Shield mounts your site code read-only at the Linux kernel level. Fortress adds nginx WAF, PHP hardening, real-time upload scanner and network egress control. No cosmetic chmod — real, kernel-enforced protection.
The docroot is mounted read-only at the kernel VFS level via Docker :ro bind mount. Even a compromised root inside the container cannot write.
Docker bind mount read-only at the VFS level. No chmod, chattr or PHP exploit bypasses it. Structural protection, not cosmetic.
WordPress, WooCommerce, Joomla, PrestaShop, Magento, Drupal, Laravel and Custom. Each profile knows which folders to keep writable (uploads, cache, sessions).
Only the truly necessary folders (wp-content/uploads, cache, logs) stay writable. Everything else — core, plugins, themes — is immutable.
On top of the kernel mount, nginx returns 403 for any .php / .phtml / .phar / .pl / .cgi / .sh / .py uploaded into writable zones. Defense in depth.
The healthcheck cron verifies from inside the container that the docroot is still read-only. Instantly detects any mount drift.
Button in the UI or shield-enable CLI command. Can be activated at container creation. Disabled hot without data loss.
nginx WAF generated per rule, PHP hardening, real-time upload scanner and network egress control. Activate / deactivate layer by layer.
SQLi, LFI, XSS, RFI, scanners, sensitive files, PHP exec in upload zones, xmlrpc, rate-limit. Generated from the store, injected at reconfigure-domain time.
systemd service per domain. MIME check (libmagic), PHP pattern, ZipSlip, SVG, PDF, Shannon entropy, Pillow image regeneration. 7 individual checks.
Surgical disable_functions (exec, system, passthru, ...) + open_basedir + extra-disable / extra-allow per domain. Optional strict mode for risky zones.
3 modes: permissive (default), standard (block bind-shell to non-whitelisted IPs), strict (internal DNS + strict IP allowlist). Prevents data exfiltration.
Block xmlrpc.php, block REST API if unused. Mu-plugin dropped into wp-content/mu-plugins/ for inline protections.
The "Test WAF" button runs a real curl with SQLi payload against the domain and checks that nginx returns 403. Continuous validation, not declarative.
Live demo: we attempt a malicious PHP upload on a WordPress, we watch Shield + Fortress block it. No commitment.
