Security advice - xCloud - Firewall, Security Plugins, Advice?
Hi! I'm new to managing my own Wordpress installation and server settings. I just started setting up my site on xCloud hosting a couple of days ago. Regarding security stuff, what should I use or not use? AFAIK some security things can break functionality, however I also know Wordpress sites are very common targets for attacks, so I want to get this all setup asap.
-
Firewall - 7g, 8g, none?
-
Wordfence?
- are there better plugins you'd recommend?
- 2 factor for admin?
-
Other Security Advice?
I am aware that I need to keep my admin accounts incredible secure, and I need to keep all plugins up to date, and from reputable sources.
Thanks so much to the members here and Fluent team. This community has already a wonderful source of help for me.
Cloudflare paid option can help ward off those attacking your site. Even big and small businesses use cloudflare.com
David Scurlock Thank you. Cloudflare was on my radar already, I was hoping I could get by with the free tier, but maybe not. I'll check it out.
Coda Meridian I use cloudflare free, and to be honest, im not sure what free offers but I think you get some protection on the $20 month plan but you should read up on it first.
Coda Meridian If you'd like to see an example of what you can do with the free tier, I have a video from last year that runs through some options.
Welcome to managing your own infrastructure. Good on you for thinking about security early, but here’s the uncomfortable truth: there is no “setup and forget” security checklist that will protect you.
The real issue with your question: You’re asking what to use before understanding why you’d use it. That’s backwards, and it’s exactly how people end up with bloated, conflicting security measures that either break their site or give them false confidence.
I see others have already suggested “just use Cloudflare Pro” or “Cloudflare Free with some WAF rules and you’re done.” That’s the exact problem. Those aren’t solutions - they’re oversimplifications that ignore the actual work of security.
Here’s what they’re not telling you: if you put Cloudflare in front of your server but don’t secure direct access to your origin server, attackers can simply bypass Cloudflare entirely by hitting your server’s IP directly. All those fancy WAF rules? Worthless. This is one of the most common misconfigurations I see - people think enabling Cloudflare equals security, without understanding that it’s just one layer that needs to work with the others.
This is how to actually think about this:
Security is a concept, not a collection of plugins or services. A firewall belongs BEFORE your application (at the network/server level), not IN your application (as a WordPress plugin). When you stack application-level “security plugins” on top of each other, you’re often just creating performance overhead and configuration conflicts.
Regarding your specific questions:
- 7G/8G Firewall: These are NGINX/Apache rulesets. Don’t enable them because someone said they’re “good.” Understand what traffic patterns they block and whether that conflicts with your setup. Different CDN/proxy configurations? Even more complexity.
- Wordfence/Security Plugins: These can work, but they’re application-layer band-aids. They consume resources and can cause conflicts. If you don’t understand what they’re protecting against, you can’t judge if they’re even addressing your actual risks.
- 2FA for admin: Yes. Always. This is non-negotiable. But it’s table stakes, not a complete strategy.
What you should actually do:
-
Understand your infrastructure first. You’re on xCloud. But what else? Are you using a CDN? Reverse proxy? Each layer changes how security needs to be configured. Case in point: fail2ban can completely break functionality when you’re running behind Cloudflare with NGINX. I just dealt with this myself. The IP detection gets screwed up, and you end up blocking legitimate traffic or creating bypass vulnerabilities. This isn’t theoretical - it’s the kind of mess you walk into when you implement “best practices” without understanding your specific stack.
-
Start at the network layer. Proper firewall configuration at the server level, understanding how traffic flows through your infrastructure, and understanding your attack surface. If you use Cloudflare, you need to lock down your origin server so traffic can ONLY come through Cloudflare. Otherwise, what’s the point?
-
Then add application security - but only what you understand and can maintain.
I’ve written about how I approach this on my own infrastructure. These aren’t copy-paste solutions (those don’t exist), but they’ll give you a framework for thinking:
Securing WordPress Behind Cloudflare with CrowdSec
Bottom line: Security is individual. It depends on your specific setup, your risk tolerance, and critically, your understanding of what you’re protecting and why. Don’t just flip switches or buy services because the internet said so. That’s security theater, not security.
Start by understanding your infrastructure. Then build security measures that make sense for YOUR context.
Sorry, this took a bit longer, but that’s the Sunday mood 😎
André Daus You say they can bypass Cloudflare an attack IP directly. But they should not be able to get the IP address if the record is proxied. Or am I missing something?
Sam Jansen that’s what I mean by layered approach. If you just use your server and rely on Cloudflare only, you add the IP to Cloudflare and proxy access through their WAF. But that does not mean, you protected your server itself. You’ll need to use a firewall in front of the server. Your hosting provider should offer one (else you’d need nftables, firewalld, or ufw). Tell the firewall to only allow Cloudflare IPs. Everything else is just theater and creates a false sense of security.
André Daus Thanks for your message. I understand the problem. A lot of things you are saying relate to our situation. We have a Plesk dedicated server. But our hosting company does not want the server address behind cloudflare because than it is harder for them to access when help is needed. We are planning to move to Hetzner soon also because there pricing is a bit cheaper. We currently have Modsecurity anf fail2ban on our server and some malware scanner. Also we use Wordfence. The websites are behind Cloudflare but we don't have to much WAF rules enabled on there because it blocked to much real traffic. Especially on high traffic websites. From my experience Mod security and Fail2ban with Nginx did not give to much false positive. Wordfence sometimes did on a high traffic websites. But need to invest more time into what you where saying. Because sometimes I feel like we have to much protection running without really knowing what is the best approach.
Sam Jansen Wait. Your hosting company refuses to let you properly secure your server because it would be “harder for them to access”?
😳That’s not a hosting company. That’s a liability.
They could easily maintain access through SSH keys, VPN, or whitelisted IPs while still letting you lock down the server. They’re choosing their convenience over your security.
Your actual problem seems to be: You’re running ModSecurity, fail2ban, Wordfence, malware scanners, and Cloudflare - but you’ve disabled protective features because of false positives, and your origin server is wide open because your host won’t let you fix it.
That’s not layered security. That’s security theater with a dangerous foundation.
Moving to Hetzner is the right call - not because it’s cheaper, but because you’ll actually control your infrastructure.
Before you migrate: stop adding security tools. Start understanding the ones you have. Otherwise, you’ll just recreate the same mess on Hetzner.
If you need help thinking through your actual security architecture (not just tool recommendations), feel free to reach out.
André Daus Thank you very much for this, I appreciate you taking the time to make this teachable and explain how the solution to the problem requires that I have a thorough understanding of the problem. There's a lot of new information here for me. I started digging into the blog post's ideas with AI's assistance to guide me and fill in some blanks.
I use Cloudflare PRO for most things. Works pretty good.
Coda Meridian If you're on xCloud, this is a really great list to look at what's involved to secure your server: https://www.hostinger.com/tutorials/web-hosting-security