visit %4$s
This is an automated notification. If you would like to speak to a site administrator, please contact them directly. Hello, this is a notice from your website to inform you that an unusually high number of failed login attempts have been detected on the %1$s account (ID %2$d). Those attempts successfully entered the user's password, and were only blocked because they entered invalid second authentication factors. To protect their account, the password has automatically been reset, and they have been notified that they will need to create a new one. If you do not wish to receive these notifications, you can disable them with the `two_factor_notify_admin_user_password_reset` filter. See %3$s for more information. Thank you Here you can configure vulnerability detection, notifications and measures. To learn more about the features displayed, please use the instructions linked in the top-right corner. Here you can see which users have configured Two-Factor Authentication. The reset button will trigger the 2FA onboarding for the selected user(s) again and allow the configured grace period. Here you control the users that are automatically, and temporarily blocked. You can also add or remove users manually. We recommend blocking ‘admin’ as username as a start. Hi Hide the remember me checkbox Hide your WordPress version High-risk High-risk (default) Hosting Hosting provider I agree to the Terms & Conditions from Let's Encrypt. I don't know, or not listed, proceed with installation I have read and understood the risks to intervene with these measures. IP Address IP Addresses IP Addresses can be allowed, blocked or will show up when your settings add them to a temporary blocklist. If you want to add your IP to the allowlist, please read the article provided at the right-hand side for instructions. IP Blocklist IP address overview If the number of failed login attempts is exceeded within this timeframe, the IP address and user will be blocked. If the username 'admin' currently exists, you can rename it here. Please note that you can no longer use this username, and should use the new username or an email address If there's a vulnerability, you will also get feedback on the themes and plugin overview. If this is not the case, don't add this alias to your certificate. If this option is set to true, the mixed content fixer will fire on the init hook instead of the template_redirect hook. Only use this option when you experience problems with the mixed content fixer. If unexpected file changes have occurred, this could be an indication that your site is compromised. If you are the owner of this account, please check your email for instructions on regaining access. If you entered your DNS records before, they need to be changed. If you recognize the detected changes, you can add the files to the exclude list, or ignore them just once. If your site is only intended for users to login from specific geographical regions, you can entirely prevent logins from certain continents or countries. Implement Two-Factor Authentication or Passkey login. Import and insert file Improve security - Upgrade Improve security by requiring strong passwords and forced periodic password changes Improve the default WordPress password strength check. You can also enforce frequent password changes for user roles. Include alias Include preload Include subdomains Install Install %sManually%s. Install Authentication app: Install SSL certificate Installation Installation failed. Installation finished Installed Installing Installing SSL certificate using PLESK API... Installing SSL certificate... Installing plugin... Instantly configure these essential features. Instructions Interval Invalid Two Factor Authentication code. Invalid Two Factor Authentication secret key. Invalid licence. Invalid login details. Invalid provider Invalid two-factor authentication provider. Invalid verification code. It is not possible to install Let's Encrypt on a localhost environment. It is not possible to install Let's Encrypt on a subfolder configuration. It is not possible to install Let's Encrypt on a subsite. Please go to the main site of your website. Keep your site secure by monitoring unexpected file changes. Key copied Lax - 10 errors in 2 seconds Learn more Learn more about our features! Leave a review Let's Encrypt Let's Encrypt. Letʼs Encrypt is a free, automated and open certificate authority brought to you by the nonprofit Internet Security Research Group (ISRG). Leveraging your SSL certificate with HSTS is a staple for every website. Force your website over SSL, mitigating risks of malicious counterfeit websites in your name. Licence invalid Licence valid Limit Attempts Limit Login Attempts Limit Login Attempts protects your site from login attempts by unauthorised users. When you enable Limit Login Attempts, all login attempts are logged and repeated attempts to login with invalid credentials will be blocked automatically. Limit logged in session duration Location Locked-out Lockout duration Log In Login Protection Login attempts Login credentials incorrect Login credentials incorrect. Please check your log-in credentials for cPanel. Login status Logs Low-risk Low-risk Low-risk (default) Maintain peace of mind with our simple, but effective automated measures when vulnerabilities are discovered. When needed Really Simple Security will force update or quarantaine vulnerable components, on your terms! Many vulnerabilities are exploited by injecting a user with administrator capabilities outside of the native WordPress creation process. Under advanced hardening you can prevent this from happening. Maybe later Measures Medium-risk Method Missing licence. Mixed Content Fixer Mixed Content Scan Mixed content Mixed content fixer Mixed content fixer - back end Mixed content fixer - init hook Mixed content fixer not enabled. Enable the option to fix mixed content on your site. Mixed content in %s Mixed content in CSS/JS file from other domain Mixed content in PHP file in %s Mixed content in post: %s Mixed content in the postmeta table Mixed content scan More info Multiple %s vulnerabilities have been found. No 301 redirect is set. Enable the WordPress 301 redirect in the settings to get a 301 permanent redirect. No 301 redirect to SSL enabled. No SSL certificate has been detected. No SSL detected No SSL detected. Use the retry button to check again. No known vulnerabilities detected No recommended redirect rules detected. No redirect No subdomain setup detected. No valid list of domains. None Normal - 10 errors in 5 seconds Not recognised server. Not sure if you're using XML-RPC, or want to restrict unauthorised use of XML-RPC? With learning mode you can see exactly which sources use XML-RPC, and you can revoke where necessary. Note Notification by %s Notifications Notifications by email OCSP not supported, the certificate will be generated without OCSP. OCSP stapling is configured as enabled by default. You can disable this option if this is not supported by your hosting provider. Off On Apache you can use a .htaccess redirect, which is usually faster, but may cause issues on some configurations. Read the instructions in the sidebar first. Once every 5 minutes Once every day Once every week One click SSL optimisation One day (for testing only) One of the most powerful features, and therefore the most complex are the Cross-Origin headers that can isolate your website so any data leaks are minimised. One year Only enable this if you experience mixed content in the admin environment of your WordPress website. Open Order ID mismatch, regenerate order. Order successfully created. Order successfully retrieved. Package information retrieved Password Reset Password Security Password security Passwords Permanent Permanent block Permission denied. Permissions Policy Please %sconsider upgrading to Pro%s to enjoy all simple and performant security features. Please activate it manually on your hosting dashboard. Please activate it on your dashboard %smanually%s Please add the following lines to your .htaccess, or set it to writable: Please adjust the CAA records via your DNS provider to allow Let’s Encrypt SSL certificates Please change your email address %shere%s and try again. Please check if the advanced-headers.php file is included in the wp-config.php, and exists in the wp-content folder. Please check if the non www version of your site also points to this website. Please check if the www version of your site also points to this website. Please check if your REST API is loading correctly. Your site currently is using the slower Ajax fallback method to load the settings. Please check the vulnerabilities overview for more information and take appropriate action. Please complete %smanually%s Please complete manually in your hosting dashboard. Please complete the following step(s) first: %s Please configure your %sCaptcha settings%s before enabling this setting Please create a folder 'rsssl' in the uploads directory, with 644 permissions. Please double check your DNS txt record. Please enter the code generated by your authenticator app. Please make sure to configure a method, access to your account will be denied if no method is configured today. Please make sure to configure a method, access to your account will be denied if no method is configured within the next %s days. Please refresh the SSL status if a certificate has been installed recently. Please scan the QR code or manually enter the key, then enter an authentication code from your app in order to complete setup. Please set the wp-config.php to writable until the rule has been written. Please set the wp-content folder to writable: Please start at the previous step. Please take appropriate action. Please verify your email Please wait %s before trying again, as this is the expiration of the DNS record currently. Plesk admin URL Plesk host Plesk password Plesk recognised. Possibly the certificate can be installed automatically. Plesk username Plesk username and password Plugin activated Plugin installed Powered by WordPress Preferred Method Premium Support Prevent clickjacking and other malicious attacks by restricting sources that are permitted to embed content from your website. Prevent code execution in the public 'Uploads' folder Prevent login feedback Prevent session hijacking Prevent usage of passwords that have been included in a databreach. This securely verifies part of the hashed password via the Have I Been Pwned API. Privacy-friendly analytics tool. Protect your login form with Limit Login Attempts. Protect your site against brute force login attacks by limiting the number of login attempts. Enabling this feature will temporary lock-out a username and the IP address that tries to login, after the set number of false logins. Protect your site with a performant Firewall. Protect your website against brute-force attacks with a captcha. Choose between Google reCAPTCHA or hCaptcha. Protecting your website visitors from malicious attacks and data breaches should be your #1 priority, start with the essentials with Really Simple Security Backup Verification Codes (Single Use) Email Time Based One-Time Password (TOTP) Quarantine Quarantined Re-check Read about our journey towards Really Simple Security Read more Really Simple Plugins is also the author of the below privacy-focused plugins, including consent management, legal documents and analytics! Really Simple SSL is now %1$sReally Simple Security!%2$s Really Simple Security Pro Really Simple Security allows you to limit the default logged in session duration. By default, WordPress will keep users logged in for 48 hours, or even 14 days when clicking the ‘remember me’ checkbox. An attacker could possibly steal the logged in cookie and gain access to a user’s account. Limiting the logged in duration to 8 hours will greatly reduce the risk of session hijacking. Really Simple Security dashboard Really Simple Security will send email notifications and security warnings from your server. We will send a test email to confirm that email is correctly configured on your site. Look for the confirmation button in the email. Receive a code by email Recommended by Really Simple Plugins Recommended security headers enabled. Recovery Mode — %s Redirect method Redirection Redirects your site to https with a SEO friendly 301 redirect if it is requested over http. Regions Rename admin user enabled: Please choose a new username of at least 3 characters, which is not in use yet. Rename and randomise your database prefix Renew certificate Renew installation Resend Code Reset Key Restrict access from specific countries or continents. You can also allow only specific countries. Restrict creation of administrator roles Retrieving Cloudways server data... Retrieving DNS verification token... Retrieving package information... Retry Risk Rules SSL Status Test SSL activation in progress SSL certificate should be generated and installed. SSL certificate will expire on %s. SSL is enabled networkwide. SSL is enabled on your site. SSL is not enabled on your network SSL is not enabled yet. SSL is not enabled. SSL is not yet enabled on this site. SSL is now activated. Follow the three steps in this article to check if your website is secure. SSL successfully installed on %s Save and continue Scan results Searching for link to SSL installation page on your server... Secret key is configured and registered. It is not possible to view it again for security reasons. Security Security Headers Security Headers Test Security configuration completed! Security configuration not completed yet. You still have %s task open. You still have %s tasks open. Security through obscurity. Your site is no longer using the default wp_ prefix for database tables. The process has been designed to only complete and replace the tables after all wp_ tables are successfully renamed. In the unlikely event that this does lead to database issues on your site, please navigate to our troubleshooting article. See which recommended security headers are not present on your website. Selected provider Self (Default) Self-hosted and privacy-friendly analytics tool. Send Serve encrypted and authenticated responses Set permissions to 644 to enable SSL generation. Set your wp-config.php to writable and reload this page. Settings Settings update: .htaccess redirect Settings update: Database prefix changed Settings update: Debug.log file relocated Settings update: Username 'admin' renamed Site wide - Test Notification Site-wide, admin notification Skip Skip (%1$d %2$s remaining) Skip (Only today remaining) Source Start login protection by adding an additional layer during authentication. This will leave authentication less dependent on just a single password. Want to force strong passwords? Check out Password Security. Status Stop editing the .htaccess file Store for renewal purposes. If not stored, renewal may need to be done manually. Strict - 10 errors in 10 seconds Strong Password policy Submit Successfully added TXT record. Successfully generated certificate. Successfully installed Let's Encrypt Successfully installed SSL Successfully retrieved account Successfully retrieved server ID and app ID Successfully verified DNS records Successfully verified alias domain. Support System status TOTP requires users to authenticate using a third-party app such as Google Authenticator. Temporary Temporary block Terms and conditions Terms & Conditions are accepted. Terms and Conditions Test not found. Test notification email error Test notifications Test notifications can be used to test email delivery and shows how vulnerabilities will be reported on your WordPress installation. The 'force-deactivate.php' file has to be renamed to .txt. Otherwise your SSL can be deactivated by anyone on the internet. The .htaccess redirect has been enabled on your site. If the server configuration is non-standard, this might cause issues. Please check if all pages on your site are functioning properly. The .htaccess redirect rules selected by this plugin failed in the test. Set manually or dismiss to leave on PHP redirect. The 301 .htaccess redirect is the fastest and most reliable redirect option. The 301 redirect with .htaccess to HTTPS is now enabled. The DISALLOW_FILE_EDIT constant is defined and set to false. You can remove it from your wp-config.php. The DNS response for %s was %s, while it should be %s. The Essentials The Event Log shows all relevant events related to limit login attempts. You can filter the log using the dropdown on the top-right to only show warnings. The Event Log shows all relevant events related to the Firewall and IP lockouts. You can filter the log using the dropdown on the top-right to only show warnings. The Hosting Panel software was not recognised. Depending on your hosting provider, the generated certificate may need to be installed manually. The IP address will see a locked out screen for the selected duration. The PHP function cURL has successfully been detected. The PHP function cURL is not available on your server, which is required. Please contact your hosting provider. The SSL certificate has been renewed, and requires manual %sinstallation%s in your hosting dashboard. The Terms & Conditions were not accepted. Please accept in the general settings. The Two-Factor Authentication setup for TOTP failed. Please try again. The Two-Factor Authentication setup for email failed. Please try again. The URL you use to access your DirectAdmin dashboard. Ends on :2222. The URL you use to access your Plesk dashboard. Ends on :8443. The URL you use to access your cPanel dashboard. Ends on :2083. The authentication code is not valid. The automatic installation of your certificate has failed. Please check your credentials, and retry the %sinstallation%s. The certificate installation was rate limited. Please try again later. The certs directory is not created yet. The certs directory was successfully created. The challenge directory is not created yet. The challenge directory was successfully created. The code to block code execution in the uploads folder cannot be added automatically on NGINX. Add the following code to your nginx.conf file: The content security policy has many options, so we always recommend starting in ‘learning mode’ to see what files and scripts are loaded. The daily scan will report any detected file changes in the table below. The email address was not set. Please set the email address The following directories do not have the necessary writing permissions. The following information is attached when you send this form: licence key, scan results, your domain, .htaccess file, debug log and a list of active plugins. The key directory is not created yet. The key directory was successfully created. The key is not valid. The lightweight Firewall can be used to lockout malicious traffic from your site. You can configure generic rules below, or block specific IP addresses by adding them to the Blocklist. The mixed content fixer could not be detected due to a cURL error: %s. cURL errors are often caused by an outdated version of PHP or cURL and don't affect the front-end of your site. Contact your hosting provider for a fix. The mixed content fixer is active, but was not detected on the frontpage. The non-www version of your site does not point to this website. This is recommended, as it will allow you to add it to the certificate as well. The onboarding wizard will help to configure essential security features in 1 minute! Select your hosting provider to start. The order is invalid, possibly due to too many failed authorisation attempts. Please start at the previous step. The preferred method is not set. The required directories have the necessary writing permissions. The selected provider is not valid. The settings below determine how strict your site will be protected. You can leave these settings on their default values, unless you experience issues. The snapshots will be updated after WordPress, plugins or themes are activated or updated. The system is not ready for the DNS verification yet. Please run the wizard again. The system is not ready for the installation yet. Please run the wizard again. The used domain for your email address is not allowed. The user ID is not valid. The user and IP address will be temporarily unable to login for the specified duration. You can block IP addresses indefinitely via the IP addresses block. The user object is not valid. The value, WP_DEBUG_LOG, has been added to this website’s configuration file. This means any errors on the site will be written to a file which is potentially available to all users. The wp-config.php file is not writable, and needs to be edited. Please set this file to writable. The www version of your site does not point to this website. This is recommended, as it will allow you to add it to the certificate as well. There are existing keys, the order had to be cleared first. There have been too many failed two-factor authentication attempts, which often indicates that the password has been compromised. The password has been reset in order to protect the account. These notifications are set to the minimum risk level that triggers a notification. For example, the default site-wide notification triggers on high-risk and critical vulnerabilities. These security headers are the fundamental security measures to protect your website visitors while visiting your website. They might be misused if you don’t actively tell the browser to disable these features. This adds extra requirements for strong passwords for new users and updated passwords. This appears to be an invalid licence key for this plugin. This email address is used to create a Let's Encrypt account. This is also where you will receive renewal notifications. This email is confirmation that any security notices are likely to reach your inbox. This email was sent to This feature allows you to block visitors from your website based on country This feature depends on multiple standard background processes. If a process fails or is unavailable on your system, detection might not work. We run frequent tests for this purpose. We will notify you accordingly if there are any issues. This is a multisite configuration with subdomains. You should generate a wildcard certificate on the root domain. This is a security feature implemented by web browsers to control how web pages from different origins can interact with each other. This is the vulnerability overview. Here you will find current known vulnerabilities on your system. You can find more information and helpful, actionable insights for every vulnerability under details. This leads to issues when activating SSL networkwide since subdomains will be forced over SSL as well while they don't have a valid certificate. This list shows all individually blocked IP addresses. On top the top-right you can filter between permanent blocks and temporary blocks. By default, blocks are only temporary, as attackers and bots will frequently alter between IP addresses. However, you can manually configure permanent blocks. This option is handled by the Content Security Policy/frame-ancestors setting. This setting will block attempts to assign administrator roles outside the native user creation process by WordPress. This might include other plugins that create, edit or assign roles to users. If you need to create an administrator in a third-party plugin, temporarily disable this setting while you make the changes. This site requires you to secure your account with a second authentication method. This will include both the www. and non-www. version of your domain. This will limit or fully disable HTTP requests that are not needed, but could be used with malicious intent. This will permanently change your database prefixes and you can NOT rollback this feature. Please make sure you have a back-up. This will send emails about vulnerabilities directly from your server. Make sure you can receive emails by the testing a preview below. If this feature is disabled, please enable notifications under general settings. Threshold Time left To ensure all traffic passes through SSL, please enable a 301 redirect. To safely enable SSL on your server configuration, you should add the following line of code to your wp-config.php. Token not generated. Please complete the previous step. Token not received yet. Token successfully retrieved. Click the refresh button if it's not visible yet. Too many invalid verification codes, you can try again in %s. This limit protects your account against automated attacks. Trigger Captcha on lockout Trigger captcha on failed login attempt Trusted Trusted IP addresses Trying to create directory in root of website. Two years (required for preload) Two-Factor Authentication adds an extra layer of security to your account. You can enable it here. Two-Factor Authentication for TOTP failed. No Authentication code provided, please try again. Two-Factor Authentication is mandatory for your account, so you need to make a selection. Two-Factor Backup Codes for %s Two-Factor authentication allows users to login using a second authentication method, other than their e-mail address and password. It is one of the most powerful ways to prevent account theft. Two-Factor: You are out of backup codes and need to <a href="%s">regenerate!</a> Type Unable to connect to cPanel Unable to enable Backup Codes provider for this user. Unable to enable TOTP provider for this user. Unable to save Two Factor Authentication code. Please re-scan the QR code and enter the code provided by your application. Unauthorised administrators Unset X-Powered-By header Update Really Simple SSL Pro: the plugin needs to be updated to the latest version to be compatible. Upgrade Uploads folder not writable. Usage of the title attribute on the login logo is not recommended for accessibility reasons. Use the link text instead. Use an authenticator app on your mobile device to generate a code. Use your authenticator app like Google Authenticator to scan the QR code below, then paste the provided Authentication code. %s User User role User roles for password change Username Username 'admin' has been changed to %s Users Users trying to enter via /wp-admin or /wp-login.php will be redirected to this URL. Validating licence... Verification Code: Verify email Verify your email View View Dashboard View settings page View vulnerabilities Visit Dashboard Visit the plugins overview or %srenew your licence%s. Vulnerabilities Vulnerabilities Overview Vulnerabilities detected Vulnerability Alert: %s Vulnerability Measures Vulnerability detection Vulnerability scan Vulnerability scanning is enabled. Vulnerability: %s Warning Warning: There has been %1$s failed login attempt on your account without providing a valid two-factor token. The last failed login occurred %2$s ago. If this wasn't you, you should reset your password. Warning: %1$s failed login attempts have been detected on your account without providing a valid two-factor token. The last failed login occurred %2$s ago. If this wasn't you, you should reset your password. Warnings We detected suspected bots triggering large numbers of 404 errors on your site. We have detected administrator roles where the login and display names are the same. We have detected the %s plugin on your website. We have not detected any known hosting limitations. We have tried to make our Wizard as simple and fast as possible. Although these questions are all necessary, if there’s any way you think we can improve the plugin, please let us %sknow%s! We think you will like this Welcome to Really Simple Security Why Premium Support? Why did I receive this email? Widget area Widget with mixed content Will run a frequent update process on vulnerable components. WordPress 301 redirect enabled. We recommend to enable a 301 .htaccess redirect. Write these down! Once you navigate away from this page, you will not be able to view these codes again. XML-RPC XML-RPC is a mechanism originally implemented into WordPress to publish content without the need to actually login to the backend. It is also used to login to WordPress from devices other than desktop, or the regular wp-admin interface. XML-RPC with Learning Mode Yes (don't set header) You already have a valid SSL certificate. You already have free SSL on your hosting environment. You can add any non-existing username to this table, to instantly block IP addresses that try common usernames like "admin". You can choose to automate the most common actions for a vulnerability. Each action is set to a minimum risk level, similar to the notifications. Please read the instructions to learn more about the process. You can easily block countries, or entire continents. You can act on the event log below and see which countries are suspicious, or exclude all countries but your own. You can find your Plesk username and password in %s You can find your api key %shere%s (make sure you're logged in with your main account). You can follow these %sinstructions%s. You can indefinitely block known abusive IP addresses, to completely prevent them from trying to login. You can prevent IP addresses from being temporarily blocked by adding them to this list. This can be convenient if you share an IP address with other site users. Usernames that trigger false logins will still be blocked. You can prevent usernames from being temporarily blocked by adding them to this list. The IP address that triggers false logins will still be blocked. You can protect your account with a second authentication layer. Please choose one of the following methods, or click %s if you don’t want to use Two-Factor Authentication. You can reset the report and generate a new snapshot, for example if you made changes via FTP. You have %s critical vulnerability You have %s critical vulnerabilities You have %s high-risk vulnerability You have %s high-risk vulnerabilities You have %s low-risk vulnerability You have %s low-risk vulnerabilities You have %s medium-risk vulnerability You have %s medium-risk vulnerabilities You have %s open hardening feature. You have %s open hardening features. You have changed your login URL You have enabled a feature on %s. We think it's important to let you know a little bit more about this feature so you can use it without worries. You have logged in successfully. You have set a 301 redirect to SSL. This is important for SEO purposes. You may need to login in again, have your credentials prepared. You run a Multisite installation with subdomains, but your site doesn't have a wildcard certificate. You run a multisite installation with subfolders, which prevents this plugin from fixing your missing server variable in the wp-config.php. You should have the www domain pointed to the same website as the non-www domain. You will have to re-scan the QR code on all devices as the previous codes will stop working. You will receive an email warning if changes are detected. You're using a feature where email is an essential part of the functionality. Please validate that you can send emails on your server. Your 2FA grace period expired. Please contact your site administrator to regain access and to configure 2FA. Your Key and Certificate directories are not properly protected. Your SSL certificate will expire soon. Your certificate is valid until: %s Your certificate will be renewed and installed automatically. Your certificate will expire on %s. Your certificate will expire on %s. You can renew it %shere%s. Your domain meets the requirements for Let's Encrypt. Your hosting environment does not allow automatic SSL installation. Your licence is not active for this URL. Your licence key expired on %s. Your licence key has been disabled. Your licence key has reached its activation limit. Your login URL has changed to {login_url} to prevent common bot attacks on standard login URLs. Learn more about this feature, common questions and measures to prevent any issues. Your login confirmation code for %s Your password was compromised and has been reset Your password was reset because of too many failed Two Factor attempts. You will need to <a href="%s">create a new password</a> to regain access. Please check your email for more information. Your server provides shell functionality, which offers additional methods to install SSL. If installing SSL using the default methods is not possible, you can install the shell add-on. Your site is set to log errors to a potentially public file Your site uses Divi. This can require some additional steps before getting the secure lock. Your site uses Elementor. This can require some additional steps before getting the secure lock. Your site uses plain permalinks, which causes issues with the REST API. Please use a different permalinks configuration. Your verification code expired, click “Resend Code” to receive a new verification code. Your website's IP address is blocked. Please add your domain's IP address to the security policy in cPanel Your wp-config.php has to be edited, but is not writable. attempts critical day days eg. %s forbidden - number in author name not allowed = %s hCaptcha hCaptcha secret key hCaptcha site key high-risk https://really-simple-plugins.com https://really-simple-ssl.com https://wordpress.org/ low-risk medium-risk no response not set reCaptcha secret key reCaptcha site key reCaptcha v2 recommended ← Go to %s