Hushfort
Menu

Troubleshooting

Updated

Most problems have a short fix. Find yours below. If none fits, email us.

You're locked out

Forgot the hidden login URL, or your IP is locked out after too many attempts? The Locked out? page lists every way back in, from one line in wp-config.php to removing the plugin folder. Your settings stay in the database either way.

You lost the phone with your 2FA app

  1. Use a recovery code. On the code screen, enter one of the recovery codes you downloaded or printed when you set up two-factor. Each code works once.
  2. Ask another administrator. Any admin can reset two-factor for your account from your user profile.
  3. No codes and no other admin? Add this line to wp-config.php:
define( 'GATEKEEPER_2FA_DISABLE', true );

This switches two-factor off for the whole site. Log in, set up two-factor again on your new phone, save the new recovery codes, then remove the line. While it is there, two-factor is off for everyone.

A form stopped sending

If a real person's message doesn't arrive, Anti-Spam may have stopped it.

  1. Look in the History screen. Every block is recorded, with the reason.
  2. Check the quarantine. Messages that look like they might be human are held, not deleted. Click Not spam to release one. Hushfort learns from it.
  3. Switch the layer to Monitor. In Monitor mode, Hushfort records what it would block without blocking it. Send a test message, check History, and switch back to Protect once you're sure nothing real is caught.

Page caching

With Pro, Hushfort's form tokens are fetched by a small script when the page loads. They are not baked into the cached HTML, so it works with LiteSpeed and other page caches.

If forms stopped sending right after you turned caching on, clear the page cache once. Pages cached before Hushfort was active don't have the script yet.

A layer blocks something it shouldn't

Anti-Spam, Fake Signup Block and Flood & Fake-Bot Guard each have a Monitor mode. Switch the layer to Monitor, reproduce the problem, then read History. You'll see exactly which rule fired.

If you work from a fixed IP, add it to the allowlist. The allowlist is shared by every layer.

You're behind Cloudflare or another proxy

Hushfort trusts proxy headers only when the request really comes from Cloudflare or a private network. Check the IP source setting in Login Limits, so Hushfort reads your visitors' real IP addresses rather than the proxy's.

Still stuck?

Contact support. Tell us what you see, your WordPress and Hushfort versions, and which layer is involved.