39 lines
2.1 KiB
Markdown
39 lines
2.1 KiB
Markdown
# Nolimit Security
|
|
|
|
Firewall, login protection, country filtering, honeytraps, malware and
|
|
vulnerability scanning, and an AI analyst that watches the site for you.
|
|
|
|
The point of it is that **nothing leaves the site**. There is no cloud account,
|
|
no telemetry and no address sent anywhere. The threat lists are compiled
|
|
locally and matched locally; the AI analyst runs against a key you supply and
|
|
can be switched off without disabling anything else.
|
|
|
|
Current version: **1.4.8**. Requires WordPress 5.8+ and PHP 7.4+. WooCommerce
|
|
is not required, and where it is installed its checkout, My Account and store
|
|
API paths are protected too.
|
|
|
|
## What it does
|
|
|
|
| | |
|
|
|---|---|
|
|
| **Firewall** | Refuses requests before WordPress loads, where it can. Rate limits per address, filters by country, and scans the request body for attack patterns. Verified crawlers are exempt — Googlebot at full speed looks exactly like a scanner to a counter, and falling out of the index is worse than the scan. |
|
|
| **Login protection** | Lockouts, two-factor with recovery codes, password quality, XML-RPC control. |
|
|
| **Honeytraps** | Paths no human visits. One request is enough to know. |
|
|
| **Scanning** | File hashes against WordPress core, signature matching for known malware, and a vulnerability check against installed plugin and theme versions. |
|
|
| **AI analyst** | Reads the findings and the log and says what it thinks is going on, on a schedule. Optional, off until a key is supplied, and it never acts without being asked unless you have ticked the actions it may take. |
|
|
|
|
## What it does not do
|
|
|
|
- **No telemetry.** Not a ping, not a count, not an anonymised anything. The
|
|
only network traffic is fetching public threat lists and vulnerability data,
|
|
and calling the AI provider if you configured one.
|
|
- **No cloud account.** There is nothing to sign up for.
|
|
- **No paid tier.** There is no feature behind a licence check, because there
|
|
is no licence check.
|
|
- **It is not translated.** The interface is English, on every site.
|
|
|
|
## Where to go next
|
|
|
|
- **Installing it and knowing it works** — [SETUP.md](SETUP.md)
|
|
- **Every hook it offers and asks for, for developers** — [CONTRACT.md](CONTRACT.md)
|