On my WordPress websites (on LEMP stack with Nginx) I normally install a WAF plugin such as Ninja Firewall or Wordfence.

I was wondering if a better practice would be to replace them with a host-based WAF like mod-security (I guess that running both wouldn't be recommended...).

  • Each of those tools are meant for different threats
    – schroeder
    Commented Nov 22, 2020 at 15:54
  • 3
    Why wouldn't running both be recommended? Commented Nov 22, 2020 at 16:44
  • @schroeder Can you explain further for which threats are they meant? Commented Nov 22, 2020 at 18:22
  • 1
    @multithr3at3d: I guess there has to be significant overlap between both, and this may hurt performance for no clear benefit. I am not familiar with Wordfence but I would make an assumption that it is fined-tuned for Wordpress and may be better suited than a generic WAF If you just running Wordpress. Just a thought.
    – Kate
    Commented Nov 22, 2020 at 18:38


You must log in to answer this question.

Browse other questions tagged .