Server & firewall
Server hardening and WAF protection for WordPress
Beyond the WordPress layer, the underlying server can be hardened too: SSH and user hardening, firewall rules, hardened PHP-FPM, Apache, and Nginx configuration, plus a suitable WAF with rate limits and bot protection. Most relevant for your own or dedicated hosting — less so for plain shared hosting without server access.
Server hardening and edge protection complement WordPress hardening, they don't replace it. Together, both layers reduce the attack surface far more than either does on its own.
Server hardening
- SSH and user hardening
- package and security updates
- firewall rules and a minimal set of open services
- PHP-FPM, Apache, and Nginx hardening
- database access and secret management
- filesystem permissions
- Fail2ban or comparable protective logic
- log retention, time synchronization, and alerting
- backup separation and restore drills
WAF and edge protection
- selecting and setting up a suitable WAF
- rate limits and bot protection
- protection for sensitive endpoints (e.g. login, XML-RPC, admin area)
- country and ASN rules — only where a real need is demonstrated, never as a blanket default
- CDN, TLS, and header configuration
- alerting and log access
- regular rule review instead of a one-time install
Regular review, not a one-time install
A WAF that gets configured once and never reviewed again loses effectiveness over time — new endpoints, changed plugins, or new attack patterns require adjusted rules. We agree with you on a sensible review cadence.
Server hardening works best alongside a hardened WordPress installation. See WordPress hardening →
Not sure which server hardening fits your hosting? We're happy to advise, no obligation.