Skip to content

Threat model

Jump to bottom
Erf Talebi edited this page Jul 19, 2026 · 1 revision

Threat model

This page exists so nobody bolts features onto Erfort without thinking, and so you can tell quickly whether it is the right tool for your site.

Who this is for

Portfolio, nonprofit, and small-business sites on shared hosting.

What actually arrives at those sites

  • Bot login stuffing, thousands of attempts against wp-login.php
  • Scanners probing for known paths: .env, wp-config backups, .git/, Adminer, phpunit
  • User enumeration via ?author=1 or the REST user list, used to feed the stuffing above
  • XML-RPC amplification

Erfort defends against exactly these, and it does so with cheap, deterministic rules that are safe to leave on.

What does not arrive, and is therefore not defended against

A targeted attacker who has picked your site specifically and is willing to spend time on it. That is a genuinely different problem, and pretending a 1,000-line plugin solves it would be dishonest.

So there is deliberately:

  • No regex WAF. Request-matching rules produce false positives that break real editors, and a determined attacker rewrites around them.
  • No "security score". A number that goes up when you toggle things is marketing, not defence.
  • No cloud reputation service. That would mean sending your traffic somewhere, which contradicts the whole premise.

The consequences of this model

  • Erfort will not stop a compromised plugin from doing damage. Keep plugins updated; that is a bigger win than any firewall.
  • Erfort will not catch a novel obfuscated payload. The malware scan uses fixed signatures and will miss things.
  • Erfort is report-only wherever a wrong call is expensive. It flags files rather than deleting them, and quarantine moves a file rather than removing it.

If you want something else

If you need a real WAF, request filtering, or managed rule updates, use Wordfence or a hosting-level firewall. Running Erfort alongside another security plugin is not recommended: two plugins both rate-limiting logins can lock out a legitimate admin, and both sending security headers produces duplicates.

Clone this wiki locally