WordPress firewalls compared: plugin, DNS-level or host, and how to choose

A firewall reads each request sent to your site and refuses the ones that match its rules: an address known for attacks, a web address with code tucked into it, the hundredth wrong password in a row. Every product on this page does that. What separates them is where the firewall sits, because a firewall can only act on a request at the point where it sees it.

This page is about firewalls alone. Most all-round security plugins include one beside their scanning and login protection, and WordPress security plugins compared looks at those as a whole.

The three places a firewall can sit

Choose the place before the product.

Inside WordPress, as a plugin

The firewall is code that runs on your own server. A request travels to the server, the server starts PHP, and the plugin then decides whether to let the request through.

What it can stop: requests that try to exploit WordPress, a plugin or a theme, and repeated login attempts. Because it runs inside WordPress, it can know things an outside firewall cannot, such as whether the visitor is logged in.
What it cannot stop: the load. Every request has already reached your server by the time the plugin sees it, so a flood of traffic still lands on your hosting.
What it costs to set up: you install a plugin. Nothing outside the site changes.

In front of the site, at the DNS level

Your domain's DNS records are changed so that visitors reach the firewall company's network first. That network passes on the requests it accepts and drops the rest. Cloudflare and Sucuri's firewall work this way.

What it can stop: attacks and floods of traffic, before either reaches your server. Visitors are no longer shown your server's own address.
What it cannot stop: anything that depends on knowing what goes on inside WordPress. Someone who learns the server's own address can also go around it, unless the server is set to accept traffic only from the firewall. Cloudflare and Sucuri both document how to do that.
What it costs to set up: a DNS change, which Sucuri says can take up to 48 hours to reach everyone. From then on your visitors' traffic passes through another company, forms and logins included, and the site depends on that company's network.

On the server, run by your host

Many hosts run a web application firewall at the web server, where it filters requests before WordPress handles them. WordPress's own documentation names ModSecurity as the most popular open-source one.

What it can stop: common attack patterns, for every site on the server.
What it cannot stop: it is the host's to configure. You rarely see its rules or change them, and a rule can mistake an ordinary action, such as saving a post that contains code, for an attack.
What it costs to set up: nothing. Ask the host whether one is running and what it covers.

What no firewall does

A firewall in any of these places filters requests and does nothing else. It does not install updates, and it does not clean a site that is already infected. That is routine work, and it is what our WordPress security service does through a care plan: weekly updates, security scanning and daily offsite backups.

The options side by side

Option	Where it sits	Free version includes	Needs the paid version	Setup
Wordfence	Plugin	Firewall rules, received 30 days after paying customers; login attempt limits; blocking by address or user agent	Rules as they are released, a real-time blocklist of attacking addresses, country blocking	Install the plugin
NinjaFirewall (WP Edition)	Plugin, run before WordPress loads	Firewall rules updated as often as hourly, brute force protection for the login page, a live log	Access control by address, country, role or URL; rate limiting	Install the plugin. Linux and other Unix-like servers only
Shield Security	Plugin	Firewall rules, bot blocking on forms, automatic blocking of addresses, login attempt limits	Rate limiting, a malware scanner, vulnerability scanning	Install the plugin
BBQ Firewall	Plugin	The whole firewall, with no settings	Settings, blocking of single addresses, email alerts	Install the plugin. Nothing to configure
Cloudflare	DNS level	The Free Managed Ruleset, custom rules, one rate limiting rule, DDoS protection	The Cloudflare Managed Ruleset and the OWASP Core Ruleset	Move the domain's nameservers to Cloudflare
Sucuri's firewall	DNS level	Nothing. It is a paid service	Everything	Change the domain's A record, or its nameservers

The options one by one

Wordfence

The firewall is one part of the Wordfence Security plugin, which also scans for malware. It runs inside WordPress, so its rules can take into account who is logged in. It limits login attempts, blocks by address or user agent, and can slow down or block crawlers that ask for too much. The free version receives new firewall rules 30 days after paying customers do. Wordfence suits a site that wants its firewall and its scanner in one plugin.

NinjaFirewall (WP Edition)

NinjaFirewall installs like a plugin but sees each request before WordPress and its other plugins load. It therefore covers every PHP script in the site's folders, including ones that are not part of WordPress. It needs a Linux or other Unix-like server, needs no root access, and its listing says it works on shared hosting.

Everything is filtered on your own server, so no traffic passes through another company. NinjaFirewall suits an owner who wants a firewall on its own, with detailed settings.

Shield Security

Shield is an all-round security plugin whose firewall leans on recognizing bots. It keeps a score for each visitor. Failed logins, requests the firewall blocked and failed bot checks all add to it, and an address that passes the threshold is blocked. Its bot check covers the login, registration, lost password and comment forms without showing visitors a puzzle.

If Shield locks you out, creating a file named forceoff in the plugin's folder and then loading any page switches it off. Shield suits an owner who wants the blocking to happen without rules to look after.

BBQ Firewall

BBQ does one thing. It checks each request against a list of patterns known from attacks, such as eval(, base64_ and requests of excessive length, and refuses the ones that match. The free version has no settings. It makes no change to .htaccess and connects to no outside service.

BBQ suits a site that wants a plain filter with nothing to maintain. Its author says it can run beside a full security plugin such as Wordfence, on the grounds that the two protect against different threats.

Cloudflare

In the usual setup you move your domain's nameservers to Cloudflare, and traffic for the records you set to be proxied passes through its network on the way to your server.

The free plan includes the Free Managed Ruleset, which Cloudflare describes as protection against high-impact and widely exploited vulnerabilities, along with custom rules you write yourself, one rate limiting rule, and DDoS protection, which is on every plan. The Cloudflare Managed Ruleset and the OWASP Core Ruleset cover more and need the Pro plan or higher.

Cloudflare's WordPress plugin is not the firewall. It connects the site to your Cloudflare account, applies Cloudflare's recommended settings and lets you clear Cloudflare's cache from the dashboard. The firewall itself runs on Cloudflare's network and is set up in your Cloudflare account. Cloudflare suits a site that wants floods and common attacks stopped away from its server, and whose owner is able to move the nameservers.

Sucuri's firewall

Sucuri's firewall is a paid service with no free version. It is not part of the free Sucuri Security plugin, and it works without that plugin. You switch it on by pointing the domain's A record at an address Sucuri gives you, or by using Sucuri's nameservers. Sucuri says the site is not fully protected until the DNS change has reached everyone.

It suits an owner who wants the DNS-level kind and would rather change one DNS record than move the nameservers.

Which one to use when

If your host already runs a firewall, you have the third kind. Add another for a reason you can name: floods of traffic, a login page under attack, or rules the host's firewall lacks.
If floods of requests slow the site down or take it offline, a plugin will not help, because the requests still reach the server. Use a DNS-level firewall.
If you cannot change the domain's DNS, or do not want your visitors' traffic to pass through another company, use a plugin.
If you already run a security plugin that has a firewall, that is your plugin firewall. Do not add a second one that filters the same requests. The two block the same visitor twice, fill two logs and make it hard to tell which of them refused a request.
If you want a firewall and nothing else, BBQ has no settings and NinjaFirewall has many.
If you want two layers, pair one DNS-level firewall with one plugin. They act at different points. Check that the plugin is set to read the visitor's real address and not the address of the firewall in front of it.

Before you switch one on

Write down how to go back. For a plugin, going back means switching it off. For a DNS-level firewall, it means the old DNS records, so copy them before you change anything.

If the firewall has a list of allowed addresses, add your own IP address to it. Not every free version has one.

Then check what your visitors do. Load the site, log in, save a post and send a form. On a store, go through to the checkout. A firewall that refuses one of these is refusing your customers too.

A firewall that refuses its own owner shows a 403. How to fix the 403 Forbidden error shows how to tell which firewall it was, switch a plugin off from the file manager and ask a host to lift a block.