Hardening Dictionary
WordPress WAF
Definition
A WAF filters HTTP traffic to block common web attacks before they reach WordPress.
Also called: WAF, web application firewall, application firewall, WordPress firewall
Why it matters for WordPress
A WordPress-oriented WAF sits in front of (or inside) the site and stops noisy exploit probes, bad bots, and known attack patterns. It is not a substitute for updates, but it buys time and reduces drive-by noise.
How it shows up in practice
- Blocked requests in a firewall log
- Country or IP rules
- Rules targeting login abuse, scanners, or injection patterns
What to do
- Enable a WAF suited to WordPress traffic, not only a generic “block China” toggle.
- Review false positives so real users and webhooks are not blocked.
- Combine with patching; a WAF does not fix a known vulnerable plugin forever.
- Watch logs after big news CVEs when exploit traffic spikes.
Feature: Cloud Firewall. Guide: WordPress firewalls.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Rate limiting Rate limiting caps how often an action can happen from an IP or account, which slows automated abuse.
- DDoS A DDoS attack floods a site or its infrastructure with traffic so legitimate visitors cannot get through.
- Security hardening Hardening is the set of configuration and process changes that make a site harder to abuse.