How to install the plugin, what it needs and answers to common questions.
Installation
- Plugins → Add New → Upload Plugin → Activate.
- The setup wizard walks you through the protection layer, choosing the technical caretaker and modules.
- At the end it shows the new login address — save it.
Security tipKeep the login address and password in a password manager, not in a note on your desktop. Share the address only with people who log in. The fewer people know it, the fewer guessing attempts.
Manuals for editors and technical caretakers are in the plugin dashboard: Stronghold WP → Manual (PDF to download and print, in Polish).
Requirements: WordPress 6.4 or newer, PHP 8.1 or newer, any theme. The antivirus and uptime checks need a Linux server with administrator access — everything else works without it.
Frequently asked questions
Will Stronghold WP replace other security plugins?
Usually yes: a firewall, two-factor login, antivirus and continuous monitoring come in one plugin. It can also run alongside another security plugin — then switch on the overlapping protections in only one of them.
Do you help with the server?
We do not provide server support — hosting, PHP and the web server are handled by your own administrator. For the server component of Stronghold WP (antivirus, site uptime checks) we work with them: we tell them what to install and how.
I can’t remember the new login address.
When protection is turned on, the address is e-mailed to administrators. A logged-in technical caretaker finds it in the Protection module settings. A server administrator can read it with WP-CLI (WordPress’s command-line tool).
What happens when the key expires?
Your site keeps working and receives security fixes until the end of the support period. It doesn’t receive new versions with new features or translations.
Does the plugin send data about my site?
It does not collect usage statistics. It connects to external services only for these purposes:
- the Stronghold WP update channel — checking for new versions and security fixes (without your site address);
- Have I Been Pwned — whether a password has leaked (only the beginning of the password hash is sent, never the password);
- Cloudflare and Spamhaus — network address lists (downloaded; nothing is sent);
- once the protection layer is installed: wordpress.org (file checksums), wpvulnerability.net (list of installed plugins and themes with versions — known vulnerabilities), CISA (including its GitHub mirror) and FIRST (vulnerability data);
- only when enabled with your own key: public vulnerability databases (the vulnerability list is downloaded), Google Safe Browsing;
- only in modules you turn on: DB-IP (location in statistics), archive.org (broken links), your SMTP mail server;
- only when connected to Headquarters (an add-on on your own site): a signed site status report — numbers and levels only, no usernames or IP addresses.
Does Stronghold WP work with my theme and other plugins?
Yes, with any theme. Modules you don’t need (for example the contact form, if you already have one) simply stay off. Disabled modules don’t slow your site down.
How much does it cost?
We quote a price after reviewing your access request. Security fixes are free for the entire support period.