Security

How we protect your site

Like a fortress: several independent layers. If one fails, the next one stops the attack.

• **Entry** — we stop common attacks before they reach WordPress.
• **Login** — we protect accounts from password guessing and takeover; two-step login.
• **Files** — we make sure nobody changes the site’s files unnoticed.
• **Known vulnerabilities** — we warn about vulnerabilities in installed plugins and themes — first about those under attack.
• **Permissions** — only the technical caretaker changes protection settings, and every change is recorded.

We don’t publish how it works in detail — no need to make attackers’ work easier. What each feature does: Features.

How we release the plugin

• **Every change is checked** — an automated code security audit; if it finds a problem, the release waits.
• **Reviews against standards** — following the international OWASP ASVS standard, together with tests of the running site.
• **Signed updates** — every package carries the publisher’s digital signature; a tampered package cannot be installed.
• **Staged releases** — a new version goes to the test site first and to all other sites after 2 days. Security fixes — right away.

Security fixes

• They are free during the support period — even without a key and after it expires.
• They install themselves. You can turn this off on the Updates tab.

Security tipDon’t turn off automatic fixes without a reason. Once a vulnerability is disclosed, bots quickly search for vulnerable sites — often faster than anyone checks the dashboard.

Support period

We release fixes for the latest version of Stronghold WP and its add-ons. At purchase we state how long we will release them (a Cyber Resilience Act requirement).