What Hushfort solves
The questions people ask, answered step by step.
Each answer shows the manual way first, where there is one, and how Hushfort does it. Plain language, no scare tactics.
Login & access
Keep strangers out of the way in.
How do I add two-factor authentication (2FA) to WordPress?
Add a second login step with any authenticator app. Set up 2FA in WordPress, save recovery codes, and know what to do if you lose your phone.
Read the stepsHow do I change the WordPress login URL?
Change the WordPress login URL and hide wp-admin in five safe steps. Test before you log out, and know how to get back in if you forget it.
Read the stepsHow do I limit login attempts in WordPress?
Stop brute-force password guessing by locking out an IP after a few failed logins. Settings that work, the manual code, and the holes to close.
Read the steps
Hardening
Close the doors WordPress leaves open.
Can one plugin replace several WordPress security plugins?
Many sites run a separate plugin for every security worry. How to audit what you have, see what overlaps, and move to one plugin without a gap.
Read the stepsHow do I run a security check on what my WordPress site exposes?
Test your WordPress site the way a bot does. Five requests show if the login, XML-RPC and your usernames are open, and how to close what you find.
Read the stepsHow do I stop user enumeration in WordPress?
WordPress publishes login names in four places. Close the REST user list, ?author=N scans, author archives and the user sitemap, then test.
Read the stepsWhat is xmlrpc.php, and how do I disable it in WordPress?
xmlrpc.php is a second login door that a hidden login page doesn't close. How to shut it safely, keep pingbacks if you want, and test the result.
Read the steps
Spam
Quiet comments and forms, without puzzles.
How do I disable comments in WordPress, or stop comment spam?
Disable comments in WordPress everywhere, or keep them open and stop the spam. Separate rules for posts and product reviews, pingbacks off, no CAPTCHA.
Read the stepsHow do I stop contact form spam without a CAPTCHA?
Stop spam in Elementor, Contact Form 7 and WPForms without puzzles. Honeypots, fill-time checks and limits that keep visitor data on your server.
Read the steps
Fake signups
Real people in, bulk accounts out.
Speed & calm
Keep the site fast under pressure.
How do I find unused plugins in WordPress?
Find plugins that are installed but do nothing, see how much code they load on every page, and remove them in two reversible steps.
Read the stepsHow do I spot and block fake Googlebot traffic on WordPress?
Bots that pretend to be Googlebot slow WordPress down. Verify real crawlers by IP, block the fakes, budget requests per IP and never block checkout.
Read the steps
Recovery
Get back in when something goes wrong.