# Nolimit Security

Firewall, login protection, country filtering, honeytraps, malware and
vulnerability scanning, and an AI analyst that watches the site for you.

The point of it is that **nothing leaves the site**. There is no cloud account,
no telemetry and no address sent anywhere. The threat lists are compiled
locally and matched locally; the AI analyst runs against a key you supply and
can be switched off without disabling anything else.

Current version: **1.4.7**. Requires WordPress 5.8+ and PHP 7.4+. WooCommerce
is not required, and where it is installed its checkout, My Account and store
API paths are protected too.

## What it does

| | |
|---|---|
| **Firewall** | Refuses requests before WordPress loads, where it can. Rate limits per address, filters by country, and scans the request body for attack patterns. Verified crawlers are exempt — Googlebot at full speed looks exactly like a scanner to a counter, and falling out of the index is worse than the scan. |
| **Login protection** | Lockouts, two-factor with recovery codes, password quality, XML-RPC control. |
| **Honeytraps** | Paths no human visits. One request is enough to know. |
| **Scanning** | File hashes against WordPress core, signature matching for known malware, and a vulnerability check against installed plugin and theme versions. |
| **AI analyst** | Reads the findings and the log and says what it thinks is going on, on a schedule. Optional, off until a key is supplied, and it never acts without being asked unless you have ticked the actions it may take. |

## What it does not do

- **No telemetry.** Not a ping, not a count, not an anonymised anything. The
  only network traffic is fetching public threat lists and vulnerability data,
  and calling the AI provider if you configured one.
- **No cloud account.** There is nothing to sign up for.
- **No paid tier.** There is no feature behind a licence check, because there
  is no licence check.
- **It is not translated.** The interface is English, on every site.

## Where to go next

- **Installing it and knowing it works** — [SETUP.md](SETUP.md)
- **Every hook it offers and asks for, for developers** — [CONTRACT.md](CONTRACT.md)