DEV Community

Lia
Lia

Posted on

Free WAF for WordPress: Self-Hosted Protection Without the Performance Hit

#webdev #tutorial #devops #security
Plugin WAF (Wordfence, etc.) Reverse Proxy WAF (SafeLine)
When it loads After WordPress boots Before traffic hits WordPress
Database hit per blocked request Yes — WordPress and MySQL already queried No — blocked at the proxy layer
Performance impact 200-500ms+ TTFB increase <1ms detection latency
Protection surface WordPress core + theme + plugins All web apps on the server
Bypass risk Higher — if the plugin fails, no protection Lower — independent of WordPress state
Setup complexity Click install in WP admin One Docker command

Step 1: Deploy SafeLine as a Reverse Proxy 

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
Enter fullscreen mode Exit fullscreen mode

Dashboard at https://your-ip:9443.

Step 2: Point SafeLine at Your WordPress Instance

If WordPress runs on the same server in Docker, point SafeLine to wordpress-container:80. If WordPress runs bare-metal or behind an existing web server, point SafeLine to localhost:8080 or wherever your web server listens.

Step 3: Enable WordPress-Specific Protections

In the SafeLine dashboard:

  1. Rate limit /wp-login.php — 5 requests/minute per IP. This alone stops 90% of brute-force login attempts.
  2. Rate limit /xmlrpc.php — 2 requests/minute per IP (or block it entirely if you don't use the WordPress mobile app or Jetpack).
  3. Bot protection on /wp-login.php and /wp-admin/ — JS challenge for suspicious fingerprints.
  4. Geo-block countries you don't serve traffic to — you'd be surprised how much noise comes from regions your site has nothing to do with.

Step 4: Keep the Plugin WAF as Defense-in-Depth

You can still run a lightweight security plugin for things a reverse proxy can't see:

  • File integrity monitoring
  • Malware scanning (scheduled, not real-time)
  • 2FA for admin accounts
  • Security header injection (HSTS, CSP, X-Frame-Options)

The plugin handles what happens inside WordPress. SafeLine handles what tries to get in.

About That Performance Hit

Plugin WAFs hurt TTFB because every request — legitimate or not — must pass through WordPress and MySQL. Reverse-proxy WAFs inspect at the HTTP layer, before WordPress boots.

If your WordPress site is already slow (3+ second TTFB), adding a reverse-proxy WAF won't make it worse — but adding a plugin WAF will.

FAQ

Do I still need to keep WordPress updated?

Absolutely. The WAF catches known attack patterns. It doesn't patch vulnerabilities in your code. Keep core, themes, and plugins updated.

Should I block xmlrpc.php?

If you don't use the WordPress mobile app, Jetpack, or any service that relies on XML-RPC — block it entirely. It's one of the most targeted endpoints.

Can SafeLine protect multiple WordPress sites on one server?

Yes. Community Edition supports up to 10 applications. Add each domain in the dashboard with its backend IP/port.

What about SSL?

SafeLine integrates with Let's Encrypt. Or keep SSL at your web server and let SafeLine inspect HTTP behind it.

Related reads:

How many login attempts does your WordPress site get per day right now?

#webdev #security #devops #tutorial

继续 A10-A12？

Top comments (0)