wordpress plugin · security

WP Fortress.Lock WordPress down — without the bloat.

Six areas of protection — SSL, SMTP, login & wp-admin hiding, CAPTCHA, hardening and a firewall — in one lightweight plugin. Every feature is off by default and only loads when you switch it on, so nothing changes your site until you decide it should.

Get WP Fortress Pro →See what’s inside

fortress:~/security

❯ fortress enable ssl

✓ https forced · hsts

❯ fortress hide-login –admin

✓ wp-login & wp-admin hidden

❯ fortress enable firewall

✓ rate-limit · lockout · auto-ban

❯

what it does

Six layers, all optional

Switch on only the protection you need. Each module loads on its own — nothing runs until you turn it on.

◉

SSL / HTTPS

Force HTTPS site-wide, with optional HSTS and a set of static security headers.

✉

SMTP

Reliable email through your own mail server, using WordPress’s built-in mailer — no external library.

◎

Login & Admin

Hide wp-login behind a custom slug, move wp-admin so outsiders hit a 404, and skin the login page in your own brand — with several recovery paths.

▣

CAPTCHA

A bot challenge on the login, registration and lost-password forms — Cloudflare Turnstile, or self-hosted ALTCHA and Cap with no third party.

■

Hardening

Independent toggles: disable XML-RPC, block user enumeration, honeypot, strong passwords, admin-login alerts and more.

◼

Firewall

Block IPs, usernames and user-agents, rate-limit requests, lock out failed logins and auto-ban repeat offenders — with an early mu-plugin loader.

built light

Protection that stays out of the way

Security you notice in the settings, not in your load times.

▲

Loaded only when on

Each module is created only when its toggle is enabled — anything you have not switched on never runs.

◇

Transients, not tables

Challenges, blocks, rate counters and lockouts live in transients, so there are no heavy extra database tables.

➞

Firewall exits early

Blocks run at the earliest point available and return a plain 403 — before the theme or templates ever load.

free & pro

Free forever. Pro when you need more.

The essentials are free for good. A Kernel Labs Pro licence unlocks the heavier protection, verified through CoreBox.

Freefree forever

Force HTTPS
Full SMTP delivery
Hide login URL, rename wp-admin & custom login skin
Cloudflare Turnstile CAPTCHA
Core hardening (XML-RPC off, enumeration blocked, honeypot, generic errors)

Prowith a licence

HSTS & security headers
Self-hosted CAPTCHA (ALTCHA & Cap)
Advanced hardening (file editor & app passwords off, strong passwords, idle timeout, admin alerts)
Full firewall (IP / username / agent blocking, rate limiting, lockouts, auto-ban)

questions

WP Fortress, answered

The things people check before locking a live site down.

Will it slow my site down?

No — each module only loads when you switch it on, temporary state uses transients rather than extra tables, and the firewall exits before the theme even loads.

Could hiding the login lock me out?

There are several recovery paths — a recovery key in wp-config.php, one-line disable constants, WP-CLI commands, and a safe-mode panic button — so you always have a way back in.

Does the CAPTCHA need an external service?

Cloudflare Turnstile is free and managed, or you can run ALTCHA or Cap self-hosted with no third party at all. If a provider is briefly unreachable the check fails open, so an outage can never lock you out.

What if I lock myself out completely?

A single safe-mode constant pauses the whole plugin while keeping the settings screen usable, and an unblock constant flushes every firewall block and allowlists your IP.

What does the Pro licence need?

A Kernel Labs Pro licence, verified against CoreBox. If it ever lapses, the Pro features simply switch off and your site keeps running on the free set.

Lock it down this afternoon.

Install free, switch on what you need, and add a Pro licence when you want the heavier protection.

Get WP Fortress Pro →