Skip to content
Forum Fortress
Get started free

Flarum 1.8 and 2 installation

Forum Fortress provides one Composer extension for both Flarum 1.8 and Flarum 2. Once enabled, it automatically selects the correct administration bundle, registers the forum with Forum Fortress, and begins checking supported activity.

The current Forum Fortress extension version is 1.4.0.

Forum Fortress returns either ALLOW or BLOCK. An allowed action continues normally; a blocked action is rejected before Flarum completes it.

Before you start

Make sure you have:

  • Flarum 1.8.x, or Flarum 2.0.0-rc.5 or newer within the Flarum 2 series. The current plugin release is tested on Flarum 1.8.19 and through Flarum 2.0.0-rc.8.
  • PHP 8.0 or newer, plus any newer PHP requirement imposed by your Flarum release
  • Composer access in the Flarum installation directory
  • Flarum administrator access
  • outbound HTTPS access from the forum server

If your host manages Composer for you, ask it to install the package forumfortress/flarum.

Privacy and outbound access

Forum Fortress sends supported forum activity to its analysis service. Checks can include submitted text, links, IP address, email address, username, account details, and basic request metadata.

If your server uses an outbound firewall, allow HTTPS traffic on port 443 to hosts ending in:

*.ffapi.net

Read Privacy and network access before enabling the extension on a live community.

Install with Composer

Run these commands from the Flarum root, where composer.json and the flarum executable are located:

composer require forumfortress/flarum:"^1.4"
php flarum extension:enable forumfortress-flarum
php flarum cache:clear

The supported Flarum and Guzzle packages are already present in standard Flarum 1.8 and 2 installations. This scoped command installs Forum Fortress without changing their locked versions. Do not add Composer's -W or --with-all-dependencies option.

You can also enable the extension from Administration > Extensions after Composer finishes.

Install from Flarum Extension Manager

Or search in Extension Manager for Forum Fortress.

Forum Fortress can also be installed from Flarum's native Extension Manager. This is the recommended route when your host exposes the manager:

  1. Open Administration > Extensions.
  2. Choose Find more extensions or Install extension.
  3. Search for Forum Fortress and select the official forumfortress/flarum package from Packagist.
  4. Select Install, wait for Composer to finish, then select Enable.
  5. Open the Forum Fortress administration page and follow First connection.

If the Extension Manager is unavailable on your hosting plan, use the scoped Composer command above instead.

After enabling, use Refresh, Connection test, and Synchronize now from the administration page to confirm that the extension can reach Forum Fortress and has stored its site identity. A temporary bootstrap warning alone does not mean that Flarum failed to install the extension.

First connection

  1. Open Administration > Extensions > Forum Fortress.
  2. Leave Site API key blank for a new installation. Forum Fortress bootstraps the site automatically.
  3. Keep Enable Forum Fortress protection enabled.
  4. Select Refresh to load the current site, plan, endpoint, and usage details.
  5. Select Connection test and wait for the success message.
  6. Select Open Forum Fortress to open the portal on this forum. Use Register site in the extension when you want to associate it with an account; this is optional for initial protection.

If details initially say Refresh to view, select Refresh, Connection test, or Synchronize now. These actions retrieve the latest status from the service.

You can install without a portal account. See Your account and forums to connect the forum to an account later.

Forum Fortress control panel in Flarum

Forum Fortress administration after a successful Flarum connection test.

Setting Recommendation
Enable Forum Fortress protection Enabled
Allow requests when Forum Fortress is unavailable Enabled for most forums, so a service or network interruption does not lock users out
Site registration email Leave blank unless you want to use Register Site from the extension
Request timeout Keep the default unless support asks you to change it
API region Global unless you require UK-, EU-, or US-only check processing
Allow global emergency fallback Disabled when strict regional processing is required
Site API key Leave blank on first use; automatic bootstrap stores the issued key

Choose an API region

Use Global unless you need regional processing. Select United Kingdom only, European Union only, or United States only to keep live checks and decisions in that regional API service.

Allow global emergency fallback is off by default. If you enable it and the selected regional service remains unavailable after a retry, Forum Fortress may send the check through the global network. Processing may then occur outside the selected region. Leave it disabled when strict regional processing is required.

This setting applies only to live spam checks. Bootstrap, portal access and account management continue through the Forum Fortress control system in the United Kingdom.

Scheduler

Forum Fortress uses Flarum's scheduler for heartbeat, endpoint maintenance, and moderation synchronization. It is strongly recommended (and required for production reliability) to keep Flarum's scheduler running every minute:

* * * * * cd /path/to/flarum && php flarum schedule:run >> /dev/null 2>&1

Replace /path/to/flarum with the directory containing the flarum executable.

Without this cron, synchronization and moderation queue updates can fall behind.

Manual synchronization is also available:

php flarum forumfortress:sync
# After fixing a connection problem, bypass the automatic retry backoff:
php flarum forumfortress:sync --force
php flarum forumfortress:moderation-sync

What is protected

The extension checks the same supported activity on Flarum 1.8 and 2:

  • new registrations
  • new and edited discussions
  • new and edited replies
  • supported profile changes, including signatures

The extension does not send login events. This integration does not handle or send Flarum contact forms.

Blocked registrations are rejected before the account is stored. Blocked discussions and replies are rejected before the content is published. Supported moderation actions synchronize with Flarum's normal Approval flow and the Forum Fortress portal.

Updating

From Administration > Extensions, use the Extension Manager's available update for Forum Fortress, review the Composer changes, and clear Flarum's cache if prompted.

From the Flarum root:

composer update forumfortress/flarum
php flarum migrate
php flarum cache:clear

Keep the update scoped to forumfortress/flarum; do not add -W or --with-all-dependencies, which permits Composer to update packages already supplied by Flarum.

Open Forum Fortress in Administration and run Connection test after an update. Then use Refresh and confirm that the extension is enabled, the current site and endpoint are shown, and synchronization is current.

Disabling or removing

To disable the extension but keep it installed:

php flarum extension:disable forumfortress-flarum
php flarum cache:clear

To remove it from the command line, run the native purge first so Forum Fortress can remove the remote forum and apply the account-retention rules:

php flarum migrate:reset --extension=forumfortress-flarum
composer remove forumfortress/flarum
php flarum cache:clear

When using Extension Manager, choose Disconnect and remove site in the Forum Fortress maintenance panel before removal. If the extension is already disabled, re-enable it first because disabled extensions cannot display their maintenance panel or register removal listeners. The current release also handles Extension Manager's removal event when the extension is still loaded. A manual disconnect pauses automatic bootstrap until the extension is explicitly re-enabled or reinstalled.

Do not remove the Composer package first if you still need the Forum Fortress maintenance panel. Removing the package does not remove unrelated Flarum users, discussions, or posts.

Troubleshooting

Symptom What to check
Composer cannot find the package Confirm the package name is forumfortress/flarum, then run composer clear-cache and retry.
Forum Fortress is not found in Extension Manager Search the exact name Forum Fortress, confirm the host allows Composer installs, and use composer require forumfortress/flarum:"^1.4" if the manager is unavailable.
Extension Manager installed it but it is not active Open Administration > Extensions, select Enable, clear the Flarum cache, and reopen the Forum Fortress administration page.
Extension will not enable Confirm Flarum is 1.8.x or Flarum 2.0 RC5 or newer, and that PHP meets your Flarum release's requirement.
Connection test fails Check outbound HTTPS, DNS, firewall, WAF, proxy, and host-level egress rules.
Status details do not appear Select Refresh or Synchronize now, then check that the scheduler is running and the extension is enabled.
Open Forum Fortress does not open Allow popups for the Flarum administration page and try again.
Legitimate activity is blocked Review the decision in the portal, then include its decision reference when contacting support.
Synchronization is delayed Confirm Flarum's scheduler runs every minute and try Synchronize now.

For more help, check the general troubleshooting guide or use Forum Fortress support. Include your forum URL, Flarum version, extension version, approximate time, and any decision reference or error message.

Licence

The extension is free and open-source software under GPL-2.0-or-later. The hosted service is separate and governed by its service terms. See Plugin licensing.