Three things called a “firewall”
The word covers very different tools, which is why “my host already has a firewall” causes so much confusion.
| Network firewall | Cloud / edge WAF | WordPress firewall (plugin WAF) | |
|---|---|---|---|
| Where it runs | On the server or the host’s network | On a proxy in front of your server | Inside your site, as PHP |
| What it sees | IPs, ports, protocols | Full HTTP requests | Full HTTP requests plus WordPress context: which user is logged in, which plugin handles the request |
| Typical job | Close unused ports, stop network floods | Absorb large attacks, block common exploits for many sites | Block exploits against WordPress, its plugins and its login |
| Blind spot | Can’t tell a normal request from an SQL injection | Doesn’t know your users or plugins; can be bypassed if your server’s real IP is exposed | Runs after the request reaches your server, so it uses some of your server’s resources |
What your host’s firewall does
A hosting firewall protects the server and the hosting network. It keeps database and admin ports closed to the internet, blocks known-bad IP ranges and soaks up network-level floods. It is essential, and you don’t control it. What it normally doesn’t do is read the body of a web request and decide that ?id=1 UNION SELECT is an attack on a specific plugin. Some hosts add a WAF on top. Ask yours what it inspects and whether you can see what it blocked.
What a WordPress firewall adds
Because a WordPress firewall runs inside the site, it can make decisions a network device can’t:
- It knows who is logged in. It can be strict with anonymous visitors and still never block your own administrators.
- It understands WordPress endpoints such as
wp-login.php,xmlrpc.php, the REST API andadmin-ajax.php, which are where most automated attacks land. - It can combine signals: failed logins, request rate and rule matches for the same IP.
- It travels with the site, so the protection is the same on any host and in staging.
Silent Threads’s firewall has 356 built-in rules plus brute-force protection and rate limiting on every plan. Pro adds the WAF Rules Manager, a Rule Sandbox for testing custom rules against real traffic, Progressive WAF Response under sustained attack, Country Blocking and the Network IP Blocklist.
Does a WordPress firewall slow down my site?
A WordPress firewall does add some work to each request it inspects, because it runs as code on your server. How much you notice depends on three things:
- How the rules are evaluated. Rules should be cheap to check and stop at the first decisive match.
- What it does per request. Calling a remote service on every request is slow; using locally cached, signed rule feeds is not.
- Your caching setup. Pages served from a full-page cache or a CDN may never reach PHP, so they aren’t slowed down, but they also aren’t inspected by a plugin firewall.
A firewall can also make a site faster under attack, by blocking floods of bot logins and vulnerability probes before WordPress does the expensive work of handling them. To judge it on your own site, measure time to first byte for a few uncached pages with the firewall on and off, at a quiet time of day.
So do you need both?
For most sites, yes, because they cover different layers:
- Keep your host’s network firewall. You can’t replace it from inside WordPress.
- Add a cloud WAF if you get large traffic spikes or attacks, or already use a CDN. Make sure your server only accepts web traffic from that proxy, or attackers can go around it.
- Run a WordPress firewall for application-level rules and for protection that knows your users and plugins.
Two WordPress firewall plugins on one site is the combination to avoid: they duplicate work and can block each other’s requests.
Avoiding lockouts
The fear with any firewall is blocking yourself. Check how a product protects administrators. Silent Threads never lets its network blocklist block logged-in administrators, IPs an administrator logged in from in the last 30 days, your trusted IPs and ranges, or the server’s own IP. New live rules start in report-only mode, so a bad rule can’t lock out real visitors.
Next steps
A firewall is one layer. Pair it with login protection (see how to stop brute-force attacks on WordPress) and with scanning. The WordPress security checklist shows where each piece fits, and the firewall features list what each plan includes.
How we checked this guide
This article explains how the different firewall types work; it contains no benchmark figures, and we haven’t published speed measurements for our own firewall. Use the time-to-first-byte test above to measure the impact on your site. Plugin features are named with the plan that includes them.