Wordfence plugin for WordPress still recommended if running csf on CloudLinux?

spaceman

• October 06, 2023 10:27

Hi All, We're running multi-tenant CloudLinux servers with csf (configserver security and firewall). Assuming the above are appropriately configured, updated, etc., is it still smart for individual WordPress sites to use the very popular Wordfence firewall/security plugin? The main Pros I can think of are: 1. Wordfence will likely have WordPress-specific protections that CL+csf do not. 2. In the event that there are problems or misconfigurations with CL/csf, then Wordfence can act as a fall-back, second line of defence. Cons: 1. Less is more. If CL+csf are up to the task, why duplicate, potentially making things more complex? 2. Potential performance impacts for busy sites. Thoughts?

• 

  TVCNet Website Hosting and Security Services

  • October 06, 2023 16:23

  You are asking for opinions, it appears. Well, Cloudflare and Wordfence are altogether different services with very little overlap in what they do. IMHO, I think this question might be better posed to Wordfence, who can explain why / what they are in this regard.

  0
• 

  spaceman

  • October 09, 2023 09:01

  @tvcnet I think you meant to say CloudLinux, and not Cloudflare? Either way, as a commercial entity, Wordfence has a strong commercial incentive to confirm that they recommend their own product in addition to CloudLinux + CSF, hence the reason to ask here if others have any relevant experiences/insights to share. CSF & Wordfence are both firewalls, offering features such as: Real-time IP blocking Brute Force protection Dynamically updated rules Therefore IMHO quite a lot in common. In the meantime, sure, I'll be using both, just in case, even though some might argue that it's overkill!

  0
• 

  SimpleSonic

  • October 09, 2023 14:33

  Wordfence vs. CloudLinux + CSF is like comparing apples to oranges as they do not do the exact same functions. For example, CSF will block an IP at the system level before it has a chance to do anything on the server, whereas Wordfence works on the application layer and blocks the IP using htaccess rules well after it has already communicated with the web server, database server, etc., so Wordfence can be resource intensive with even a modest size attack. Honestly, it's best to use a server level security product like Imunify360 or BitNinja rather than a bunch of resource intensive WordPress plugins that will not come close to protecting like a server level product will.

  0
• 

  spaceman

  • October 09, 2023 16:45

  Thanks for that @ResellerWiz I actually forgot to mention that we are (as of recently) subscribed to Imunify360 on our CloudLinux servers. So yes, maybe I will give consideration to NOT using the Wordfence plugin on WordPress sites given that we have CL + csf + Imunify360.

  0
• 

  SimpleSonic

  • October 09, 2023 16:56

  @spaceman If you're already using Imunify360, you don't need Wordfence as it will just be trying to do a few things Imunify360 is already doing, so it would be nothing more than wasting account/server resources.

  0

Please sign in to leave a comment.