Wordfence Configuration Guide
System Sections
Wordfence Installation Guide
Why Wordfence Is Installed
Wordfence forms part of the security baseline used across my WordPress websites.
The plugin is not responsible for the entire security model, nor is it intended to replace backups, security headers, hosting security, or operational security practices.
Its primary responsibilities within my stack are:
- application firewall protection
- malware scanning
- file monitoring
- security visibility
- traffic monitoring
SiteGround Security handles login hardening separately, including custom login URLs and related access controls.
Within this environment, Wordfence provides an additional firewall layer, monitors file integrity, and helps identify unusual activity across the WordPress installation.
The remainder of this article documents the settings currently used and the reasoning behind them.
Wordfence Within My Security Stack
Varied Security Layers
Wordfence operates alongside several other security layers:
- hardened security headers
- daily backups
- secure hosting infrastructure
- limited plugin usage
- WordPress updates
- administrator account discipline
Together, these layers form the broader security architecture used across the website.
Basic Wordfence Firewall Settings
Wordfence Settings Part 1
Current Configuration
- Web Application Firewall: Enabled and Protecting
- Protection Level: Extended Protection Enabled
- Firewall Rules: Community Rules
- Real-Time IP Blocklist: Disabled (Free Version)
- Brute Force Protection: Enabled
Why These Settings Are Enabled
The primary purpose of Wordfence within my security stack is firewall protection and security visibility.
Wordfence runs the firewall in Extended Protection mode, allowing it to inspect requests before WordPress fully processes them.
The website currently uses the Community Rules included with the free version of Wordfence. This website does not currently use the premium version, so the Real-Time IP Blocklist remains disabled.
Current Limitations
The free version receives firewall rule updates after a delay compared to premium users and does not include access to the Real-Time IP Blocklist.
For smaller websites and personal projects, this limitation is currently acceptable while still providing a useful layer of protection and visibility.
Advanced Wordfence Firewall Settings
Wordfence Settings Part 2
Current Configuration
Current configuration includes:
- IP allowlisting disabled
- URL-based blocking rules not configured
- Firewall rules enabled
- Early firewall processing enabled
- Common services allowlisted
The advanced firewall settings remain largely unchanged from the default Wordfence configuration.
Enabled Firewall Protections
The firewall rule set remains fully enabled, including protections against:
- SQL injection
- Cross-site scripting (XSS)
- directory traversal attacks
- local file inclusion (LFI)
- malicious file uploads
- external entity attacks (XXE)
These protections form part of Wordfence’s application firewall and are enabled by default.
Why These Settings Are Used
The goal of this configuration is to maintain a strong baseline while avoiding unnecessary customization.
The allowlisted services section permits legitimate services such as Google Search, Facebook, Uptime Robot, and StatusCake to interact with the website without unnecessary interference from firewall rules.
The configuration does not use custom IP allowlists or manual URL blocking rules.
Unless a specific operational requirement exists, the configuration avoids additional allowlists, blocklists, and custom firewall rules. Keeping the configuration simple makes it easier to maintain and reduces the likelihood of accidental exclusions or conflicts.
For most websites, the default Wordfence firewall configuration already provides sensible protection without requiring extensive modification.
Brute Force Protection Settings
Wordfence Firewall Settings Part 3
Current configuration includes:
- Brute force protection enabled
- Lock out after 5 failed login attempts
- Lock out after 5 password reset attempts
- Failures counted over a 2-hour period
- Users locked out for 2 hours
- Invalid usernames immediately locked out
- Password breach protection enabled for administrators
- Strong password enforcement enabled
- Username discovery protection enabled
- WordPress application passwords disabled
- Password strength validation enabled
- Participation in the Wordfence Security Network enabled
Why These Settings Are Used
The objective of this configuration is to reduce common automated login attacks while maintaining a relatively simple setup.
Several protections are enabled by default, including lockouts for repeated login failures, invalid username detection, password strength enforcement, and protections that reduce username enumeration through WordPress endpoints.
Password breach protection is also enabled for administrator accounts, helping prevent the use of credentials that have previously appeared in known data breaches.
This website does not rely exclusively on Wordfence for login hardening. SiteGround Security manages the custom login URL and related access controls, while Wordfence provides additional protections such as lockouts, password policies, and username enumeration protections.
Settings Left Disabled
The following setting remains disabled:
- Block IPs that send POST requests with blank User-Agent and Referrer headers
This configuration leaves the option disabled because certain legitimate services and integrations may send requests without these headers. Enabling the setting can occasionally create unnecessary compatibility issues.
Rate Limiting
Wordfence Firewall Settings Part 4
Current Configuration
Current configuration includes:
- Rate limiting enabled
- Verified Google crawlers exempt from rate limiting
- Visitor request limits disabled
- Crawler request limits disabled
- Human visitor request limits disabled
- 404 monitoring enabled
- IP block duration set to 5 minutes
- Common website assets allowlisted (automatically generated)
Why These Settings Are Used
Wordfence includes rate-limiting controls that can restrict how frequently visitors, crawlers, and automated systems access the website.
The current configuration prioritizes compatibility and normal website operation over aggressive traffic restrictions. The configuration excludes verified Google crawlers from rate limiting to prevent unnecessary interference with search engine indexing and crawling activities.
All visitor and crawler limits remain set to unlimited. While more aggressive rate limiting can reduce abusive traffic and excessive crawling activity, overly restrictive settings can also interfere with:
- search engine crawling
- uptime monitoring services
- API integrations
- legitimate visitors
- website performance testing
For this reason, the current configuration remains relatively conservative.
For smaller websites and content-focused projects, a conservative rate-limiting configuration often provides a better balance between security, compatibility, and search engine accessibility.
Current Assessment
At present, rate limiting is enabled but operates primarily as a monitoring and fallback mechanism rather than an aggressive blocking system.
Scan Configuration
Wordfence Firewall Settings Part 5
Current configuration includes:
- Scheduled scans enabled
- Theme file monitoring enabled
- Plugin file monitoring enabled
- WordPress core file monitoring enabled
- Malware signature scanning enabled
- Backdoor and suspicious code detection enabled
- Vulnerable plugin and theme detection enabled
- Suspicious administrator account detection enabled
- Password strength auditing enabled
- Firewall status monitoring enabled
- Why These Settings Are Used
Wordfence scanning monitors the website for unexpected changes, suspicious files, vulnerable software, and indicators of potential compromise.
The primary purpose of scanning is visibility.
While the firewall helps reduce exposure to malicious traffic, the scanning engine helps identify problems that may already exist within the website environment.
The current configuration checks for:
- modified WordPress core files
- modified theme files
- modified plugin files
- known malware signatures
- suspicious code patterns
- vulnerable software
- unexpected administrator accounts
- dangerous URLs and content
Together, these checks provide a practical baseline for monitoring the integrity of the website over time.
Additional Scan Options
The following scan options remain disabled:
- Scan files outside the WordPress installation
- Scan images, binary files, and other non-executable files as executables
These settings can increase scan duration, server resource usage, and false positives while providing relatively little additional value for this environment.
For a maintained WordPress installation with a controlled plugin stack, regular updates, and limited administrative access, the default scanning scope provides a practical balance between visibility, performance, and maintenance overhead.
Additional Configuration
Wordfence Firewall Settings Part 6
The remaining Wordfence settings largely use their default configuration.
Automatic updates remain enabled, scan notifications remain active, administrator login alerts remain enabled, and Wordfence protects the uploads directory from code execution.
These settings primarily support monitoring, maintenance, and operational visibility rather than direct protection. As a result, they require relatively little customization and have not required significant changes from the default Wordfence configuration.
Concluding Thoughts
Final Notes on Wordfence
Wordfence provides firewall protection, malware scanning, file monitoring, and operational visibility across the website. However, it is only one component within the overall security stack.
The goal is not to rely on a single security plugin to solve every problem. Instead, Wordfence serves as a practical monitoring and protection layer alongside backups, security headers, hosting security, software updates, and administrative controls.
The configuration documented throughout this article reflects the settings currently used on this website. As the website evolves, some settings may change, but the overall approach remains the same.
Maintain a sensible baseline, avoid unnecessary complexity, and focus on long-term maintainability rather than aggressive security tuning.
Project Disclaimer
WordPress Security Disclaimer
The information provided throughout this page reflects the security tools, configurations, and operational practices currently used across my WordPress websites.
This content is shared for educational and documentation purposes only and should not be interpreted as a guarantee of security or protection against vulnerabilities, attacks, data loss, service interruptions, or infrastructure failures.
Website security depends on many factors, including hosting, server configuration, software updates, access control, operational maintenance, and user behaviour. No individual plugin, configuration, or security measure can provide complete protection.
The settings and recommendations discussed throughout this page should be evaluated and adapted to the specific requirements of each website, hosting environment, and operational workflow.
As with all systems documented on this website, the tools, configurations, and processes described here may evolve as infrastructure, requirements, and operational practices change.
Share This Article
Disciplined Maintenance.
