Discourse installation

Forum Fortress for Discourse checks supported registrations, topics and replies in categories without read restrictions, eligible content edits, and profile changes before Discourse accepts them. The current stable release is 1.0.2. The declared minimum is Discourse 2026.8.0; the plugin is tested on the official v2026.8.0 and v2026.9.0-latest tags.

Before you start

Make sure you have:

• a current standard self-hosted Discourse Docker installation
• SSH and root or sudo access to the Discourse host
• a recent site backup
• Discourse administrator access
• outbound HTTPS access to hosts ending in *.ffapi.net

Install on a test or backed-up site first. Hosted Discourse plans that do not permit arbitrary third-party plugins require approval from the hosting provider.

Install on standard Docker Discourse

Open /var/discourse/containers/app.yml and find the existing hooks and after_code block. Keep the docker_manager line and add the Forum Fortress clone beneath it:

hooks:
  after_code:
    - exec:
        cd: $home/plugins
        cmd:
          - git clone https://github.com/discourse/docker_manager.git
          - git clone https://github.com/Forum-Fortress/discourse-forum-fortress.git

If your existing clone lines begin with sudo -E -u discourse, use the same prefix for the Forum Fortress line.

Rebuild Discourse:

cd /var/discourse
./launcher rebuild app

The rebuild can take several minutes and briefly interrupts the forum. When it completes, sign in to Discourse as an administrator.

First connection

1. Open Admin → Plugins → Forum Fortress → Dashboard.
2. Enable Forum Fortress if it is not already enabled.
3. Leave the API key blank for a new installation; the first connection test can bootstrap the site automatically.
4. Keep Allow requests when Forum Fortress is unavailable enabled initially.
5. Select Test connection. Initial bootstrap may take up to 30 seconds.
6. Select Open Forum Fortress to open the portal on this forum. If you want to associate it with an account, use the plugin's registration control and follow the verification steps shown.

The API key remains in Discourse's server-side site settings and is not sent to ordinary browser clients.

What is protected

• new ordinary-user registrations before acceptance; these checks include identity data such as username, email, display name and registration IP when Discourse provides it
• new topics and replies in categories without read restrictions before saving
• reply edits and first-post body or title edits when the current and intended categories have no read restrictions
• username, display-name, bio, and website changes where Discourse exposes a supported pre-save path; profile checks include account identity fields and the supported fields changed in that submission

Private messages and content in access-restricted categories are not sent to Forum Fortress. A content edit combined with a category move is not checked when either the current category or destination is restricted. If the plugin cannot safely determine the category, it skips the external content check and leaves Discourse’s own permissions and validation in control. Category-only moves do not trigger a historical or new content scan.

“Without read restrictions” refers specifically to the category’s Discourse access setting. It does not mean anonymous visitors can read the content: a category on a forum with login_required may still be eligible for the configured check. Staff, system, bot, and staged-user activity is skipped. Discourse has no native user-signature feature, so there is no signature check.

Failure behaviour

Checks run synchronously before the protected Discourse save completes. The normal total timeout defaults to 5 seconds and is configurable from 1 to 30 seconds; each regional endpoint attempt is capped at 1 second within that budget. First-time bootstrap has a separate 30-second maximum. With fail-open enabled by default, network, timeout, malformed-response or service failures let the Discourse action continue so an outage does not lock the community. Administrators can choose fail-closed behaviour, which returns a temporary-unavailable validation error.

An allow response continues, block returns a validation error, and the recognised legacy review response continues without entering Discourse’s review queue. The stable plugin does not synchronize the Forum Fortress and Discourse moderation queues.

Forum Fortress is an external service. Before enabling it, review Privacy and network access and the Privacy Policy.

Optional repeat-spammer suspension

Compatible plugin versions expose Repeat offender action in the local Discourse site settings. It is off by default, including for existing sites after upgrading. When enabled, the forum may impose a reversible seven-day suspension after two distinct service-confirmed blocks scoring above 80 within 24 hours. This applies only to new, low-post-count members; staff, system users and guests are excluded.

Older service responses continue blocking spam normally but do not activate account enforcement. Permanent deletion and automatic content purging are not offered by this initial option.

Updating

Back up the site, then rebuild Discourse. The standard rebuild fetches the current plugin source:

cd /var/discourse
./launcher rebuild app

After an update, open the Forum Fortress dashboard and run Test connection.

Removing the plugin

Run the cleanup task before removing the clone line so the authenticated Forum Fortress site can be deprovisioned:

cd /var/discourse
./launcher enter app
cd /var/www/discourse
RAILS_ENV=production bundle exec rake forum_fortress:uninstall
exit

Then remove the Forum Fortress git clone line from /var/discourse/containers/app.yml and rebuild:

cd /var/discourse
./launcher rebuild app

Disabling the plugin without running the cleanup task is reversible and does not disconnect the site.

Troubleshooting

Symptom	What to check
Rebuild cannot clone the plugin	Confirm the host can reach github.com over HTTPS and that the repository URL is exact.
Plugin does not appear in Admin	Confirm the clone destination is discourse-forum-fortress, then inspect the rebuild output for plugin errors.
Connection test times out	Allow up to 30 seconds for first bootstrap; check DNS, outbound HTTPS, proxy, and firewall rules for *.ffapi.net.
Open Forum Fortress does not open	Allow popups and redirects from the Discourse admin page, then try again.
Legitimate activity is blocked	Review the decision in the Forum Fortress portal and include its decision reference when contacting support.

For more help, use the general troubleshooting guide or Forum Fortress support.

Licence

The plugin is free and open-source software under GPL-2.0-or-later. The hosted service is separate and governed by its service terms. See Plugin licensing.