Security is one of those things we don’t think much about… until something goes wrong.
Whether it’s firewalls, monitoring, malware scanning, or all-in-one solutions, everyone has a different setup that helps them sleep at night.
This week inside The Admin Bar, we asked agency owners what they actually use for website security — and the responses revealed a clear pattern: nobody relies on just one tool.
The most security-conscious agencies are running 3-5 different solutions in layers. Some focus on the edge (Cloudflare). Others prioritize server-level protection. And quite a few are avoiding bloated security plugins altogether in favor of lighter, more surgical approaches.
The Most Mentioned Website Security Solutions
These tools came up repeatedly in the discussion:
- Cloudflare
- Patchstack
- Wordfence
- Server-level protection (Imunify360, cpGuard, 7G/8G WAF)
- Hosting with built-in security
- Malcare / BlogVault / WPremote
- Solid Security (formerly iThemes)
- Custom server configurations (Fail2Ban, 2FA, SSH hardening)
Let’s break down why agencies are choosing each — and how they’re layering them.
Why Agencies Choose These Website Security Solutions
When it comes to website security, the real question isn’t “which tool?” — it’s “which layers?”
Almost everyone in the thread is running multiple solutions that work at different levels:
- Edge/DNS layer (stops attacks before they hit the server)
- Server layer (hardens the hosting environment)
- Application layer (protects WordPress itself)
- Monitoring layer (detects threats and vulnerabilities)
Cloudflare
Cloudflare dominated the conversation — mentioned more than any other single tool.
Troy Glancy shared his layered approach:
“Cloudflare + my custom WAF rules (v3) + Cloudflare Access + Turnstile at the network level. This alone stops a TON of junk.”
Jordan Trask called it out as a foundational first layer:
“Right now I think Cloudflare is a great first layer of defense, mostly because you can control and track traffic as needed. The free plan works well, there’s lots of guides and suggestions out there on what you can setup as good defaults.”
Why agencies like it:
- Stops attacks at the edge before they reach the server
- Free tier works for most agencies
- Custom WAF rules for fine-tuned protection
- Rate limiting and bot detection
- Doesn’t impact server performance
Best fit: every agency should be using Cloudflare (or a similar edge solution) as the first line of defense.
Patchstack
Patchstack came up almost as frequently as Cloudflare — often mentioned alongside it.
Multiple people called out the WP Umbrella integration as a game-changer.
Chris Key mentioned running it through WP Umbrella:
“Rocket + WP Umbrella with Patchstack.”
Why agencies like it:
- Focused solely on vulnerability detection and virtual patching
- Lighter than all-in-one security plugins
- Integrates with WP Umbrella and ManageWP
- Proactive protection for plugin/theme vulnerabilities
Best fit: agencies managing multiple sites who want vulnerability monitoring without plugin bloat.
Wordfence
Wordfence still has plenty of users — but the way people use it has shifted.
Jordan Trask offered a nuanced take:
“If you can’t do Cloudflare, then Wordfence is the next best option, but with just the firewall enabled… Also making sure you ‘optimize’ the firewall, which is just setting auto_prepend_file correctly.”
Why agencies like it:
- Comprehensive firewall when optimized correctly
- File integrity monitoring
- Works as a Cloudflare alternative when nameserver changes aren’t possible
- Real-time threat defense feed
Common hesitations:
- Can be resource-heavy if not optimized
- Some prefer lighter, more focused solutions
Best fit: agencies who need an all-in-one solution or can’t use Cloudflare.
Server-Level Protection (Imunify360, cpGuard, 7G/8G WAF)
A significant portion of the thread focused on server-level hardening.
Luke Humble detailed his layered approach:
“WAF 7G, Fail2Ban & 2FA, Fortress, BitNinja. It’s key to address any threats at the edge/DNS layer (Cloudflare), but if they get through then get the server to carry out any protection it can (WAF 7G).”
Why agencies like it:
- Stops threats before they reach WordPress
- User isolation prevents cross-site contamination
- Lighter server load than WordPress-level solutions
- Works across all sites on the server
Best fit: agencies with their own servers or VPS who want granular control.
Managed Hosting with Built-in Security (GridPane, Rocket.net)
Many agencies are offloading security to their hosting provider.
Cody Clifton said:
“I host with GridPane which has their own 7g WAF and Fail2Ban. I need to look into Patchstack but never have security issues with GridPane.”
Duncan Isaksen-Loxton runs:
“Thomas J. Raef. + Cloudflare Troy Glancy + 7g on server + fortress from Calvin Alkan. Happy days.”
Why agencies like it:
- Security handled at the infrastructure level
- No WordPress plugins required
- WAF and isolation built in
- Expert-managed security updates
Best fit: agencies who want enterprise-level security without managing servers themselves.
Malcare, BlogVault, WPremote
Several agencies mentioned dedicated malware scanning services.
Jordan Trask on WPremote:
“If you got the $$ wpremote is great and will scan and backup your site as well as try and do automatic clean-up.”
Why agencies like it:
- Automated malware detection and cleanup
- Often includes backup functionality
- Removes the manual work of infection response
Best fit: agencies who want automated response to infections, not just detection.
Solid Security (formerly iThemes Security)
Jodi Stammer mentioned using Solid Security.
It’s a popular all-in-one WordPress plugin with hardening features, 2FA, and file monitoring — though it didn’t get the same depth of discussion as Patchstack or Wordfence.
Best fit: agencies wanting a comprehensive WordPress-level solution with a simpler interface than Wordfence.
Custom Server Configurations
Several members shared fully custom approaches.
Svetoslav Marinov keeps it simple:
“Just block xmlrpc.php file and put basic authentication for wp-login.php and wp-admin/ with exception of admin-ajax.php.. on the server I have some custom rules to block bad people.”
Rose Newell runs a VPS with CrowdSec:
“I love CrowdSec… It runs on my VPS and there’s an API to connect it to WordPress, too. Mega efficient. Mega effective.”
Eoin Healy built a custom network defense:
“If any IP gets blocked on one site, it gets blocked on all sites I manage. I have a custom system a bit like managewp and the likes, so every site with my plugin on it are effectively securing all other sites too.”
Why agencies like it:
- Full control over every security decision
- No plugin overhead
- Tailored to specific needs
- Often more efficient than all-in-one solutions
Best fit: technically proficient agencies comfortable with server management.
Other Mentions
A few other solutions came up:
WP Umbrella with Site Protect — Sebastián Bórquez mentioned this as a base setup, sometimes combined with Cloudflare.
WP Security Ninja — Gerson El is testing this alongside Cloudflare and Patchstack.
Sucuri — Alex Celeste mentioned installing it on all sites as part of a layered approach.
Virusdie — Roelinde Brons uses it alongside Malcare.
WeWatchYourWebsite — Sean Golding mentioned it as part of his monitoring stack.
BitNinja & Fortress — Luke Humble uses these for real-time scanning at the server level.
CrowdSec — Rose Newell praised it for efficiency and effectiveness on VPS setups.
Patterns We Noticed
A few things stood out clearly:
- Nobody uses just one tool. The most security-conscious agencies are running 3-5 different solutions in layers.
- Cloudflare is nearly universal as the first line of defense.
- Patchstack is rapidly becoming the vulnerability detection standard — especially through WP Umbrella and ManageWP integrations.
- Server-level protection is a priority for agencies with technical chops or managed hosting with built-in security.
- Wordfence usage is shifting — people are either optimizing it heavily or replacing it with lighter alternatives.
- Isolation matters. Multiple people emphasized running each site under its own user account to prevent cross-contamination.
- Many agencies are ditching WordPress security plugins in favor of server-level and edge-level solutions.
The biggest insight? Security isn’t one thing. It’s layers. As Troy Glancy put it:
“Security isn’t one thing. It’s layers. Just like a piece of Swiss cheese you have to have several pieces to close all the holes.”
How to Choose the Right Website Security Stack
Ask yourself:
- Do you have control over your server, or are you on shared hosting?
- How many sites are you managing?
- Do you have the technical knowledge for server-level hardening?
- Are you willing to pay for managed security, or do you want to DIY?
- Do clients expect malware cleanup, or just prevention?
For most agencies, start here:
- Cloudflare (free tier) for edge protection
- Patchstack (via WP Umbrella or ManageWP) for vulnerability monitoring
- Server-level isolation if you control the hosting environment
- Malware scanning (Malcare, WPremote, or Wordfence CLI) for detection and cleanup
If you’re on managed hosting:
Check what’s already included. GridPane, Rocket.net, and similar providers handle most of the heavy lifting — you may only need Cloudflare and Patchstack on top.
If you’re technical and want full control:
Build your own stack with Cloudflare, server-level WAF (7G/8G), Fail2Ban, SSH hardening, and custom rules. Add Patchstack for vulnerability detection.
If you want simplicity:
Cloudflare + Wordfence (optimized) + a good host. It’s not the lightest stack, but it covers most bases without requiring deep technical knowledge.
Frequently Asked Questions About WordPress security
Do I really need multiple security solutions?
Yes. Every tool works at a different layer. Cloudflare stops attacks at the DNS level. Server-level tools prevent unauthorized access. WordPress plugins detect vulnerabilities and malware. No single solution covers everything.
Is Cloudflare’s free tier enough?
For most small agencies, yes. The free tier includes WAF, DDoS protection, and bot management. You can add custom rules for more control. Paid tiers add more rate limiting and advanced features, but aren’t necessary for most sites.
Should I avoid WordPress security plugins entirely?
Not necessarily. Patchstack and lightweight solutions are fine. The issue is bloated all-in-one plugins that try to do everything. If you’re handling firewall and hardening at the server level, you may only need vulnerability detection at the WordPress level.
What’s the difference between 7G and 8G firewall?
8G is the newer version with more comprehensive protection. However, some agencies report it can cause issues with page builders. 7G is battle-tested and widely trusted. Luke Humble mentioned sticking with 7G because “8G has advanced/comprehensive protection has I’ve read in some reports can cause issues with page builders.”
How important is user isolation?
Very. Running each site under its own system user prevents a compromised site from infecting others on the same server. Troy Glancy called isolation “everything” at the hosting layer.
Do I need malware scanning if I have good prevention?
Yes. Prevention reduces risk, but scanning catches what slips through. Jordan Trask recommended WPremote for automated cleanup, or Wordfence CLI for lighter overhead if you’re on a budget.
What’s the minimum security setup for a basic brochure site?
At minimum: Cloudflare (free), a secure host with isolation, and Patchstack for vulnerability monitoring. Donna Dawe asked about this specifically, and the consensus was that even basic sites need foundational security — though e-commerce sites warrant additional layers like 2FA and enhanced monitoring.
Kyle Van Deusen
After spending 15 years as a graphic designer and earning a business degree, I launched my agency, OGAL Web Design, in 2017. A year later, after finding the amazing community around WordPress, I co-found The Admin Bar, which has grown to become the #1 community for WordPress professionals. I'm a husband and proud father of three, and a resident of the Commonwealth of Virginia.
