Oops! We could not locate your form.
If your website is a critical part of your business, keeping it secure should be one of your highest priorities. A hack which takes your site out of action could seriously damage revenue, and a data breach could come with serious repercussions.
There are a broad range of things that can be done to harden a website against security threats. As many as possible should be layered to maximise protection.
A good hosting partner should have a robust hosting infrastructure that will dramatically reduce risk. This should be bolstered with other features and solutions to further improve security. One such solution, is a good quality WAF (Website Application Firewall).
Firewalls are designed to protect your website from the likes of DDoS attacks, malware, intrusions, and brute force attacks.
So let’s take a look at:
A quality WAF acts as a gatekeeper for your website. It inspects and filters all traffic before it ever reaches your website. Some though, as we will look at shortly, do this at the application level, which is less ideal.
A WAF sends potentially malicious traffic away, whilst letting good traffic (your users) in. They do this in a similar way to the antivirus software you are using on your computer. They use a continuously updated list of signatures known to be malicious. Then when a request matches one of those signatures, they block it from reaching your site.
Certain WAFs can also help to improve the performance of your site. They reduce server load by filtering out malicious requests, before they reach your website server. This means fewer requests, and greater availability.
Not all firewalls are created equally, and some are less efficient. So let’s take a look at the two main types you’ll find available for WordPress websites. We’ll also look at the main differences between them.
As the name makes obvious, these are firewalls installed on your site via a WordPress plugin. This means they operate at the application level. They are usually cheap or free, so are popular with personal websites and small businesses.
These plugin firewalls check requests that are sent to your site once they arrive. WordPress initialises, as does the firewall, which then screens the requests (filtering out the malicious ones) before WordPress processes them.
As these run on your site, there is the risk that should there be a vulnerability before the firewall initialises, attackers could gain access to your website. They can also hamper network performance.
A cloud based Website Firewall isn’t installed on the same network as your website server. Instead, these firewalls route and screen traffic via cloud proxy servers. So it has been filtered before it gets anywhere near your website.
This means that you have a whole extra layer of security. Harmful traffic will be identified and removed, before it can reach your site, and long before any scripts run.
As they operate outside of your website, it also means that they don’t put any additional strain on your website.
These firewalls often come as part of a security platform, with numerous features to protect your site, and improve performance.
Here’s a selection of WAFs (often included as part of broader security or performance solutions) that are available for WordPress websites.
We’ve included three cloud-based and three endpoint/application level options for you to start looking at, but there are many more out there for you to investigate, including: Shield & Astra among others.
Cloudflare’s cloud-based Web Application Firewall protects against OWASP Top 10 threats, credential stuffing, and DDoS attacks, backed by managed rulesets that update automatically using threat intelligence and machine learning.
It has a genuinely usable free tier, with more advanced bot management, rate limiting, and account takeover protection unlocked on paid plans.
One caveat: malware/content scanning of file uploads is currently an Enterprise-only add-on, so if you need built-in file integrity monitoring or malware cleanup, you’d want to pair it with another tool.
Sucuri offers a cloud-based firewall bundled with brute force prevention, malware and blacklist removal, and virtual patching as part of one managed platform. It’s a solid all-in-one choice, particularly where you want malware cleanup and blacklist removal included rather than bought separately, and it plays well alongside other CDNs, for your website performance improvements.
AWS WAF is Amazon’s pay-as-you-go application firewall, protecting against SQL injection, cross-site scripting, and other OWASP Top 10 threats, with optional add-ons for bot control and account takeover protection.
Pricing is usage-based (a monthly fee per Web ACL, per rule, and per million requests) which suits variable traffic well but takes more budgeting effort than a flat-rate plan. It’s worth knowing that AWS WAF only inspects traffic passing through AWS infrastructure (CloudFront, an Application Load Balancer, API Gateway, etc.), so it’s a better fit for sites already built on AWS than a drop-in option for a typical self-managed WordPress site.
Wordfence is a popular choice of application level WordPress security plugin, including WAF.
It’s features include on-demand and scheduled security scans, and you can monitor traffic and block suspicious IPs manually, from the WordPress admin area. The free version has a 30 day delay on firewall rules and malware signatures.
Another popular WordPress plugin, Jetpack has an application level firewall, along with other features depending on whether you have the free version or one of the paid versions. These include things like downtime monitoring, brute force protection, backup management, and at a higher tier, malware scanning and so on.
Another Application Level option, Ninja makes use of Sensei, a great filter engine.
They have a free version, and then their paid version WP+, which comes with way more features. Both support multisite, and include brute force protection, event notifications, and regular file scans, whilst the paid version includes extras like dedicated support, geolocation, rate-limiting, and antispam for comments and registration forms.
So now you know what a WAF is, and the main types out there for WordPress websites. You also have a list of some of the available options to start you on your path.
Do your research, and remember that even cloud based firewalls aren’t completely infallible, and so a broader security solution, and layers of protection are important to consider for your website.
If you’re considering a WordPress Support & Maintenance Agency, make sure you take a look at our range of plans by requesting our Support brochure.
See how migrating to our hosting environment brought Automation Logic significant performance gains, along with a far more robust security set up.
We take great pride in keeping our clients’ websites secure. Our hosting infrastructure, WordPress expertise and technical knowledge, partnered with industry leading security solutions (inclusive with most of our support plans) gives you peace of mind.
If you’d like to learn more about our WordPress & WooCommerce Support & Maintenance plans, drop us an email or give James a call.
Our plans provide a holistic solution to your website’s performance, reliability and security, and are inclusive of premium tools and services.
