Wordfence is a WordPress plugin that runs in PHP after the request reaches your site. Imunify sits on the server itself. A CDN WAF sits in front of the origin. Stacking all three often blocks checkout, bans payment callbacks, and leaves you reading the wrong log on a busy Friday.
Where each layer actually runs
A CDN WAF decides before traffic reaches our network. Imunify works on the server in the WAF, malware, and account isolation layer. Wordfence runs inside WordPress after LiteSpeed has already accepted the request. A flood that saturates the network never reaches Wordfence. A vulnerable plugin might. Match the tool to the abuse you are trying to stop. Turning off risky PHP functions is useful hardening, but it is not a WAF, and you still need to patch old plugins.
On much of our shared hosting we already run Imunify. Adding Wordfence because a blog recommended it often means two malware scanners fighting over the same files. If you mainly want Wordfence for two-factor login, you can keep that feature and turn its firewall and scanner down. If you want a WAF, choose the one whose logs you will actually open and read.
How three WAFs break checkout
Wordfence rate limits, Imunify rules, a CDN block, and a separate login plugin can each think they are helping. One of them may match your payment processor’s callback and kill the cart. The log you open first is often not the layer that issued the 403. A second firewall enabled “just in case” can lock you out of wp-admin while the green status screen still looks fine. A full Wordfence scan during a sale also burns CPU you need for customers, so schedule scans and use staging when you can.
- Rate limits that also catch admin-ajax can ban real shoppers.
- Overlapping malware tools may quarantine each other’s files.
- The blocking layer is identified by the response body, Server header, and matching timestamps—not a green checkmark.
A simple plan that works
On our shared hosting, start with Imunify plus ordinary WordPress hygiene: keep core and plugins updated, use unique admin accounts, and turn xmlrpc off when you do not need it. If you already use a CDN with its own WAF, rely on that edge layer and skip Wordfence’s firewall. On a VPS you control, pick one WAF, learn its logs, and do not install the other two for comfort. Test checkout and wp-admin from a phone hotspot, not only from the office IP, so you notice lockouts early.
Default setup: Imunify on the server, Wordfence only when you need its two-factor login with the firewall and scanner reduced, and a CDN WAF only when that CDN is already in front. Patch regularly, keep admin accounts unique, and leave xmlrpc off unless something real depends on it. The next freelancer may install Wordfence again; catch that before three layers start racing.
Tagged
Was this article helpful?
Be the first to rate this article.
