FAQ SOP: Cloud WAF or plugin WAF — which do I need?

FAQ SOP: Cloud WAF or plugin WAF — which do I need?

Different jobs. Decide with this tree.

— Step 1: If attacks should be stopped before hitting your server, use a cloud WAF (Cloudflare, Sucuri). It saves CPU and blocks volumetric floods.
— Step 2: If you need WordPress-aware rules (specific plugin exploits), add an application WAF (Wordfence) too.
— Step 3: Run both — edge filters noise, app layer catches the specific.
— Step 4: Set the cloud WAF to challenge, not block, unknown bots to avoid false positives.
— Step 5: Verify: trigger a test rule and confirm the edge logs it, not your origin.

A plugin WAF cannot stop traffic that already crashed your PHP. Layer them.

Run this on every production site.