About Hushfort
Updated
Hushfort Security is made by Eureka Studio, a small studio that builds and looks after WordPress sites. We built it for our own sites first. It runs on our own production sites today.
Why it exists
Every layer in Hushfort started with a real problem on a real site:
- A hidden login wasn't enough. A store kept receiving password attempts through XML-RPC, even though its login URL was hidden. XML-RPC is a second, fully privileged way in. That's why Hushfort has Backdoor Lock and Surface Scan, which shows what a site actually exposes.
- Ten thousand signups in an hour. One site received around 10,000 signup requests in a single hour and ended up with tens of thousands of fake accounts. That became Fake Signup Block, with a site-wide ceiling, a circuit breaker and a cleanup wizard.
- A mail quota burned by bots. On another site, welcome emails to fake accounts used up the mail quota, so real emails stopped. Hushfort now throttles welcome emails during a signup flood.
- Plugins that do nothing but weigh a lot. On one site we measured, unused plugins made up 44% of the code on every page. One add-on pack loaded 35 widgets, none of them used. That became Declutter.
Each of these used to need a separate plugin or service. Hushfort puts them in one, with one dashboard and one history.
What we hold to
- Nothing goes to third parties. No reCAPTCHA, no external APIs, no telemetry. Spam, form and comment data stays on your server. Pro checks its licence with hushfort.com, sending only your domain, licence key and version.
- Checkout is never broken. No layer blocks a WooCommerce checkout. Payment callbacks pass, even for a rate-limited IP.
- No self-lockout. Hide Login does nothing until you choose a path, and there is always a way back in.
- Honest limits. Hushfort hardens the ways into your site. It doesn't scan for malware, run firewall rule sets or make backups, and we say so. A plugin can't stop a network-level flood; Cloudflare or your host is the shield there.
- Wrong in the safe direction. When unsure, Hushfort quarantines instead of deleting, and Declutter says "Can't tell" instead of guessing.
Get in touch
Contact us at [email protected]. Security reports go to the security page.