Wordfence is one of the best-known security plugins for WordPress: it provides a web firewall, malware scanner, login protection and traffic monitoring. Not every website needs it, and on shared hosting it comes at a cost. Below, we explain when it is worth using and what to look out for if you decide to install it.

The data was collected in October 2026 using a free licence for Wordfence version 9.0.2 on a test account hosted on aWh’s cPanel hosting service, running WordPress 7.1 on a website with no content. We tested the scan, the activation of the firewall and its deactivation.

Do you need this?

The question is: what is already running on your hosting account?

Security	By default on cPanel hosting	Does Wordfence add it?
Malware scan of files	ImunifyAV+ on the server (if it finds anything)	Yes, it compares them to WordPress’s own files as well
Flagging vulnerable plugins	WP Toolkit	Yes
Security settings	WP Toolkit	Partially
Restrictions on password attempts	Server-side protection	Yes, at WordPress level
Two-step login	None	Yes (Login Security)
Web firewall in front of WordPress	None	Yes

For a simple, regularly updated website on cPanel hosting, what the server provides is usually sufficient, supplemented by basic security settings and a small plugin that offers two-factor authentication. Wordfence is worth considering if you want a web firewall in front of WordPress – for example, for an online shop or a membership site with many users – or if you want to see for yourself what kind of attacks your website is facing. WP Toolkit is only available on cPanel hosting, so when it comes to web hosting, a security plugin may offer more value due to its ability to flag vulnerable plugins and provide WordPress-level protection.

If Cloudflare or another proxy is in front of the website, some of the firewall rules there will override the Wordfence firewall, and the load will not be generated on the hosting server either.

Installation

1. In the admin interface, select Plugins › Add New, search for Wordfence, install it and activate it. You can also do this via the WP Toolkit or the command line: wp plugin install wordfence --activate.
2. After activation, the plugin displays the following message: ‘You must install a licence to continue using Wordfence.’ Registration is required even for free use. You can request a licence on the Wordfence website by clicking the ‘RESUME INSTALLATION’ button, followed by the ‘GET YOUR WORDFENCE LICENCE’ button.
3. Enter the key you have received by clicking on the ‘Install an existing licence’ link: enter the recipient of the alerts in the ‘Email’ field, enter the key in the ‘Licence Key’ field, then click the ‘INSTALL LICENCE’ button. A successful installation is indicated by the message ‘Free Licence Installed’. Wordfence requires each installation to have its own unique key.
4. Please provide an email address that you check regularly, as the extension will send alerts to this address.

The extension’s menu appears in the left-hand sidebar, in English: Dashboard, Firewall, Scan, Tools, Audit Log, Login Security, All Options, Help.

The first search

On the Scan page, the START NEW SCAN button initiates the scan. On our test website, which contains no content, it scanned 4,433 files, 3 plugins, 3 templates and 414 URLs in 21 seconds. Its only finding, classified as low severity, was that, due to the settings, two paths were omitted from the malware scan; this does not indicate an infection. On a website containing many images and plugins, the scan takes considerably longer.

In the free version, malware signatures are updated with a 30-day delay (Signature updates delayed by 30 days), whilst the real-time IP blocklist and reputation checks (Spamvertising Checks, Spam Check, Blocklist Check) are not available.

Enabling the firewall

The firewall starts in Learning Mode, set to seven days in our test. During this time, it simply observes the website’s normal traffic and does not block anything: in our test, even attack patterns were allowed through. By the end of the week, it has analysed the website’s key functions, including login, forms and the checkout. You should then switch to ‘Enabled and Protecting’ mode in the Firewall settings, if automatic switching is not enabled.

The default ‘Basic WordPress Protection’ level only starts working when WordPress loads. You can enable the more robust ‘Extended Protection’ mode by clicking the ‘Optimise the Wordfence Firewall’ button:

1. The wizard recognises the server; on the aWh cPanel server, LiteSpeed/lsapi was preselected, so leave this as it is.
2. Download the two backups using the DOWNLOAD .HTACCESS and DOWNLOAD .USER.INI buttons. The CONTINUE button will only become active once you have done this.
3. A successful setup is indicated by the message ‘Installation Successful’.

The wizard creates the wordfence-waf.php file in the website’s root directory and inserts a # Wordfence WAF block into the .htaccess and .user.ini files. In our test, the firewall subsequently rejected the directory traversal and script injection patterns with a 403 error and the message **‘A potentially unsafe operation has been **detected’, whilst normal requests were allowed through. However, a simple SQL injection pattern did get through because it did not match any of the rules; consequently, the firewall does not apply updates.

What to bear in mind when using Extended Protection

We observed the following in our own tests:

• Do not delete the wordfence-waf.php file. If the file is missing but the configuration still references it, the entire website will return a 500 error. If this happens, restore the file or remove the # Wordfence WAF block from the .htaccess file.
• Restoring the .htaccess_file silently disables the firewall. If you reset the file to its default state, the website will continue to function without errors, but the firewall will not start running early enough, so you will need to run the wizard again.
• Migration: this block contains the full path to the file. Before migrating or changing folders, disable this using the REMOVE EXTENDED PROTECTION button, then re-enable it using the wizard.

How much resources are you using?

Data measured from the test website without content:

What we measured	Result
Time elapsed until the first byte of the homepage	Off: approx. 0.10 ms, On: approx. 0.15 ms, in Extended Protection mode: approx. 0.17 ms
The size of the extension	22 MB
The wp-content/wflogs folder	8.3 MB, immediately after switching on
New database tables	26
New scheduled tasks	Hourly and daily runs

This isn’t much on an empty website, but the plugin runs with every request, and a full search reads a large number of files. On shared hosting, this may hit resource limits and cause a 508 error. Therefore:

• Scan: on the ‘All Options’ page, under ‘Performance Options’, enable the ‘Use low resource scanning’ setting. The scan will take longer, but will place less strain on the hosting server. If possible, schedule scans for periods of low traffic.
• Live Traffic: keep this limited to security incidents. Logging all traffic writes continuously to the database, so only enable it for brief troubleshooting sessions.
• One plugin is enough: do not use two firewall security plugins at the same time, as they will conflict and place a double load on the hosting.

Behind Cloudflare

If Cloudflare is set up in front of your website and Wordfence misidentifies a visitor’s IP address, it may see the proxy IP address instead of the visitor’s, meaning that a block could affect all visitors. On the ‘All Options’ page, under the ‘How does Wordfence get IPs’ setting, specify the correct source, and check your own IP address on the ‘Tools › Live Traffic’ page.

If you have locked yourself out

If Wordfence is blocking your own IP address, or if the admin interface fails to load due to your firewall, you can disable it by renaming the plugin folder in File Manager or via FTP: for example, change wp-content/plugins/wordfence to wordfence-ki. Via SSH: wp plugin deactivate wordfence. Afterwards, please refer to the article on firewall IP blocking if the server’s firewall is also blocking your address.

Removal

A standard removal leaves a lot behind. In our test, after deleting the plugin, all 26 tables, the 8.3 MB wflogs folder and some settings remained. Therefore, please proceed in the following order:

1. If you have been using Extended Protection mode, click the REMOVE EXTENDED PROTECTION button in the firewall settings, download the two backups, and click the CONTINUE button. It may take up to 5 minutes for the change to take effect; please do not delete the extension until then.
2. On the All Options page, under General Wordfence Options, enable the ‘Delete Wordfence tables and data on deactivation’ setting and save your changes.
3. Disable and then delete the extension.
4. Delete the remaining wordfence-waf.php file from the website’s root directory.

In our test, the wflogs folder disappeared, and only four of the 26 tables remained: the tables prefixed with wfls_ belong to the Login Security section, and a few settings also remain in the database. These are not active; they simply take up space. Among the Login Security settings, the option ‘Delete Login Security tables and data on deactivation’ deletes these as well; we did not test this, but they can also be deleted retrospectively in phpMyAdmin.

You can find further WordPress security measures in our practical checklist.