Support
Updated
We're a small studio, and we read every message. Write to us in plain words and we'll answer the same way.
To help us help you faster, include:
- Your WordPress version and PHP version.
- The Hushfort version (Plugins screen).
- Which layer is involved, for example Hide Login, Anti-Spam or Load Protection.
- What you expected, and what happened instead. A screenshot helps.
Please never send passwords, recovery codes or API keys. We will never ask for them.
Locked out?
Start with the Locked out? page. It lists every way back in, from a single
line in wp-config.php to removing the plugin folder.
Before you write: quick checks
- A layer blocks something it shouldn't. Spam, signup and load protection can run in Monitor mode. They log what they would block without blocking it. Switch the layer to Monitor, reproduce the problem, then look at the History screen.
- Forms stopped sending after you turned on caching. Clear the page cache once. Hushfort fetches its form token with a small script, so cached pages keep working after that.
- A plugin is flagged as unused but you need it. Declutter never removes anything on its own. Ignore the suggestion, or switch a set-aside plugin back on with one click.
- You're behind Cloudflare or another proxy. Check the IP source setting in Login Limits, so Hushfort reads your visitors' real IP addresses.
Docs
The docs cover getting started, installing Pro and activating your licence, Free vs Pro and troubleshooting.
Questions
See the FAQ for pricing, privacy and what Hushfort does and doesn't do. Billing questions are answered in the billing & licences FAQ, and refunds in the refund policy: 14 days, no questions asked.
Reporting a security issue in Hushfort
If you believe you've found a security problem in the plugin itself, please follow our responsible disclosure policy. In short: email [email protected] with "Security" in the subject line, and give us time to fix it before you share details publicly.
Frequently asked questions
Straight answers about Hushfort, pricing and support.
Pricing
Is there a free plan?
Yes. Free includes Hide Login, basic spam protection (an invisible honeypot and a fill-time check), Surface Scan and the dashboard. It shows you every open door, even the ones only Pro closes.
What does Pro add?
Every other layer: Login Limits against bot password guessing, two-factor login, Backdoor Lock for XML-RPC, Username Shield, the full Anti-Spam toolkit, Fake Signup Block, Flood & Fake-Bot Guard and Declutter. Pro is a separate add-on that sits on top of the free plugin, so your settings and history stay where they are.
How much does Pro cost?
$11 a month, $49 a year, or $149 once for a lifetime licence. Prices are in US dollars; taxes, if any, are added at checkout.
How many sites does one licence cover?
One. Each Pro licence is for one site.
Do you offer refunds?
Yes. If Hushfort Pro isn't right for you, ask within 14 days of purchase and you get a full refund, no questions asked.
The plugin
What does Hushfort do?
It hardens the ways into a WordPress site. It hides the login page, limits failed logins, adds two-factor login, closes XML-RPC login and username leaks, stops comment, form and signup spam, slows request floods, blocks fake Googlebots and finds plugins you don't use.
What does it need to run?
WordPress 6.2 or newer and PHP 7.2 or newer. It is tested up to WordPress 7.1.
Can I use only some of the layers?
Yes. Each layer is a module you switch on separately from the Hushfort menu.
Does it send data to any outside service?
No. There is no telemetry, no reCAPTCHA and no external API. Pro's fake-bot check downloads Google's and Bing's public crawler IP lists; no personal data is sent. If you add your own Cloudflare API key, Hushfort uses it only to switch your security level in emergency mode. Pro also contacts hushfort.com to check its licence and fetch updates; it sends only your site's domain and licence key.
Will it block real people by mistake?
Spam, signup and load protection each have a Monitor mode, and load protection starts in it. In Monitor mode a layer logs what it would block without blocking it, so you can check the log before you switch to Protect. Borderline messages go to quarantine, where you can mark them "Not spam".
Does it work with WooCommerce?
Yes. It protects product reviews and WooCommerce registration, and no layer blocks a checkout. Payment callbacks always pass.
Which form plugins does Anti-Spam cover?
Elementor Pro forms, Contact Form 7, WPForms, Gravity Forms, Fluent Forms and Forminator, plus WordPress comments and WooCommerce reviews.
Does it work with page caching?
Yes. Login pages are never cached, and form tokens are fetched by a small script of about 2 KB rather than baked into cached HTML.
Is there a command-line tool?
Declutter runs from WP-CLI: wp hushfort declutter. Add --format=json for machine-readable output.
What languages is the plugin in?
English, with a complete Turkish translation.
What happens if I deactivate it?
WordPress goes back to its defaults: wp-login.php opens again, login limits stop and existing lockouts are lifted. Logged data is removed only when you delete the plugin.
What it doesn't do
Does Hushfort scan for malware?
No. It doesn't scan files, check file integrity or clean infected sites. Use a dedicated scanner for that.
Is it a firewall?
Not in the sense of SQL injection or XSS rule sets. It also doesn't block countries. It limits requests per IP and turns away fake search bots, which is a different job.
Does it make backups?
No. Keep a backup plugin or your host's backups. Hushfort's own cleanup tools keep 30-day restorable copies only for the accounts they remove.
Can it stop a DDoS attack?
Not a network-level one. No plugin can, because the traffic reaches your server before WordPress runs. A CDN such as Cloudflare is the real shield. Hushfort tells you which layer is protecting you.
Support and access
How do I get help?
Email [email protected]. Tell us your WordPress and PHP versions and what you see. Please never send passwords or recovery codes.
I'm locked out. What now?
Add define( 'GATEKEEPER_LOGIN_SLUG', 'new-path' ); to wp-config.php and log in at yoursite.com/new-path. The Locked out? page walks through every way back in.
I lost the phone with my authenticator app.
Use one of your recovery codes. If you have none left, add define( 'GATEKEEPER_2FA_DISABLE', true ); to wp-config.php, log in, set up two-factor again, then remove the line.