Fuerte-WP

🛡️ WordPress Security and Maintenance That Prevents Problems Before They Happen

Every day, WordPress sites are compromised through supply chain attacks. A trustworthy plugin developer has their account hacked, malicious code ships as an “update”, and thousands of sites auto-install it within hours. Fuerte-WP protects your site when developers cannot protect their own update systems.

Fuerte-WP combines four defenses in one lightweight plugin: update management, admin oversight, login security, and two-factor authentication. It is built for agencies, e-commerce stores, and anyone who manages WordPress sites and needs to sleep at night.

🚨 CRITICAL: SUPPLY CHAIN ATTACK AND MALICIOUS UPDATE PROTECTION

A supply chain attack happens when an attacker compromises a developer account and pushes a malicious update that thousands of sites auto-install before anyone notices. When you learn an attack is in progress, you need to act in minutes, not days.

Fuerte-WP gives you three update modes so you can react correctly:

• Scheduled Updates: choose how often WordPress checks for and applies updates. Options are 6, 12, 24, or 48 hours. Slower cycles give you a review window. Faster cycles keep client sites current.
• Deferred Updates: keep a plugin out of auto-updates while still letting you update it manually. Useful when you want to test a release on staging before it reaches production.
• Blocked Updates: completely freeze a plugin or theme. Neither WordPress nor manual clicks can update it. This is the supply chain defense. When a developer account is compromised, you block the plugin at its last known safe version and wait until the all-clear.

This is not a generic “disable updates” toggle. Deferred and Blocked are separate, intentional controls, so you can hold one compromised plugin back while the rest of the site keeps updating normally.

⚡ AUTO-UPDATE MANAGEMENT FOR CORE, PLUGINS, THEMES, AND TRANSLATIONS

Granular control over every update channel:

• WordPress core auto-updates (on or off)
• Plugin auto-updates (on or off, with per-plugin defer and block)
• Theme auto-updates (on or off, with per-theme defer and block)
• Translation auto-updates (on or off)
• Update check frequency: 6, 12, 24, or 48 hours
• Zero performance impact: all checks run in the background through a dedicated cron event. Page load times are unaffected.

You can configure this once on your main site and reuse the same file-based configuration across every site you manage.

👑 ADMINISTRATOR OVERSIGHT AND ACCESS CONTROL

Most WordPress security plugins assume the administrator is the threat. Fuerte-WP assumes the administrator is trusted but busy, and that you want to protect them from themselves and from each other.

• Super User Access: designate one or more super users by email. Super users bypass every restriction and are the only accounts that can change Fuerte-WP settings or disable the plugin.
• Restrict Other Administrators: prevent non-super administrators from installing unstable plugins, editing theme and plugin code, changing permalinks, or touching sensitive WordPress settings.
• Hide and Block Admin Menus: a searchable, discovery-driven interface lists every registered admin menu, submenu, and admin-bar node on your site. You select what to hide. Hide and block are unified: hiding a page also blocks direct URL access to it. A manual textarea stays available as a precision escape hatch for slugs the discovery scan does not surface.
• Smart Block Targeting: the block engine avoids over-blocking. Shared scripts like edit.php (Posts, Pages, and custom post types) and index.php are hide-only so you never strand a non-super user on a blank screen. Single-purpose core scripts (themes.php, tools.php, plugins.php) block by $pagenow. Plugin pages block by their ?page= query argument.
• Account Protection: protect your own admin account from being modified or deleted by another administrator.

🔒 LOGIN SECURITY (OPTIONAL, ON BY DEFAULT)

Read the full description on the official page →