nolimit-security-dist/docs/README.md

Nolimit Security

Firewall, login protection, country filtering, honeytraps, malware and vulnerability scanning, and an AI analyst that watches the site for you.

The point of it is that nothing leaves the site. There is no cloud account, no telemetry and no address sent anywhere. The threat lists are compiled locally and matched locally; the AI analyst runs against a key you supply and can be switched off without disabling anything else.

Current version: 1.4.8. Requires WordPress 5.8+ and PHP 7.4+. WooCommerce is not required, and where it is installed its checkout, My Account and store API paths are protected too.

What it does

Firewall	Refuses requests before WordPress loads, where it can. Rate limits per address, filters by country, and scans the request body for attack patterns. Verified crawlers are exempt — Googlebot at full speed looks exactly like a scanner to a counter, and falling out of the index is worse than the scan.
Login protection	Lockouts, two-factor with recovery codes, password quality, XML-RPC control.
Honeytraps	Paths no human visits. One request is enough to know.
Scanning	File hashes against WordPress core, signature matching for known malware, and a vulnerability check against installed plugin and theme versions.
AI analyst	Reads the findings and the log and says what it thinks is going on, on a schedule. Optional, off until a key is supplied, and it never acts without being asked unless you have ticked the actions it may take.

What it does not do

• No telemetry. Not a ping, not a count, not an anonymised anything. The only network traffic is fetching public threat lists and vulnerability data, and calling the AI provider if you configured one.
• No cloud account. There is nothing to sign up for.
• No paid tier. There is no feature behind a licence check, because there is no licence check.
• It is not translated. The interface is English, on every site.

Where to go next

• Installing it and knowing it works — SETUP.md
• Every hook it offers and asks for, for developers — CONTRACT.md