{"id":24,"date":"2021-04-05T14:05:19","date_gmt":"2021-04-05T14:05:19","guid":{"rendered":"https:\/\/bandittracker.com\/?p=24"},"modified":"2021-04-06T17:17:56","modified_gmt":"2021-04-06T17:17:56","slug":"does-wordfence-slow-down-your-website-complete-guide","status":"publish","type":"post","link":"https:\/\/bandittracker.com\/does-wordfence-slow-down-your-website-complete-guide\/","title":{"rendered":"Does Wordfence Slow Down Your Website? (Complete Guide)"},"content":{"rendered":"\n<p>If you look at older reviews about Wordfence, you\u2019ll see reports that it slows down a website. But recent changes to the Wordfence plugin have greatly increased performance.<\/p>\n\n\n\n<p>I tested the latest version of Wordfence on four of my websites this year. Here\u2019s my verdict: Wordfence doesn&#8217;t slow down most of my websites. I&#8217;ll discuss the exception later in this article.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_64 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<p class=\"ez-toc-title\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-661391b79d999\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-661391b79d999\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/bandittracker.com\/does-wordfence-slow-down-your-website-complete-guide\/#Does_Wordfence_Slow_Down_Your_Website\" title=\"Does Wordfence Slow Down Your Website?\">Does Wordfence Slow Down Your Website?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/bandittracker.com\/does-wordfence-slow-down-your-website-complete-guide\/#Why_Do_Older_Reviews_Report_That_Wordfence_Slows_Down_Websites\" title=\"Why Do Older Reviews Report That Wordfence Slows Down Websites?\">Why Do Older Reviews Report That Wordfence Slows Down Websites?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/bandittracker.com\/does-wordfence-slow-down-your-website-complete-guide\/#Wordfence_Live_Traffic_Options\" title=\"Wordfence Live Traffic Options\">Wordfence Live Traffic Options<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/bandittracker.com\/does-wordfence-slow-down-your-website-complete-guide\/#BanditTracker_Wordfence_Performance_Tests\" title=\"BanditTracker Wordfence Performance Tests\">BanditTracker Wordfence Performance Tests<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/bandittracker.com\/does-wordfence-slow-down-your-website-complete-guide\/#How_to_Check_If_Wordfence_Is_Slowing_Your_Website\" title=\"How to Check If Wordfence Is Slowing Your Website\">How to Check If Wordfence Is Slowing Your Website<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/bandittracker.com\/does-wordfence-slow-down-your-website-complete-guide\/#What_To_Do_If_Wordfence_Slows_Down_Your_Website\" title=\"What To Do If Wordfence Slows Down Your Website\">What To Do If Wordfence Slows Down Your Website<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/bandittracker.com\/does-wordfence-slow-down-your-website-complete-guide\/#Why_Do_I_Have_One_Website_Without_Wordfence\" title=\"Why Do I Have One Website Without Wordfence?\">Why Do I Have One Website Without Wordfence?<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Does_Wordfence_Slow_Down_Your_Website\"><\/span>Does Wordfence Slow Down Your Website?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p><strong>When you install Wordfence with default settings on a mid-level hosting package, it will not slow down your website noticeably.<\/strong><\/p>\n\n\n\n<p><strong>If you are using the most basic entry-level hosting, Wordfence may add to performance issues. High-traffic sites may also have issues with Wordfence. You can change the configuration options to mitigate the impact on performance of scanning and security checks<\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Why_Do_Older_Reviews_Report_That_Wordfence_Slows_Down_Websites\"><\/span>Why Do Older Reviews Report That Wordfence Slows Down Websites?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>You may find detailed articles with in-depth testing that show a serious performance hit from the Wordfence plug-in. These reviews are legitimate and accurate for the versions they were working with at the time.<\/p>\n\n\n\n<p>The default installation of Wordfence used to come with a very high level of scanning. Every single visit to your website was tracked and logged. And because Wordfence tries to distinguish between humans and bots, there were additional checks for regular page views.<\/p>\n\n\n\n<p>This was okay for new websites with low traffic. But sites with significant traffic were noticeably slowed.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Poor reviews<\/h3>\n\n\n\n<p>Here\u2019s an example review from 2019. The careful reviewer ran multiple tests and the results were not good. You don\u2019t have to go read it (because I\u2019ll show you soon that it\u2019s out of date). I\u2019ll give you the summary:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>\u201c<em>Running Wordfence is expensive from a performance standpoint. Wordfence&#8230;can increase your response time between 2x-7x..<\/em>\u201d<\/p><cite><a href=\"https:\/\/blog.kernl.us\/2019\/11\/wordpress-plugin-performance-implications-Wordfence\/\" target=\"_blank\" rel=\"noreferrer noopener\">Kernl Blog<\/a><\/cite><\/blockquote>\n\n\n\n<p>Up to seven times slower? Yikes! No wonder people with busy websites were complaining on popular forums like Reddit and StackExchange.<\/p>\n\n\n\n<p>But wait. The reviewer ran the tests with the option to scan traffic turned on. That was a perfectly legitimate test because this option was enabled by default at that time.<\/p>\n\n\n\n<p>Crucially, this default has changed since then.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Amended default settings<\/h3>\n\n\n\n<p>When you install the Wordfence plugin, the default settings are different than they\u2019ve been in the past.<\/p>\n\n\n\n<p>Specifically, the \u201cLive Traffic Options\u201d are set to \u201cSecurity Only\u201d. That\u2019s so important that I\u2019ll explain it in detail in the next section.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Wordfence_Live_Traffic_Options\"><\/span>Wordfence Live Traffic Options<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>The current default setting for scanning Live Traffic is \u201cSecurity Only\u201d. This means that only a restricted type of hit on your website are scanned and logged:<\/p>\n\n\n\n<ul><li>Successful logins to your WordPress site<\/li><li>Failed logins (wrong password)<\/li><li>Blocked hits (using the Wordfence IP blacklist)<\/li><\/ul>\n\n\n\n<p>Normal page views are not logged (unless the IP is on the blacklist).<\/p>\n\n\n\n<p>What\u2019s happening is that your site is protected from the most common form of malicious activity: brute force. Brute force login attempts are when a bot tries thousands of user\/password combinations at the WordPress login page.<\/p>\n\n\n\n<p><em>Beginners tip: the user is typically \u201cadmin\u201d in a brute-force attempted. So, it\u2019s a good idea to create a new user with admin permissions and remove the default admin user. But make sure your new login is working before you do so!<\/em><\/p>\n\n\n\n<p>By not including normal page views in the default settings, the amount of scanning is greatly reduced. This removes the extra load from your hosting servers.<\/p>\n\n\n\n<p>To check this out, I ran my own tests.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"BanditTracker_Wordfence_Performance_Tests\"><\/span>BanditTracker Wordfence Performance Tests<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>I tested performance across four websites using the Pingdom speed-tracker tool. The sites don\u2019t all have the same plugins or caching. But I ran the same tests on each and averaged the response times.<\/p>\n\n\n\n<p>The tests were at three levels:<\/p>\n\n\n\n<ul><li>No Wordfence installation<\/li><li>Default Wordfence installation (and running a scan)<\/li><li>Wordfence All Traffic option enabled (and running a scan)<\/li><\/ul>\n\n\n\n<p>For the tests with Wordfence installed, I kicked off a manual scan and started the speed test.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong>Test<\/strong><\/td><td><strong>Configuration<\/strong><\/td><td><strong>Load Time (ms)<\/strong><\/td><td><strong>Change<\/strong><\/td><\/tr><tr><td>#1<\/td><td>Uninstalled<\/td><td>1,660<\/td><td>N\/A<\/td><\/tr><tr><td>#2<\/td><td>Security Only<\/td><td>1,821<\/td><td>10%<\/td><\/tr><tr><td>#3<\/td><td>All Traffic<\/td><td>1,881<\/td><td>3%<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>As you can see, the Wordfence plugin added a 10% performance hit at the default level. My sites aren\u2019t lightning fast (e.g. below 1 second), but I don\u2019t mind the 160-millisecond penalty for peace of mind.<\/p>\n\n\n\n<p>Interesting, the \u201cAll Traffic\u201d option was a little slower, but not by much. That, however, may not be the case if you have a high-traffic site.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Testing \u201creal-life\u201d traffic for <strong>your<\/strong> site<\/h3>\n\n\n\n<p>None of the sites I used for testing are above 50K page views per month.<\/p>\n\n\n\n<p>I could have used a traffic generator to test my sites under significant load. And if this was an \u201cindustry standard\u201d test, I would do so.<\/p>\n\n\n\n<p>But I\u2019m not interested in testing high traffic that these sites do not experience. I want to know if they would be adversely impacted by Wordfence now and in the medium future.<\/p>\n\n\n\n<p>I suggest that you run similar tests when you\u2019re about to install Wordfence.<\/p>\n\n\n\n<p>Before the install, check your site using the free Pingdom.com speed checker or another of your choosing. Then, run the same check after the default install of Wordfence.<\/p>\n\n\n\n<p>If your site crawls with the default settings, then read on.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_to_Check_If_Wordfence_Is_Slowing_Your_Website\"><\/span>How to Check If Wordfence Is Slowing Your Website<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>If you have recently installed Wordfence and are seeing a marked slowdown, then the first step is to deactivate the security plugin and see what happens.<\/p>\n\n\n\n<p><em>If you&#8217;re not sure how to do this, we have an article on <a href=\"https:\/\/bandittracker.com\/ways-to-remove-wordfence\/\">ways to remove Wordfence<\/a>. You can safely choose the first option described, which is a partial deletion.<\/em><\/p>\n\n\n\n<p>If that fixes the performance, then Wordfence may not be the actual culprit. Or at least, it may have an accomplice that is really the problem. Another plugin may be interacting with Wordfence in a way that consumes extra resources.<\/p>\n\n\n\n<p>You can check this by disabling and enabling different combinations of plugins. If you find that a plugin doesn\u2019t play nice with Wordfence, then you need to decide which is more important to you. You may decide to ditch that social media plugin and keep your protection.<\/p>\n\n\n\n<p>If you use external services on your website, that might also be a cause of conflict. One example is Ezoic, the advertising provider. Their FAQ has specific instructions on extra configuration for Wordfence to avoid performance issues.<\/p>\n\n\n\n<p>Suppose you find that Wordfence is definitely the sole cause of your performance woes. Is there anything you can do, other than uninstalling it? Yes, read on.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_To_Do_If_Wordfence_Slows_Down_Your_Website\"><\/span>What To Do If Wordfence Slows Down Your Website<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Before you chuck it in the bin, let&#8217;s take a look at some remedial action.<\/p>\n\n\n\n<p>If your site is on cheap entry-level hosting, then you may have been allocated very sparse resources by your hosting provider. Wordfence gives you the option to drop the scanning levels right down to the minimum that is still useful.<\/p>\n\n\n\n<p>From the Dashboard, click on the link to \u201cManage Scan\u201d. From here, you\u2019ll see that the default option is the \u201cStandard Scan\u201d. You can drop this down to a \u201cLimited Scan\u201d.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"719\" height=\"212\" src=\"https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/scan_options.png\" alt=\"\" class=\"wp-image-26\" srcset=\"https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/scan_options.png 719w, https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/scan_options-300x88.png 300w\" sizes=\"(max-width: 719px) 100vw, 719px\" \/><\/figure><\/div>\n\n\n\n<p>You can also explore some other options.<\/p>\n\n\n\n<p>The \u201cGeneral Options\u201d list under the Scan Options will show you the many different types of checks. Most are enabled by default. Some may not be necessary for you.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Do you allow comments?<\/h3>\n\n\n\n<p>Plenty of website owners choose not to allow comments on their sites. But comment scanning is enabled by default in Wordfence. Do you need it?<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Disk space monitoring?<\/h3>\n\n\n\n<p>I pay for a mid-level hosting service. I expect my host to monitor disk space and send alerts if there\u2019s a problem. And indeed, they\u2019ve done so in the past.<\/p>\n\n\n\n<p>If you\u2019re using some bare-minimum hosting service, then this option is a good idea. Otherwise, you may not need it.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Minimum plugins?<\/h3>\n\n\n\n<p>Some website owners are fanatical about having a minimum set of plugins. If you only use a few highly reputable plugins, then have a think about whether you need the scan for \u201cout of date, abandoned, and vulnerable plugins, themes, and WordPress versions\u201d.<\/p>\n\n\n\n<p>The danger here is that some well-known themes and plugins have introduced temporary vulnerabilities when releasing updates. So if you disable this option, then it is worth re-enabling for a while if you upgrade a plugin, your theme, or WordPress itself.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Only run manual scans<\/h3>\n\n\n\n<p>The free version of Wordfence runs a limited scan daily and a full scan every 72 hours.<\/p>\n\n\n\n<p>You can turn off scheduled scans completely under the Scan Options.<\/p>\n\n\n\n<p>Suppose you\u2019re running a special offer and expect a spike in traffic. That may be a good reason to disable scans temporarily. Of course, you\u2019re also increasing your security risk.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Reducing your own impact<\/h3>\n\n\n\n<p>On the General Options page, you\u2019ll see a default interval setting of two seconds. T<\/p>\n\n\n\n<p>This setting doesn\u2019t control how often that scanning occurs. It defines how often Wordfence refreshes the information is giving you.<\/p>\n\n\n\n<p>If you (or someone working for you) tend to keep the Wordfence admin page open to monitor traffic, then you are hitting your own site every two seconds. &nbsp;You can change this to something like 15 seconds.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Advanced performance options<\/h3>\n\n\n\n<p>Wordfence has a lot of configuration options. These include capping memory consumption and the execution time.<\/p>\n\n\n\n<p>You\u2019d best have a bit of knowledge of hosting and administration to go messing about with these options.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Why_Do_I_Have_One_Website_Without_Wordfence\"><\/span>Why Do I Have One Website Without Wordfence?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Wordfence is usually one of the first plugins that I install on a website. However, I removed it from one of my sites.<\/p>\n\n\n\n<p>The reason is that the traffic grew to a high level, and my testing showed that Wordfence was adding a little extra drag on response times. So, I chose to hire a hosting admin expert to review security and performance on the site. This wasn&#8217;t cheap, but I was paying for quality. The admin made changes which ensured that I got the same levels of security on this site at the server level. <\/p>\n\n\n\n<p>This allowed me to remove Wordfence completely. Every plugin adds a little bit of load to your hosting server. So, if it&#8217;s no longer necessary, it should be removed.<\/p>\n\n\n\n<p>If you are also thinking of removing Wordfence for a site with high traffic, please consider how else you are going to protect your website. I have an article that covers <a href=\"https:\/\/bandittracker.com\/does-wordfence-affect-seo\/\">how Wordfence impacts SEO very positively<\/a>. You need to be sure you are protected from the kinds of threats to indexation and rankings that I describe.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you look at older reviews about Wordfence, you\u2019ll see reports that it slows down a website. But recent changes to the Wordfence plugin have greatly increased performance. I tested the latest version of Wordfence on four of my websites this year. Here\u2019s my verdict: Wordfence doesn&#8217;t slow down most of my websites. I&#8217;ll discuss &#8230; <a title=\"Does Wordfence Slow Down Your Website? (Complete Guide)\" class=\"read-more\" href=\"https:\/\/bandittracker.com\/does-wordfence-slow-down-your-website-complete-guide\/\" aria-label=\"More on Does Wordfence Slow Down Your Website? (Complete Guide)\">Read more<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[5],"tags":[],"_links":{"self":[{"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/posts\/24"}],"collection":[{"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/comments?post=24"}],"version-history":[{"count":9,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/posts\/24\/revisions"}],"predecessor-version":[{"id":73,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/posts\/24\/revisions\/73"}],"wp:attachment":[{"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/media?parent=24"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/categories?post=24"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/tags?post=24"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}