A friend's website is connected to CloudFlare, through the domain name at least, and has WordFence installed. It was my understanding that CloudFlare has security that would block attackers, but WordFence is picking up a significant number of "Users locked out" for suspicious user names.

My friend said that WordFence is no longer needed, but with the lockouts, I realized I need more information on what operations each does at what point of the user making a request and the server sending a response. Does Cloudflare's system have functions that check the validity of requests for resources before WordPress loads? Note: my question may not be worded correctly, but I hope the meaning is clear.

  • 2
    What exactly is the question here? Wordfence and Cloudflare do different things, albeit with some overlap. Wordfence is Wordpress specific, using information not available to Cloudflare to make security decisions but at a cost of speed. In the above scenario Wordfence would only deal with requests which got through cloudflares defences.
    – davidgo
    May 5, 2021 at 19:31
  • It seems to me that there is actually no way for CloudFlare's software to check whether an invalid user is asking for login access, but that may be a gap in my knowledge. I have changed my question to hopefully ask that question correctly. May 6, 2021 at 2:05
  • 1
    @NoraMcDougall-Collins That's mostly correct, CloudFlare manages DNS, caching, and URL requests up until WordPress starts processing the requests, so it wouldn't have access to WordPress code or databases, but there are different methods to secure your login and admin URLs using just CloudFlare, for example with Firewall Rules to limit access to just specific IP's. It will also block what's known as "brute-force" attacks, whereby a bot or script tries repeated combinations of user names & passwords...
    – dan
    May 6, 2021 at 3:50
  • 1
    Some webmasters find that using that plus reCAPTCHA's for public login URLs is enough. CloudFlare doesn't provide more specific WordPress security functions however (like scanning for malware and code injections), or custom blocking/blacklisting, like you'd find in WordFence. If WordFence plus CloudFlare has been working well and is affordable, perhaps you should continue to use both until you're more experienced with CloudFlare and securing WordPress.
    – dan
    May 6, 2021 at 4:06
  • 1
    @NoraMcDougall-Collins Glad it was helpful to you. I've mostly been allowing the community to answer questions so as to give them the opportunity to build reputation on the site. If you can mold an answer from the comments here that reflects your understanding now, feel feel to add that as an answer and accept it (for the added rep). Otherwise, I'll check back and add an answer later so the question is marked as complete. Thanks and good luck!
    – dan
    May 8, 2021 at 7:07

1 Answer 1


Based on the comments to this post, a question posted to the authors of WordFence, and my own programming base, I find the following factors to be influencing which operations are done by CloudFlare and WordFence.

  1. They are different. It's not a matter of chosing one over the other, they do different functions.

  2. Cloudflare does not read the WordPress database, so it does not compare a login request to the valid credentials in a WordPress database. So, the lockouts are a unique, and valuable, function of WordFence.

  3. Cloudflare does read the requests for a website's resources and can distinguish other malicious requests.

My recommendation to my friend will be to use both.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.