9 WordPress WAF to Prevent Security Threats

Securing site is always challenging.

There are thousands of
online vulnerabilities , and it’s difficult to ensure
everything on site is hardened and secured, manually.

A hacked website report by SUCURI indicates ~74% of
WordPress sites were infected

Is your WordPress
site secure ?

One of the quickest ways to protect WordPress site is to use
WAF (Web Application Firewall).

WAF add multiple security elements on the fly and protect from
known & unknown online threats. There are two types of WAF

  1. Cloud-based – cloud-based security provider
    protects a site. This sits out of your hosting
    infrastructure, at the network edge.
  2. Hosted – usually, a plugin which is
    installed on WordPress and requests are examined, protected,
    blocked after reaching requests to the web server.

Many of you’ve asked which one is better.

Well, it depends on the approach, but I prefer cloud-based. By
using cloud-based security provider, all bad traffics are
blocked at their network, and you receive only genuine

Let’s see what the best web application firewall we have for
WordPress are.

1. Wordfence

Wordfence is one of the most popular all-in-one
security plugins. It got more than 2 millions active installed.

Under the premium plan, you get to enjoy firewall protection
with real-time updates for rules, malware signature and
malicious IP.

You also get to enjoy other features like:

  • Two-factor authentication
  • Spam filter
  • Scheduled security scan
  • Brute force attacks prevention

Wordfence cost $99 per year.


SUCURI WAF  provides
dual benefits – Protection & Performance Optimization.

SUCURI offers cloud-based WAF to stop attacker and hacker with
their own custom rules instantly.

You don’t have to install anything on your server, all it
requires is a simple DNS change, so all traffic is getting
processed through SUCURI. Don’t worry about DNS changes; they
can help you with that.

Let’s take a look at some of the benefits.


  • DDoS attacks prevention
  • Zero-day exploit prevention
  • Malware & hack protection
  • Brute force mitigation
  • Bad bot blocking
  • OWASP top 10 protection


  • HTTP/2 support
  • Global anycast network for low-latency CDN
  • Smart caching
  • Gzip compression

SUCURI plan starts from
$9.99 per month.

3. Cloudflare

One of the robust web firewall, process ~3 million
requests every second by Cloudflare offers WordPress WAF under
PRO plan.

Cloudflare is known for providing performance optimization,
CDN, and security. Their WAF doesn’t slow down the site; it
adds less than 1ms of latency to the page load
time .

Cloudflare WAF protects from OWASP top 10,
application specific and known vulnerabilities.

And it got WordPress specific rules.

You can get it
started with Cloudflare in less than 5 minutes.
Optionally, you may also consider their plugin for quick setup.

Cloudflare PRO plan costs $20 per month.

4. StackPath

WAF and CDN are tightly integrated with StackPath , something similar to

They provide all the standard security protection for layer 7
(application layer).


  • Bot protection
  • User-defined rules
  • Dynamic filtering
  • Scraping prevention
  • Enterprise level rules

Each plan also includes  DDoS

I like StackPath EdgeRule where you can do many things on the
fly without restarting web server or installing anything within
your WordPress site.

Some of the possibilities are:

  • Injecting HTTP headers
  • Blocking requests by country
  • Redirection for bot requests, by country, by referrer
  • Custom rule

StackPath integrate well with W3 Total Cache and pricing starts
from $20 per month for five sites, and they offer 15-days free

5. NinjaFirewall

NinjaFirewall sits in front
of WordPress and leverages powerful filter engine called

Along with firewall, it also provides event notification,
centralized logging, malware scanning and supports multi-site.

A single domain NinjaFirewall license cost $34.90 per year.

6. Incapsula

Incapsula by Imperva got WAF
included in PRO plan starting at $59 per month.

It’s PCI certified and protect from all type of application
security threats. WAF policies are regularly updated to keep
the site safe from all latest vulnerabilities.


If you are hosting on AWS , then you
may want to take advantage of AWS WAF .

Recently they’ve released a template which can be used
to mitigate OWASP top 10 vulnerabilities. However, if you need
more than that, then you may explore Alert’s Logic managed rules for
WordPress .

8. Shield Security

Shield is another WordPress
security plugin which comes with firewall module inbuilt.

Shield scan GET & POST requests
and kill if it violates the policies. It gives you an option
how you want to respond to blocked responses.

  • Die
  • Die with custom message
  • Return to home page
  • Return 404

Under firewall blocking, it checks the following.

  • Directory transversals
  • SQL queries
  • WordPress terms
  • Field truncation
  • PHP code
  • Cooking value

Shield also got other features like login protection, user
session management, powerful spam protection, hack protection,
auto core updates, auto lock down, audit trail.

It’s FREE!

9. SiteLock

A cloud-based comprehensive solution for website in performance
acceleration and security. Something similar to Cloudflare,
Incapsula, SUCURI.

SiteLock’s WAF called TrueShield is simple to setup, and
you can get it started in less than 5 minutes.

I hope the above list helps you to choose the web application
firewalls for your WordPress site.

WAF is essential for any website to keep it safe from a hacker,
spam, an attacker.

and if you don’t want to get into these or don’t have to time
to do then you can always consider premium
WordPress managed hosting providers who take care of
everything (hosting, security, CDN, etc.)


Leave a Reply

%d bloggers like this: