Don’t Risk Crashing Your Website With A WordPress Security Plugin

Can A WordPress Security Plugin Actually Be Bad?

Remaining secure is paramount for all websites. A hack can be devastating. Using a firewall is a must as part of your website’s security infrastructure. However, for many WordPress websites, marketers and developers tend to rely heavily on plugins to manage website security.

What’s The Issue With This?

Whilst a plugin is better than nothing, there are better solutions that are less likely to cause problems for your website.

A plugin is installed directly on a website, therefore the work it does requires the use of website resources to fight off the bad guys.

This type of firewall is known as an endpoint firewall, as it operates at the application level, rather than the network level.

Imagine a nightclub with a long queue of guests in a single file. The bouncer allows guests in individually and there’s no issue. However, the guests get wind that Nikki Minaj is on stage and it creates a stampede. They begin piling into the door, completely overwhelming the bouncer. Poor guy didn’t stand a chance.

The security plugin firewall is like that single bouncer. Filtering traffic on your website. The website’s hosting is powering the plugin and if the website was to become overwhelmed with bad bot traffic (like a stampede of Nikki Minaj fans), the plugin and website can become overwhelmed and crash.

What should I Replace My WordPress Security Plugin With?

The answer is a third-party web application firewall that works at the network level.

Instead of using the website’s resources to funnel traffic and block bots, all traffic is channelled via a separate web server altogether. This is before it reaches your website.

Going back to our bouncer analogy, when all the visitors arrive there are gates before the club doors, and the gates are staffed with multiple bouncers. They screen all of the guests, turning away all the bad guys and only allowing the good guys through to the club’s front door.

The good traffic is only the traffic that makes it through to your website. This traffic is clean and safe.

By diverting to the third-party firewall, your website is protected and your hosting and resources are not placed under the sort of pressure that could cause your website to go down.

Recommended Web Application Firewall Providers

At Impact Media we partner with industry leading firewall solutions, and include a WAF license as part of our Support & Maintenance plans. This is for every website we support. However there are others on the market.

Listed below are some of the dedicated web application firewalls that can protect your WordPress website more effectively than a basic plugin.

1. Cloudflare – An industry standard provider that is constantly evolving and innovating.
2. Sucuri – Another popular industry standard and security solution.
3. Imperva – (Previously Incapsula) is another web application firewall provider that has been around for several years.
4. Akamai – Providing DDoS protection and protection for APIs and Applications.
5. Fastly – Traditionally a CDN provider, but now providing a firewall too.
6. Threatx – Cloud WAF that boasts that it’s set-and-forget.

What’s To Swipe & Deploy

First of all, if you haven’t got any security for your WordPress website, then even a plugin can be a sufficient short-term solution.

Bear in mind that free versions of these plugins usually have delays on updating firewall rules and malware signatures, compared to their premium counterparts. Free plugins in general often receive fewer updates and have limited features.

However, if you already have a security plugin installed like Wordfence, and you want to reduce the risk of your website being overwhelmed, then begin exploring replacing your security plugin with a dedicated cloud based web application firewall.

That’s a wrap for Swipe & Deploy #53. Join me next week when I’ll share another insight or piece of inspiration from around the web. 

If you’d like to learn more about our WordPress & WooCommerce Support & Maintenance plans, drop us an email or give James a call.

Our plans provide a holistic solution to your website’s performance, reliability and security, and are inclusive of premium tools and services.