• Get application security done the right way! Detect, Protect, Monitor, Accelerate, and more…
  • Securing a site is always challenging, and it is every site owner’s responsibility.

    There are thousands of online vulnerabilities, and it’s difficult to ensure everything on site is hardened and secured, manually.

    A hacked website report by SUCURI indicates 94% of WordPress sites were infected.

    Is your WordPress site secure?

    One of the quickest ways to protect the WordPress site is to use WAF (Web Application Firewall).

    WAF add multiple security elements on the fly and protect from known & unknown online threats. There are two types of WAF implementation.

    1. Cloud-based – cloud-based security provider protects a site. This sits out of your hosting infrastructure at the network edge.
    2. Hosted – usually, a plugin that is installed on WordPress and requests are examined, protected, blocked after reaching requests to the webserver.

    Many of you’ve asked which one is better.

    Well, it depends on the approach, but I prefer cloud-based. By using cloud-based security provider, all bad traffics are blocked at their network, and you receive only legitimate requests.

    Let’s see the following some of the best web application firewalls we have for WordPress.


    SUCURI WAF provides dual benefits – Protection & Performance Optimization.

    SUCURI offers cloud-based WAF to stop attackers and hackers with their own custom rules instantly.

    You don’t have to install anything on your server, all it requires is a simple DNS change, so all traffic is getting processed through SUCURI. Don’t worry about DNS changes; they can help you with that.

    Let’s take a look at some of the benefits.


    • DDoS attacks prevention
    • Zero-day exploit prevention
    • Malware & hack protection
    • Brute force mitigation
    • Bad bot blocking
    • OWASP top 10 protection


    • HTTP/2 support
    • Global anycast network for low-latency CDN
    • Smart caching
    • Gzip compression

    SUCURI plan starts from $9.99 per month.


    Wordfence is one of the most popular all-in-one security plugins. It got more than 2 million active installed.

    Under the premium plan, you get to enjoy firewall protection with real-time updates for rules, malware signature, and malicious IP.

    You also get to enjoy other features like:

    • Two-factor authentication
    • Spam filter
    • Scheduled security scan
    • Brute force attacks prevention

    Wordfence costs $99 per year.


    Malcare is an all-in-one premium security plugin that offers the following along with a powerful website firewall.

    • Scan site for more than 100 malware. The scan is done remotely, so it doesn’t overload your WP server.
    • Remove malicious codes in one-click if/when found
    • Harden WordPress for better security
    • Manage multiple WP sites (useful if you have multiple sites)
    • Staging site and backup
    • Uptime monitoring

    Malcare offers 24X7 support.


    One of the robust web firewall, process ~3 million requests every second by Cloudflare offers WordPress WAF under PRO plan.

    Cloudflare is known for providing performance optimization, CDN, and security. Their WAF doesn’t slow down the site; it adds less than 1ms of latency to the page load time.

    Cloudflare WAF protects from OWASP top 10, application-specific, and known vulnerabilities.

    And it got WordPress specific rules.

    You can get it started with Cloudflare in less than 5 minutes. Optionally, you may also consider their plugin for a quick setup.

    Cloudflare PRO plan costs $20 per month.


    WAF and CDN are tightly integrated with StackPath, something similar to Cloudflare.

    They provide all the standard security protection for layer 7 (application layer).


    • Bot protection
    • User-defined rules
    • Dynamic filtering
    • Scraping prevention
    • Enterprise-level rules

    Each plan also includes DDoS protection.

    I like StackPath EdgeRule, where you can do many things on the fly without restarting the web server or installing anything within your WordPress site.

    Some of the possibilities are:

    • Injecting HTTP headers
    • Blocking requests by country
    • Redirection for bot requests, by country, by the referrer
    • Custom rule

    StackPath integrates well with W3 Total Cache, and pricing starts from $20 per month for five sites, and they offer a 15-days free trial.


    NinjaFirewall sits in front of WordPress and leverages a powerful filter engine called Sensei.

    Along with the firewall, it also provides event notification, centralized logging, malware scanning, and supports multi-site.

    A single domain NinjaFirewall license cost $34.90 per year.


    If you are hosting on AWS, then you may want to take advantage of AWS WAF.

    Recently they’ve released a template that can be used to mitigate OWASP top 10 vulnerabilities. However, if you need more than that, then you may explore Alert’s Logic managed rules for WordPress.

    Shield Security

    Shield is another WordPress security plugin that comes with a firewall module inbuilt.

    Shield scan GET & POST requests and kill if it violates the policies. It gives you an option of how you want to respond to blocked responses.

    • Die
    • Die with a custom message
    • Return to home page
    • Return 404

    Under firewall blocking, it checks the following.

    • Directory transversals
    • SQL queries
    • WordPress terms
    • Field truncation
    • PHP code
    • Cooking value

    Shield also got other features like login protection, user session management, powerful spam protection, hack protection, auto core updates, auto lockdown, audit trail.


    I hope the above list helps you to choose the web application firewalls for your WordPress site.

    WAF is essential for any website to keep it safe from a hacker, spam, an attacker. And, if you don’t want to get into these or don’t have to time to do, then you can always consider premium WordPress managed hosting providers who take care of everything (hosting, security, CDN, etc.)