FlatBB’s core already escapes output, verifies CSRF on every POST, ships a Content Security Policy, and re-asks the admin password on high-risk pages. Guard is the free operational-security plugin that watches what happens on top of that stack.
Plugin page: https://www.flatbb.com/market/guard
What Guard adds
Two-factor sign-in (Guard 1.1+)
Authenticator apps (TOTP), eight recovery codes, secrets encrypted with the site secret. Optional rule: staff must use 2FA. Available for staff only or for every member.
Admin Security toolkit
-
Check-up — HTTPS, CSP mode, real IP behind proxies,
data/not web-accessible, no PHP inuploads/, debug flags, site secret, PHP version, scheduled jobs, staff accounts, registration, new-address staff sign-ins, CSP reports - Admin log — searchable core action log (action, target, detail, IP)
- Sign-ins — per account/address history; new addresses in the last 7 days marked; Sign out everywhere without changing the password
- Bans — IP or CIDR, permanent or timed; admins never blocked
- Warnings notify staff about script-like text in posts/profiles (content is already escaped by the core)
-
Probes record scanner paths (
wp-admin,.env,.git, backups, plugin PHP…), one-click ban, ignore the server probing itself
Alerts
Sign-in from a never-seen address in-app notification (and optional email), for staff by default or for everyone.
Why this matters
A lightweight PHP forum on shared hosting still gets scanned. Guard turns “secure defaults” into day-to-day ops: see whos knocking, ban ranges, force 2FA for mods, and keep an audit trail — without buying a separate WAF product.
Get it
- FlatBB: https://www.flatbb.com/
- Guard: https://www.flatbb.com/market/guard
- Install: Admin → Market → search
guard
Requires FlatBB 0.1.26+ (newer features need later cores; Probes needs 0.1.58+).
Disclosure: I’m the author of FlatBB.
Top comments (0)