Hushfort
Menu

WordPress security, one plugin

Your WordPress, behind quiet walls.

Hushfort does the work of ten security plugins in one: it hides the way in, keeps spam and fake signups out, and stays out of your visitors' way.

Get it on WordPress.orgSee what it solves

Free to start. Pro closes every door.

  • No CAPTCHA
  • No telemetry
  • No third-party services
  • Checkout never blocked

10 → 1

Ten plugins' worth of work. One plugin.

  1. Hide LoginMoves your login to a secret path you choose.
  2. Login LimitsLocks out an IP after too many wrong passwords.
  3. Two-FactorA second step with any authenticator app.
  4. Backdoor LockCloses password guessing through xmlrpc.php.
  5. Username ShieldStops WordPress from publishing your usernames.
  6. Surface ScanShows what your site really exposes, with proof.
  7. Anti-SpamStops comment and form spam without a CAPTCHA.
  8. Fake SignupsStops signup floods. Checkout keeps working.
  9. Flood GuardSlows request floods and blocks fake Googlebots.
  10. DeclutterFinds plugins you installed but never use.

10 plugins1 plugin · Hushfort

10 plugins → 1 plugin. Hushfort.

Quiet by design

Hushfort works in the background. Your visitors don't solve puzzles, and you don't babysit settings.

  1. Watch first, then protect

    Spam, signup and load protection each have a Monitor mode (load protection starts in it). It records what they would block, so you can check for mistakes before you switch to Protect.

  2. Every block is written down

    Failed logins, held signups, quarantined messages: each one lands in a filterable history. Nothing is hidden from you.

  3. One switch per layer

    Each layer is a module you turn on separately. Use two of them or all ten.

  4. Works with page caching

    Form tokens are fetched by a tiny script of about 2 KB, so cached pages keep working.

See it before you install it

Real screens from the plugin. This is what you'll see in your WordPress admin.

  1. One look at the whole fort

    Every layer has a status card: green when it's protecting, red when it's off or needs a look. Each card says in plain words what is still open.

    Hushfort dashboard in WordPress admin with a status card for each protection layer

  2. Every block, written down

    The History screen lists failed logins, lockouts and blocked probes with time, IP, username and source. Active blocks sit on top, with an Unblock button.

    Hushfort History screen listing failed login attempts and IP lockouts

  3. What your site really exposes

    Surface Scan checks XML-RPC, the REST user list, author scans and the user sitemap with real requests, and names any username that leaks.

    Hushfort Surface Scan results showing open and closed surfaces

  4. Plugins you forgot about

    Declutter shows how much of every page is code from unused plugins, with the evidence for each one.

    Hushfort Declutter results grouped by status with evidence per plugin

  5. Your way back in, always on screen

    The "If you lose access" card shows your current login URL and the emergency lines, so you can save them while you're still logged in.

    Hushfort 'If you lose access' card with the login URL and emergency wp-config lines

Screenshots from a demo store running Hushfort 1.14.1. Test IP addresses, no real visitors.

The ten layers

Grouped by the thing you're worried about. Each one links to a plain how-to.

Login & access

6

Spam & signups

2

Speed & calm

2

Works with

  • Elementor Pro
  • Contact Form 7
  • WPForms
  • Gravity Forms
  • Fluent Forms
  • Forminator
  • WooCommerce
  • LiteSpeed Cache
  • Cloudflare
  • WP-CLI
See how : integrations

Why Hushfort is different

A few promises we can keep, written plainly.

  • Your data stays on your server

    No reCAPTCHA, no external APIs, no telemetry. Form, comment and spam data stay with you. Pro only checks its licence and updates with hushfort.com, sending your domain and licence key, nothing else.

  • Checkout is never broken

    No layer blocks a WooCommerce checkout. Payment callbacks pass even for a rate-limited IP. Suspicious accounts made during payment are held for review, not refused.

  • Hard to lock yourself out

    Hide Login does nothing until you choose a path. A line in wp-config.php sets the path any time, and the dashboard keeps your way back in on display.

  • Wrong in the safe direction

    Maybe-human messages go to quarantine, not the bin. Declutter says "Can't tell" instead of guessing. If a layer fails, the site stays up.

  • Private by default

    Emails in logs are stored hashed and masked. Logs are kept for 14 days by default and work with WordPress's export and erase tools.

  • Layers that know each other

    Every module uses the same IP reading, the same allowlist and the same event log. Allow yourself once, everywhere.

What Hushfort is not

Honest limits, so nothing surprises you later.

  • Not a malware scanner

    It doesn't scan files for malware or clean infected sites.

  • Not a firewall

    It has no SQL injection or XSS rule sets, and no country blocking.

  • Not a backup tool

    It doesn't back up your site. Keep a separate backup.

  • Not a DDoS shield

    A plugin can't stop network-level floods. A CDN such as Cloudflare is the real shield there.

Hushfort pairs well with a backup plugin, a malware scanner and a CDN. It guards the doors; they cover the rest.

Simple pricing

Free shows you every open door. Pro closes them all.

  • Free

    $0forever

    See every open door. Close the first two.

    • Hide Login: move your login to a secret path
    • Basic spam protection: invisible honeypot and fill-time check
    • Surface Scan: see everything your site exposes
    • Dashboard: a status card for every layer
    Get it free

  • Pro

    Complete

    $49per year

    or $11 per monthor $149 once, lifetime

    Every layer, every wall. One licence per site.

    • Everything in Free
    • Login Limits: lock out bots guessing passwords, with alerts and history
    • Two-Factor login with any authenticator app
    • Backdoor Lock: close XML-RPC login and bulk guessing
    • Username Shield: stop WordPress publishing usernames
    • Full Anti-Spam: limits, disposable emails, block lists, quarantine
    • Fake Signup Block, with checkout never blocked
    • Flood & Fake-Bot Guard
    • Declutter: find the plugins you don't use
    Get a plan

Prices in US dollars. Taxes, if any, are added at checkout. 14-day money-back guarantee, no questions asked. Checkout opens soon.

Questions, answered plainly

Is there a free plan?

Yes. Free hides your login page, adds basic spam protection and shows every open door on your site through Surface Scan and the dashboard. Pro closes the rest.

Can I lock myself out?

It is hard to. Hide Login does nothing until you choose a path, and one line in wp-config.php sets the login path again at any time. There is also a switch for two-factor and, as a last resort, you can delete the plugin folder over FTP. See the Locked out? page.

Does Hushfort send any data anywhere?

No. There is no telemetry and no third-party service. Spam and form checks run on your server. The free plugin makes no outbound calls. Pro fetches Google's and Bing's public crawler IP lists and checks its licence with hushfort.com; no personal data is sent.

Does it replace my malware scanner or firewall?

No. Hushfort hardens the ways into your site: login, XML-RPC, usernames, spam, signups and request floods. It does not scan for malware, run firewall rules or make backups. It works alongside tools that do.

Will it slow my site down or break my cache?

It is built to stay light. Bot checks use a script of about 2 KB with no cookies, and it works with page caching such as LiteSpeed. Declutter can even show you which plugins weigh your pages down.

Will it ever block a customer at checkout?

No. No layer blocks a WooCommerce checkout, and payment callbacks always pass. If a suspicious account is created during payment, the order goes through and the account is held for you to review.

Do my visitors have to solve a CAPTCHA?

No. Spam and signup checks are invisible: hidden honeypot fields, a minimum fill time and signed tokens. Real people just fill in the form.

Is hiding the login page enough on its own?

No. It cuts down automated noise, but it is an obscurity layer. Pair it with login limits, two-factor, strong passwords and updates. Hushfort has all of those in one place, except the passwords and updates, which are yours.

Help when you need it

Plain docs, a page for the worst day, and a person on the other end of the email.

Latest how-tos

Step-by-step answers to the questions people ask about WordPress security.

All how-tos

Close the gates. Keep the calm.

Start free. See every open door. Close them when you're ready.

Get it on WordPress.orgRead the how-tos