An agent can check whether a specific comment looks like spam and pull the site's antispam performance statistics.
2 read
View abilitiesShield Security abilities, governed through the Bridge
On a licensed Shield Premium site, an agent can read the site's security posture overview, the items flagged for operator attention, a recent-activity summary, and the latest malware and vulnerability scan findings.
- Abilities
- 44 read
- Active installs
- 30K+
- Rating
- 96% (1,038 ratings)
- Version
- 22.2.3
- Requires
- WP 5.7+, PHP 7.4+
- Last updated
- 2026-09-21 9:57am GMT
View Shield Security on WordPress.org
What has to be true first
Shield needs WordPress 7.0 (its own higher internal floor) and an active, licensed Shield Premium subscription carrying the rest_api_level_2 capability, or none of its abilities register. Once registered, each ability re-checks the site's REST posture permission at execution time, which defaults to the manage_options capability unless the shield/rest_api_verify_permission filter changes it.
- WordPress 7.0 or newer, a stricter internal gate the plugin's own MCP compatibility check applies on top of the Abilities API's own WordPress 6.9 floor
- Shield Premium must be active and licensed with the rest_api_level_2 capability, since the ServerRegistrar's availability callback checks this before it will register the category or any of the four abilities at all
The 4 Shield Security abilities
Grouped by what each one can change. Every one starts off until you enable it.
Read 4
- Read
Shield Site Overview
Read the current Shield site overview, including issue summary and configuration coverage.
- Read
Shield Attention Items
Read the current Shield attention items that need operator review.
- Read
Shield Recent Activity
Read the recent Shield activity summary based on the current recent-events policy.
- Read
Shield Scan Findings
Read the latest Shield scan findings, optionally filtered by scan and item state.
How to switch these on
Four steps from two active plugins to a governed connection.
Install Shield Security and Agent Abilities for MCP
Both plugins need to be active on the same WordPress site. Shield Security registers its own abilities; this plugin discovers and governs them.
Open the Other plugins screen
In Agent Abilities for MCP, open the Bridge tab (labeled "Other plugins" in the admin). Abilities from every registered plugin appear there, grouped by the plugin that registered them.
Enable one ability at a time
Every ability from Shield Security starts off. Turn on only the ones you want an agent to reach, or enable the whole set in one click.
Connect as a least-privilege user
Approve the connection as a WordPress account scoped to what you actually want the agent to do. Each call still re-checks that account’s capability before it runs.
Read more in how bridging works or the full documentation.
Frequently asked questions
Does Shield Security work with the Bridge?
Conditionally. Shield registers four read-only abilities through its own AbilityDefinitions class and a shared ServerRegistrar wrapper around wp_register_ability, so the bridge sees them in the core registry, but the ServerRegistrar only runs registration at all when the site's REST posture route reports itself available, and that route is gated on the rest_api_level_2 capability, which the source marks premium-only.
What has to be true for Shield Security's abilities to register?
WordPress 7.0 or newer, a stricter internal gate the plugin's own MCP compatibility check applies on top of the Abilities API's own WordPress 6.9 floor. Shield Premium must be active and licensed with the rest_api_level_2 capability, since the ServerRegistrar's availability callback checks this before it will register the category or any of the four abilities at all.
Does Shield Security need anything special to work with the Bridge?
Shield needs WordPress 7.0 (its own higher internal floor) and an active, licensed Shield Premium subscription carrying the rest_api_level_2 capability, or none of its abilities register. Once registered, each ability re-checks the site's REST posture permission at execution time, which defaults to the manage_options capability unless the shield/rest_api_verify_permission filter changes it.
More Security & privacy plugins
An agent can check exactly where comments are currently disabled across the site or a multisite network, turn comments off or on for specific post types, and delete existing comments.
1 read1 write1 destructive
View abilitiesAn agent can search and read the WordPress activity log: recent events, a single event's detail, one user's activity, failed login attempts, and a statistics summary grouped by users, content, media, plugins, core and notes, all without being able to change anything.
6 read
View abilitiesVerified from Shield Security's own free wordpress.org code on 28 September 2026, not from its marketing claims. Not every ability listed here has been run end to end against a live site. Plugin authors change their code, so a name, a capability, or a condition can be different in a later release. This site is not affiliated with, or endorsed by, Paul or Shield Security. Back to the full directory.
Bridge Shield Security, keep the same control.
Every ability starts off, is scoped to the user you connect, and is written to the same audit log as core. Turn on only what you need.
Off by default. Capability checked on every call.