Advanced Restrictions now actually apply, and admin menu management is searchable. Review your Restrictions tab after upgrading; sensible defaults are enabled for non-super users.<\/p>","1.10.0":"
Adds bundled Two-Factor authentication with admin enforcement. If you already run the standalone Two-Factor plugin, Fuerte-WP detects it and steps aside automatically.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":2589990,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-2048x2048.png":{"filename":"icon-2048x2048.png","revision":2589990,"resolution":"2048x2048","location":"assets","locale":"","width":2048,"height":2048},"icon-256x256.png":{"filename":"icon-256x256.png","revision":2589990,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":2589990,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":2589990,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.10.0","1.11.0","1.11.1","1.3.1","1.3.10","1.3.11","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.1","1.4.10","1.4.11","1.4.12","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5.0","1.5.1","1.6.1","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.8.0","1.8.1","1.9.0","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":2589990,"resolution":"1","location":"assets","locale":"","width":2556,"height":1967},"screenshot-2.png":{"filename":"screenshot-2.png","revision":2589990,"resolution":"2","location":"assets","locale":"","width":2556,"height":1967},"screenshot-3.png":{"filename":"screenshot-3.png","revision":2589990,"resolution":"3","location":"assets","locale":"","width":2556,"height":1967},"screenshot-4.png":{"filename":"screenshot-4.png","revision":2589990,"resolution":"4","location":"assets","locale":"","width":2556,"height":1967}},"screenshots":{"1":"Main settings page with super user configuration","2":"Auto-update management with scheduling options","3":"Deferred and Blocked Updates configuration","4":"Two-Factor and Login Security dashboard with real-time monitoring","5":"Discovery-driven admin menu and access control management"}},"plugin_section":[],"plugin_tags":[37376,1229,732,600,9217],"plugin_category":[54],"plugin_contributors":[85358],"plugin_business_model":[],"class_list":["post-145700","plugin","type-plugin","status-publish","hentry","plugin_tags-auto-updates","plugin_tags-login-security","plugin_tags-maintenance","plugin_tags-security","plugin_tags-two-factor","plugin_category-security-and-spam-protection","plugin_contributors-tcattd","plugin_committers-tcattd"],"banners":{"banner":"https:\/\/ps.w.org\/fuerte-wp\/assets\/banner-772x250.png?rev=2589990","banner_2x":"https:\/\/ps.w.org\/fuerte-wp\/assets\/banner-1544x500.png?rev=2589990","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/fuerte-wp\/assets\/icon-128x128.png?rev=2589990","icon_2x":"https:\/\/ps.w.org\/fuerte-wp\/assets\/icon-256x256.png?rev=2589990","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/fuerte-wp\/assets\/screenshot-1.png?rev=2589990","caption":"Main settings page with super user configuration"},{"src":"https:\/\/ps.w.org\/fuerte-wp\/assets\/screenshot-2.png?rev=2589990","caption":"Auto-update management with scheduling options"},{"src":"https:\/\/ps.w.org\/fuerte-wp\/assets\/screenshot-3.png?rev=2589990","caption":"Deferred and Blocked Updates configuration"},{"src":"https:\/\/ps.w.org\/fuerte-wp\/assets\/screenshot-4.png?rev=2589990","caption":"Two-Factor and Login Security dashboard with real-time monitoring"}],"raw_content":"\n
\ud83d\udee1\ufe0f WordPress Security and Maintenance That Prevents Problems Before They Happen<\/strong><\/p>\n\n Every day, WordPress sites are compromised through supply chain attacks. A trustworthy plugin developer has their account hacked, malicious code ships as an \"update\", and thousands of sites auto-install it within hours. Fuerte-WP protects your site when developers cannot protect their own update systems.<\/p>\n\n Fuerte-WP combines four defenses in one lightweight plugin: update management<\/strong>, admin oversight<\/strong>, login security<\/strong>, and two-factor authentication<\/strong>. It is built for agencies, e-commerce stores, and anyone who manages WordPress sites and needs to sleep at night.<\/p>\n\n \ud83d\udea8 CRITICAL: SUPPLY CHAIN ATTACK AND MALICIOUS UPDATE PROTECTION<\/strong><\/p>\n\n A supply chain attack happens when an attacker compromises a developer account and pushes a malicious update that thousands of sites auto-install before anyone notices. When you learn an attack is in progress, you need to act in minutes, not days.<\/p>\n\n Fuerte-WP gives you three update modes so you can react correctly:<\/p>\n\n This is not a generic \"disable updates\" toggle. Deferred and Blocked are separate, intentional controls, so you can hold one compromised plugin back while the rest of the site keeps updating normally.<\/p>\n\n \u26a1 AUTO-UPDATE MANAGEMENT FOR CORE, PLUGINS, THEMES, AND TRANSLATIONS<\/strong><\/p>\n\n Granular control over every update channel:<\/p>\n\n You can configure this once on your main site and reuse the same file-based configuration across every site you manage.<\/p>\n\n \ud83d\udc51 ADMINISTRATOR OVERSIGHT AND ACCESS CONTROL<\/strong><\/p>\n\n Most WordPress security plugins assume the administrator is the threat. Fuerte-WP assumes the administrator is trusted but busy, and that you want to protect them from themselves and from each other.<\/p>\n\n \ud83d\udd12 LOGIN SECURITY (OPTIONAL, ON BY DEFAULT)<\/strong><\/p>\n\n Brute force attacks against \ud83d\udd10 TWO-FACTOR AUTHENTICATION (2FA) FOR ADMINS<\/strong><\/p>\n\n Since version 1.10.0, Fuerte-WP bundles the official WordPress Two-Factor library and enforces a safe provider policy:<\/p>\n\n Enforce 2FA for Administrators<\/strong> is on by default. Administrators and Super Admins are challenged with an emailed code at login even before they set up an authenticator app. Each admin can switch to TOTP from their own profile page. Enforcement is read-only: it never writes to user meta, so unchecking the box releases admins immediately. Fuerte super users always bypass enforcement.<\/p>\n\n Crash-safe coexistence: if you already run the standalone Two-Factor plugin, Fuerte-WP detects it and steps aside. No class-redeclare fatal, no duplicate provider screens.<\/p>\n\n Operator escape hatch: define \ud83d\udee0 REST API, XML-RPC, AND APP PASSWORD HARDENING<\/strong><\/p>\n\n Modern WordPress exposes several attack surfaces beyond the login form:<\/p>\n\n \ud83d\udce7 EMAIL CONTROLS AND RECOVERY<\/strong><\/p>\n\n WordPress sends a lot of email. Fuerte-WP lets you redirect and silence it:<\/p>\n\n \ud83c\udf10 MULTISITE, PERFORMANCE, AND DEVELOPER FRIENDLINESS<\/strong><\/p>\n\n \ud83d\udd27 HOW FUERTE-WP WORKS<\/strong><\/p>\n\n Fuerte-WP follows a single-source-of-truth model. Configuration lives in one normalized array and is read the same way everywhere:<\/p>\n\n Because the enforcer reads one normalized array, there is no drift between what the admin UI shows and what the site enforces. After editing config logic in code, bust the transient with \ud83d\udcc1 FILE-BASED CONFIGURATION FOR MASS DEPLOYMENT<\/strong><\/p>\n\n For agencies and platform teams, Fuerte-WP can be configured entirely from a file, with no admin UI clicks. Drop a <?php\n$fuertewp = array(\n 'general' => array( 'sender_email_enable' => true ),\n 'super_users' => array( 'you@agency.com' ),\n 'auto_updates' => array(\n 'core' => true, 'plugins' => true, 'themes' => true,\n 'translations' => true, 'frequency' => '12h',\n ),\n 'restrictions' => array(\n 'disable_theme_editor' => true,\n 'disable_plugin_editor' => true,\n 'restapi_disable_app_passwords' => true,\n 'disable_xmlrpc' => true,\n ),\n 'login_security' => array( 'login_security_enable' => true, 'two_factor_enable' => true ),\n);\n `<\/p>\n\n Commit this file to your deployment pipeline and every site in your fleet ships the same security baseline. The admin UI still renders for inspection, but saved values never override the file. This is the recommended path for WordPress multisite networks and managed-hosting platforms.<\/p>\n\n \ud83d\udccb SECURITY HARDENING CHECKLIST<\/strong><\/p>\n\n Fuerte-WP ships with safe defaults so a fresh install is already hardened. The following are on by default and can be toggled on the Restrictions and Login Security tabs:<\/p>\n\n Review the Restrictions tab after your first install and adjust to your workflow.<\/p>\n\n \ud83c\udfaf PERFECT FOR:<\/strong><\/p>\n\n \u26a1 INSTALL IN SECONDS, PROTECT FOR YEARS<\/strong><\/p>\n\n For mass deployment, drop a When you learn that a plugin developer's account has been compromised and malicious updates are being distributed, open Fuerte-WP and block that plugin under Blocked Updates. This freezes the plugin at its last safe version and prevents your site from auto-installing malicious code, even while thousands of other sites are being compromised. Once the developer publishes a verified clean release, remove the block.<\/p><\/dd>\n Deferred Updates<\/strong>: the plugin will not auto-update, but you can still update it manually when you are ready. Good for testing a release on staging before it reaches production.<\/p>\n\n Blocked Updates<\/strong>: the plugin cannot update at all, neither automatically nor manually. Essential during a supply chain attack when any update could contain malicious code.<\/p><\/dd>\n Yes. Since 1.10.0, Fuerte-WP bundles the official WordPress Two-Factor library. Administrators can use Email codes, an Authenticator App (TOTP, compatible with Google Authenticator, Authy, 1Password), and Recovery Codes. \"Enforce 2FA for Admins\" is on by default. If you already run the standalone Two-Factor plugin, Fuerte-WP detects it and steps aside.<\/p><\/dd>\n No. Only super users can modify Fuerte-WP settings or disable the plugin. Other administrators are restricted from making changes that could compromise your site's security. This makes Fuerte-WP self-protecting.<\/p><\/dd>\n You set a secret login slug. Fuerte-WP redirects the default Yes, both are one-click toggles and both are on by default. Disabling XML-RPC removes the pingback vector and brute force amplification. Disabling Application Passwords prevents leaked credentials from being used against the REST API.<\/p><\/dd>\n No. All maintenance and update checks run in the background through a dedicated cron event. Page load times are unaffected. Fuerte-WP is performance optimized.<\/p><\/dd>\n Yes. Fuerte-WP is fully compatible with WordPress multisite and can be network-activated for centralized management across every site on the network.<\/p><\/dd>\n Yes. Define a \n
\n
\n
edit.php<\/code> (Posts, Pages, and custom post types) and index.php<\/code> are hide-only so you never strand a non-super user on a blank screen. Single-purpose core scripts (themes.php<\/code>, tools.php<\/code>, plugins.php<\/code>) block by $pagenow<\/code>. Plugin pages block by their ?page=<\/code> query argument.<\/li>\nwp-login.php<\/code> and XML-RPC are the most common way WordPress sites are compromised. Fuerte-WP ships with a full login hardening suite:<\/p>\n\n\n
wp-login.php<\/code> and wp-admin<\/code> paths so automated bots that scan for those endpoints find nothing. Your real login URL is whatever you choose.<\/li>\n\n
WP_DEBUG<\/code>.<\/li>\n<\/ul>\n\nFUERTEWP_DISABLE_2FA<\/code> in wp-config.php<\/code> to skip the bundled library entirely.<\/p>\n\n\n
\n
wp_mail()<\/code> (falls back to no-reply@<your-domain><\/code> when left empty)<\/li>\n\n
$fuertewp<\/code> in wp-config-fuerte.php<\/code> for mass deployment. File config wins over the database, so the same settings ship to every site without touching the admin UI<\/li>\n\n
wp-config-fuerte.php<\/code> file first, then falls back to the database option saved by the admin UI. File always wins.<\/li>\nFUERTEWP_FORCE<\/code> to enforce even on super users, or FUERTEWP_DISABLE<\/code> to switch the whole plugin off without uninstalling.<\/li>\n<\/ol>\n\ndelete_transient('fuertewp_config')<\/code> so the new rules take effect.<\/p>\n\nwp-config-fuerte.php<\/code> file in your ABSPATH<\/code> directory defining a $fuertewp<\/code> array:<\/p>\n\n`\n<\/code><\/pre>\n\n\n
\n
\n
\n
wp-config-fuerte.php<\/code> file in your ABSPATH<\/code> directory defining a $fuertewp<\/code> array. File configuration wins over the database. See the sample in config-sample\/<\/code>.<\/p>\n\n\n\n
How does supply chain attack protection work?<\/h3><\/dt>\n
What is the difference between Deferred and Blocked updates?<\/h3><\/dt>\n
Does Fuerte-WP include two-factor authentication (2FA)?<\/h3><\/dt>\n
Can other administrators disable Fuerte-WP?<\/h3><\/dt>\n
How does the hide login URL \/ custom login URL feature work?<\/h3><\/dt>\n
wp-login.php<\/code> and wp-admin<\/code> paths away from unauthenticated visitors, so bots that scan for those endpoints find nothing. You and your team log in at your custom URL instead. Brute force attacks against the default login form stop almost entirely.<\/p><\/dd>\nCan I disable XML-RPC and Application Passwords?<\/h3><\/dt>\n
Will this slow down my website?<\/h3><\/dt>\n
Does this work with WordPress multisite?<\/h3><\/dt>\n
Can I configure Fuerte-WP without the admin UI?<\/h3><\/dt>\n
$fuertewp<\/code> array in wp-config-fuerte.php<\/code> inside your ABSPATH<\/code> directory. File configuration wins over the database, so the same baseline ships to every site you manage. See config-sample\/wp-config-fuerte.php<\/code> for the full shape.<\/p><\/dd>\nWhere can I find more documentation?<\/h3><\/dt>\n