Security
Setting up a WordPress firewall: the complete guide for 2026
15 May 2025 · 4 min read
A WordPress firewall is no longer optional. With more than 90,000 hack attempts per minute worldwide, active protection is essential for every website. But how do you set up a firewall correctly without affecting the functioning of your website?
At WP Maintainer we manage firewalls for hundreds of WordPress websites. In this guide we share our approach and give you the knowledge to get started yourself — or to make an informed choice about outsourcing.
What is a WordPress firewall?
A firewall is a security system that filters suspicious traffic before it reaches your website. There are two types: **DNS firewall (cloud-based):** Traffic is filtered before it reaches your server. Examples: Cloudflare, Sucuri. **Application firewall (plugin-based):** Works within WordPress itself. Examples: Wordfence, iThemes Security.
Step 1: Choose the right type of firewall
For most WordPress websites, a cloud-based DNS firewall is the best choice. It offers: - Protection against DDoS attacks - Filtering of malicious traffic before it reaches your server - Better performance through caching at edge locations - No load on your server resources
An application firewall as a supplement is wise for specific protection against WordPress vulnerabilities such as XSS, SQL injection and brute force attacks.
Step 2: Basic configuration
Always start with a fundamental configuration: 1. **Block countries where you do not expect visitors** — but beware of VPN users 2. **Limit login attempts** — maximum 3-5 attempts per IP per hour 3. **Enable DDoS protection** — both layer 3/4 and layer 7 4. **Force HTTPS** — do not allow unencrypted traffic 5. **Enable bot filtering** — block malicious bots
Step 3: WordPress-specific rules
Configure rules specific to WordPress: - Block direct access to wp-config.php - Secure the wp-admin folder (IP restrictions or 2FA) - Block execution of PHP in upload folders - Limit REST API access where possible - Filter suspicious query strings that indicate exploits
Common mistakes
The most common mistakes in firewall configuration: 1. **Rules too strict** — blocking legitimate visitors and search bots 2. **No logging** — you do not see what is being blocked 3. **Not testing** — always test after configuration whether everything works 4. **No monitoring** — a firewall without monitoring is half the work
WP Maintainer security
Our professional maintenance plan includes complete firewall configuration and monitoring. We apply a defense-in-depth strategy with multiple security layers. More than 20 years of experience in web security guarantees optimal protection of your WordPress website.