WordPress is the foundation of numerous websites globally, making it one of the most popular but also one of the most vulnerable content management systems online. A Web Application Firewall (WAF) is one of the most useful solutions for security purposes since it acts as a barrier between the internet and your WordPress website.
This guide outlines how a WAF can help WordPress websites, describes the main categories of WordPress WAFs, and brings specific step-by-step instructions on how to configure it, regardless of what plugin or WAF provider is used.
Why Do WordPress Sites Need a WAF?
Most attacks against WordPress sites are automated; therefore, a single weak point, such as the use of an outdated plugin or a simple password, bears serious consequences. A properly set-up WAF plays the role of a gatekeeper by blocking known malicious IPs, preventing bot attacks, stopping brute-force logins, guarding against SQL injection and XSS, limiting the amount of threats coming to the server, and filtering out suspicious traffic before it reaches the WordPress installation.
It is worth noting that two particular endpoints, /wp-login.php and /wp-admin/, are often targets of various cyber attacks, such as bots attempting brute force attacks, credential stuffing, and username enumeration. However, even failed attempts to breach your website’s security can affect its performance through consumption of server resources; thus, deploying a worm is a fantastic way to block those attacks at the outset.
Useful Read: How to Protect a Website with a Web Application Firewall?
Two Types of WordPress WAF
a) Cloud-based / Network-level WAF
The first type is a cloud or network-level WAF, when all incoming traffic is sent through the provider’s server before reaching your hosting company (for example, Cloudflare or Sucuri).
The advantages of this type of WAF are that it protects your server from malicious traffic even before it gets there, is often coupled with a CDN, and does not utilize server resources. However, the downside is that in this case a DNS change is required for routing traffic through the provider.
b) Application-level / Plugin-based WAF
The second type is an application WAF or plugin-based WAF that serves as a plugin for WordPress (for example, Wordfence or Sucuri’s WordPress plugin). It is used within WordPress to filter out both the attack patterns and the malicious IP addresses in real time.
The benefit is it does not require any modification of DNS records and offers substantial visibility of the activities happening on WordPress (including user behavior, changes in files, and attempts to log in to a platform). However, the downside is that the traffic is first received by your server before being filtered, which means a potential increase in load times for every webpage (while some plug-ins may have a significant impact on the loading time, it may be reasonable to check them out in advance).
Step-by-Step: Setting Up a WAF for WordPress
Step 1: Choose your WAF type and provider
- Decide on the type of WAF you want as well as the company you will work with.
- Select either cloud-based WAF, plugin-based WAF, or both based on your budget.
Step 2: Activate the WAF
- Cloud-based: Contact the WAF provider and enter their DNS information at your domain host, or follow any instructions.
- Plugin-based: Download the WAF plug-in on your WordPress site and activate it (you can do it by going to the Plugins section on WordPress and clicking Add New).
Step 3: Activate the core/managed protection rules
- Most web application firewalls come with default (“core” or “managed”) rules that safeguard against common attacks such as SQL injection or cross-site scripting (XSS).
- Activate these rule sets because they defend against the majority of automatic attacks and require little configuration.
Step 4: Use a specialized rule set for WordPress
- Many web application firewalls dedicate rule sets to WordPress (and popular plugins/themes) to minimize false alerts.
- Enable the WordPress-specific rule set if it is available.
Step 5: Protect login and administrative endpoints
- Introducing rules that protect /wp-login.php and /wp-admin/:
- Limit or prevent a certain number of login attempts.
- Add CAPTCHA to the login page.
- If your team always logs in from recognizable locations, restrict access to /wp-admin/ to certain trusted IP addresses.
Step 6: Secure XML-RPC access
xmlrpc.php is frequently targeted by both brute force and amplification attacks.
- Disable it in your web application firewall or security plugin if it is not used (many companies do not use it unless they need the WordPress mobile app or other plugins).
Step 7: Configuring IP allow or block lists
You should block IP addresses and address blocks that have been found to generate malicious requests.
At the same time, add IPs of trusted parties, such as your office, ISP, or monitoring service, to your allow list, thereby making sure they do not fall victim to the stringent set of rules (for detailed information, refer to our related guide—How to Whitelist and Blacklist IP Addresses in WAF).
Step 8: Turn on logging and alerts
Enable event logging so you can get back to blocked requests and set up alerts for highly significant events via email or dashboard notification (e.g., an increase in the number of blocked login attempts).
Step 9: Testing WAF
Make sure that the WAF is indeed functioning and properly protecting your website by doing some safe and harmless testing (for more information, see our related guide—How to check that your WAF is working).
Step 10: Regularly monitor and review
Regularly check the statistics for traffic and events related to WAF to detect any emerging trends and/or unintentional blocking of legitimate users.
Common Beginner Mistakes
- Dependence on WAF, with failure to provide updates, make backups, or create strong passwords.
- The decision to implement multiple WAF rules that can prevent legitimate users from accessing the website.
- Ignoring the protection of the XML-RPC feature due to the fact that it is not as well-known as the login screen.
- Not examining the logs—a misconfigured WAF gives a false sense of security to the user.
- Selecting a WAF on the basis of the number of features it provides instead of paying attention to the false-positive ratio it has.
🛡️ Short Guidance Checklist
This article serves as a general guide that is free from vendor bias. For precise instructions regarding the names of particular WAFs or security plugins and their functioning, check the official instructions for the particular WAF or security plugin, as their functionalities are regularly updated.
