Module reference

Module reference

Every module, what it changes, and whether it is on by default. All of them are toggles on the Erfort settings screen.

Core protections, on by default

These are the ones that are cheap and safe enough to leave on everywhere.

Module	What it does
Login guard	Five failed attempts in fifteen minutes locks that IP and that username for fifteen minutes. Login errors are made generic so the form stops confirming which usernames exist.
Probe block	A fixed list of scanner paths returns 403 at plugins_loaded priority 1, before WordPress builds a query. It is a list, not a pattern, so it cannot false-positive on a real URL.
XML-RPC off	The whole endpoint returns 403, pingbacks included.
Enumeration off	?author= dies, and the anonymous REST user list is removed.
Security headers	X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
File editors off	Removes edit_files, edit_plugins, edit_themes via a capability filter. Updates still work.
Version cloak	No generator tag in the page head.

Why a capability filter and not DISALLOW_FILE_EDIT: that constant cannot be defined late enough from a plugin, and file_mod_allowed would break updates. The filter removes exactly three capabilities and nothing else.

Optional modules, off by default

Each of these can lock someone out or generate noise, so none of them turn themselves on.

Module	What it does	Why it is off
Two-factor	TOTP, Google Authenticator compatible, with recovery codes and an optional grace period for admins.	Enrolment is a real workflow change for every admin.
Integrity check	Compares core and wordpress.org plugin files against official checksums.	Makes an outbound request to wordpress.org.
Malware scan	Signature scan of wp-content and PHP in uploads. Report-only; quarantine moves rather than deletes.	Heuristic, so it will produce false positives.
Audit log	Records admin actions and emails on new-administrator or promote-to-admin.	Sends email.
Hardening	Configurable CSP, idle-timeout logout, disable application passwords, require login for REST.	Any of these can break a workflow if applied blindly.
Weekly digest	One email summarising updates, scan results, admin count, event volume.	Sends email.

IP detection behind Cloudflare

Erfort trusts CF-Connecting-IP only when the request actually arrived through Cloudflare, checked against Cloudflare's published edge ranges. Otherwise the header is forged trivially and could be used to evade the per-IP limit or frame someone else's IP into a lockout.

This is also why the login guard limits per username as well as per IP: rotating fake IPs still cannot brute-force one account.

The event log

A 200-line ring buffer in a single non-autoloaded option. No custom tables. It is the only record Erfort keeps, and it is exportable as CSV.