Home

Erfort is a small, honest WordPress firewall. No cloud, no telemetry, no upsells.

The README covers installing it and what each protection does. This wiki is for the longer material that would bloat a README.

Pages

• Threat model - what Erfort defends against, and what it deliberately does not. Read this before filing a feature request.
• Module reference - every module, what it changes, and its default state.
• Break glass - how to get back in if you lock yourself out.
• Self-hosted updates - the one outbound request, and three ways to change or remove it.

The short version

Copy the folder into wp-content/plugins/erfort/, activate. Useful protection is on immediately; everything risky is off by default.

If you get locked out, wp erfort off stands the lockout protections down. That command exists precisely because being locked out of your own site is also a security failure.

Reporting a security problem

Do not open a public issue. Use the Security tab, Report a vulnerability, or read SECURITY.md.