Wordfence hosting where the scan does not cost you the site.
A security scan reads every file and every row you have. Run it on a host with no headroom and the plugin protecting the site is the thing taking it offline.
Security software is a workload too.
Wordfence does real work on a schedule, and it needs to be paid for out of headroom rather than out of your visitors' page loads.
Scans that run when nobody is looking
A full scan hashes every file and checks every post for injected content. It is scheduled into quiet hours and given resources, rather than competing with traffic at midday.
Live traffic logging that stays bounded
Recording every hit including bots produces a table that grows faster than anything else on the site. Retention is set deliberately instead of being left to fill the disk.
The firewall in front of PHP
Wordfence's extended protection needs to load before WordPress does, which depends on a PHP setting that many hosts do not allow to be changed. Here it is set correctly.
Rate limiting that does not fight ours
Two systems blocking the same requests can lock out real people. Wordfence's thresholds and the platform's are set to complement rather than stack.
Restore after a real incident
Detection tells you something got in. Daily backups are what get the site back to before it did.
Protection you can afford to run.
Most sites that disable their security plugin do it because scans were making the site slow. That is a capacity problem being solved by removing the protection.
- Scans given resources outside peak hours
- Traffic log retention configured
- Firewall optimisation enabled at the PHP level
- Rate limits coordinated with the platform
The site stays up while it is being checked.
The number that matters is not how fast the site is normally. It is how fast it is at three in the morning with a full scan running.
What we change for Wordfence
The plugin is well built; what it needs is somewhere with room to do its job. Each row is a way of giving it that.
| Setting | What we do | Why |
|---|---|---|
| Scan scheduling | Pinned to off-peak hours with resources reserved | A full scan hashes every file and inspects every row, and running that against live traffic is the reason people end up switching scanning off. |
| Live traffic retention | Bounded, with a deliberate window | Logging every request including crawlers produces the fastest-growing table on the site, and an unbounded one fills the disk before anybody looks at it. |
| Extended protection | PHP configured so the firewall loads before WordPress | The optimised mode depends on a prepended file, which many hosts do not allow, so the firewall silently runs in its weaker mode instead. |
| Rate limiting | Thresholds coordinated with platform-level blocking | Two independent systems throttling the same client can compound into a lockout for a legitimate visitor nobody can explain. |
| Scan file scope | Backups and cache directories excluded | Hashing a directory of generated files and archives is most of the scan's runtime and none of its value. |
Simple, transparent pricing.
Every plan includes free migration, daily backups, SSL and 24/7 support.
- 1 WordPress site
- 10 GB NVMe disk
- Free SSL
- Daily backups
- One-click deployment
- Support tickets
- 5 WordPress sites
- 50 GB NVMe disk
- Free SSL
- Daily backups
- One-click deployment
- Priority support tickets
- 20 WordPress sites
- 200 GB NVMe disk
- Free SSL
- Daily backups
- One-click deployment
- Dedicated support
Questions, answered.
Will Wordfence slow my site down?
Does the firewall run in optimised mode?
The live traffic table is huge. Is that normal?
Do I still need backups if I have a security plugin?
Run the scan and keep the site up.
Move the site across. Migration is free, security config reviewed.