Update the public pages to 1.4.6

2026-10-07 09:51:49 +02:00
parent 0e8f498f78
commit 6f30fa13e3
10 changed files with 320 additions and 18 deletions
@@ -0,0 +1,38 @@
+# Nolimit Security
+
+Firewall, login protection, country filtering, honeytraps, malware and
+vulnerability scanning, and an AI analyst that watches the site for you.
+
+The point of it is that **nothing leaves the site**. There is no cloud account,
+no telemetry and no address sent anywhere. The threat lists are compiled
+locally and matched locally; the AI analyst runs against a key you supply and
+can be switched off without disabling anything else.
+
+Current version: **1.4.6**. Requires WordPress 5.8+ and PHP 7.4+. WooCommerce
+is not required, and where it is installed its checkout, My Account and store
+API paths are protected too.
+
+## What it does
+
+| | |
+|---|---|
+| **Firewall** | Refuses requests before WordPress loads, where it can. Rate limits per address, filters by country, and scans the request body for attack patterns. Verified crawlers are exempt — Googlebot at full speed looks exactly like a scanner to a counter, and falling out of the index is worse than the scan. |
+| **Login protection** | Lockouts, two-factor with recovery codes, password quality, XML-RPC control. |
+| **Honeytraps** | Paths no human visits. One request is enough to know. |
+| **Scanning** | File hashes against WordPress core, signature matching for known malware, and a vulnerability check against installed plugin and theme versions. |
+| **AI analyst** | Reads the findings and the log and says what it thinks is going on, on a schedule. Optional, off until a key is supplied, and it never acts without being asked unless you have ticked the actions it may take. |
+
+## What it does not do
+
+- **No telemetry.** Not a ping, not a count, not an anonymised anything. The
+  only network traffic is fetching public threat lists and vulnerability data,
+  and calling the AI provider if you configured one.
+- **No cloud account.** There is nothing to sign up for.
+- **No paid tier.** There is no feature behind a licence check, because there
+  is no licence check.
+- **It is not translated.** The interface is English, on every site.
+
+## Where to go next
+
+- **Installing it and knowing it works** — [SETUP.md](SETUP.md)
+- **Every hook it offers and asks for, for developers** — [CONTRACT.md](CONTRACT.md)