Use layered protection: put WordPress behind a CDN or reverse proxy that absorbs network and HTTP floods, keep managed DDoS rules enabled, add narrowly scoped WAF and rate-limit rules, lock the origin to trusted proxy addresses, and agree on an escalation plan with your host. A WordPress security plugin can reduce application abuse, but it cannot absorb a large attack before PHP and the server consume resources.
What a WordPress DDoS defense must do
A distributed denial-of-service (DDoS) attack sends traffic from many systems to exhaust bandwidth, connection capacity, CPU, memory, or expensive application code. WordPress sites face both volumetric floods and “low-and-slow” HTTP attacks that send seemingly normal requests for long periods. The controls that work for one layer may not help at another.
| Layer | Useful controls | What it cannot replace |
|---|---|---|
| Network and transport (layers 3/4) | Provider edge mitigation, filtering, sufficient host capacity | Application-aware rules for expensive URLs |
| HTTP (layer 7) | Reverse proxy, managed DDoS rules, WAF, challenges and rate limits | Host action if the origin IP remains exposed |
| WordPress application | Login throttling, endpoint-specific controls, efficient caching | Upstream mitigation during a large flood |
Cloudflare says its DDoS controls cover layers 3, 4 and 7, and recommends an HTTP reverse proxy for low-and-slow attacks. Its documentation also reports detection and mitigation of layer 3/4 attacks in up to three seconds on average at the edge; that is a Cloudflare vendor figure, not a guarantee for every attack, plan or WordPress site (Cloudflare’s DDoS architecture documentation).
1. Map your architecture and host capabilities
- Identify the WordPress origin server, its public IP addresses, DNS provider, CDN or reverse proxy, and any separate API, mail or media hosts.
- Ask the host whether it provides network-flood mitigation, firewall controls, origin-IP changes, traffic statistics, emergency filtering and 24/7 escalation. WordPress’s hardening guidance recommends starting with the hosting environment (WordPress Hardening).
- Document who can change DNS, firewall rules and proxy settings. Record rollback steps so an over-aggressive rule can be removed quickly.
- Confirm backups are independent of the attacked server and that you know how to restore them. Backups do not stop a DDoS, but they limit recovery time after related damage.
Do not assume that changing DNS alone creates protection. HTTP requests must actually terminate at the reverse proxy; a DNS-only record that exposes the origin sends visitors directly to the server.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
2. Put the site behind a reverse proxy or CDN
Set the site’s proxied DNS records at your provider and verify that the response headers and logs show traffic arriving through the proxy. Enable the provider’s managed DDoS protections before an incident, not after the origin is already saturated. A proxy can drop or challenge traffic at the edge, cache eligible responses and apply HTTP rules without making every request execute WordPress.
Check the cutover
- Resolve the public hostname and compare the result with the origin address; the origin should not be directly advertised.
- Request a cacheable page and inspect proxy headers and the provider’s security-event dashboard.
- Test authenticated, API and webhook paths separately. Some must bypass caching but can still use WAF and rate limits.
Cloudflare’s FAQ states: “The best practice to defend against low and slow attacks is by using an HTTP reverse proxy, such as Cloudflare’s CDN or WAF service” (Cloudflare DDoS Protection FAQ).
3. Hide and harden the origin
If attackers learn the origin IP, they can send traffic straight to it and bypass proxy rules. Where your architecture permits, configure the host firewall to accept public web traffic only from the proxy’s published IP ranges. Keep administrative access on a separate management path, restricted by VPN or allowlist, rather than opening SSH or a control panel to the internet.
Rank #2
- 【Professional Firewall & NAS SERVER】OAKNODE 10gbe Firewall Appliance Mini PC-MGNASN, a powerful professional firewall router pc equipped with a 12th Gen Alder Lake N100 4C/4T up to 3.4GHz TDP only 6W with Intel UHD Graphics which maximizes the performance of the 2.5GbE port & SFP+ port, bring you a smooth secured and encrypted network environment.
- 【Rich I/O to meet your needs】Firewall Appliance MGNASN With HDMI 2.0+DP 1.4+TYPE-C(dp 1.2) Support for 3x4K@60Hz together, Dual DDR4 RAM slot support for up to 1x32GB SO-Dimm laptop DDR5 Ram Maximum 5600Mhz and 1xM.2 NVMe/PCIe 3.0x1 2280 SSD slot +1*SATA 3.0 SSD/HDD slots (install externally), also it support boot from TF card slot and it also support PXE/AWOL/Watchdog/GPIO etc. which is perfect for your firewall appliance、VM、Router、home Server needs.
- 【2xSFP+ 10GbE + 4x2.5GbE】This Firewall Router equipped with 2xIntel 82599ES 10gbe network card and 4*Intel i226-V network card speed maximum up to 2.5GbE(need other device like router, cables etc. also support 2.5Gbe/10gbe)which can bring you more faster and professional network usage(some system not release drivers yet) suggest to install version of below systems: pf-sense plus 23.0X or CE 2.7.X, OPNsense 22.1, OpenWrt, ROS7, ESXI 8 , Proxmox, CentOS etc).
- 【4G LTE Function supported】This model also support 4G LTE function(mini PCIE slot for 4G modem) and SIM card slot which you can use it as a IOT devices for your server.
- 【Quality With Warranty】If you have any questions or requirements(like OS installation/ drives/bios updates etc.) on OAKNODE Firewall mini pc MGNASN, PLEASE feel free to contact us. We offered 12 Months warranty for it and WE'LL REPLY YOUR Questions within 12 hours(during Workdays).
Search old DNS records, mail headers, development environments and certificates for leaked addresses. Do not blindly put mail, FTP or unrelated services behind an HTTP proxy. If the address has already been targeted, ask the host whether it can rotate the origin IP, then update firewall rules and proxy configuration together. Cloudflare’s proactive-defense guidance recommends limiting origin access to Cloudflare IP ranges and obtaining a new origin address after direct exposure (Cloudflare Proactive DDoS Defense).
4. Keep managed DDoS and WAF protections enabled
Start with the provider’s managed rulesets. Add custom WAF rules only after reviewing normal requests, blocked events and false positives. Cloudflare documents HTTP DDoS mitigation that can consider origin health and error rates; exact behavior, thresholds and plan entitlements are provider-specific and can change (HTTP DDoS Attack Protection managed ruleset).
Write narrow rules
- Target a known abusive path, method, parameter or traffic pattern instead of blocking all automation.
- Use a challenge or managed response before a hard block when legitimate visitors may match the signal.
- Exclude trusted payment providers, monitoring systems, mobile apps and webhook senders after verifying their addresses or signatures.
- Review events during normal traffic and after each change; keep a documented rollback.
Blocking entire countries, all bots or broad user-agent categories without a site-specific reason can break search indexing, accessibility tools, integrations and customers.
Rank #3
- BUSINESS READY - pfSense+ software updates included for product lifetime. Netgate TAC Lite technical support included. One year hardware warranty included.
- COMPLETE - Pre-loaded with pfSense+ software to get up and running fast. Simply unbox it and start customizing for your secure edge networking needs. Free help with setup from our expert Technical Assistance Center (TAC) available 24/7/365.
- POWERFUL - A dual core ARM Cortex-A53 1.2 GHz delivers near gigabit routing of common home iPerf3 traffic and in excess of 650 Mbps of firewall throughput.
- COMPACT - Low power draw, a compact form factor, and silent operation allow it to run unnoticed when placed on a desktop, wall, or rack.
- FLEXIBLE - Three (3) 1 GbE switched (WAN/LAN/OPT) ports allow you to configure three separate 1 GbE switched ports for upto a gigabit of bi-directional traffic.
5. Rate-limit login and expensive endpoints
Login URLs, XML-RPC, search, uncached queries, form handlers and API endpoints can cost far more than a cached page. Apply limits at the proxy or WAF first. Cloudflare’s CMS guidance recommends rate limiting login pages while warning that rules must be scoped so public pages are not blocked (Cloudflare’s WordPress security guidance).
- Measure normal requests per IP, account and endpoint, including office networks, mobile carriers and integrations.
- Set a temporary challenge or response threshold above normal bursts.
- Observe security events and application logs for false positives.
- Adjust separate limits for browser logins, API clients and trusted webhooks.
Use WordPress plugins for application-level controls such as login lockouts, but do not treat them as volumetric DDoS protection. A plugin executes inside the same PHP environment being stressed; WordPress recommends edge or server throttling where possible (WordPress Brute Force Attacks).
6. Cache and reduce origin work
- Cache anonymous HTML and static assets at the edge with correct purge rules.
- Serve images, CSS and JavaScript from an edge cache and compress them before an incident.
- Keep logged-in, cart and personalized responses uncacheable unless you have tested privacy and invalidation.
- Make expensive searches paginated and impose sensible query limits.
- Disable unnecessary plugins and background jobs that multiply database work during traffic spikes.
Caching lowers origin load but does not replace upstream filtering: an attacker can still request uncached or unique URLs.
Rank #4
- 【CPU】Intel Pentium J3710 4-Core/4-Thread processor, up to 2.64GHz, with 2MB L2 Cache and 6W TDP. Supports AES-NI and suitable for firewall, router, VPN and other network applications.
- 【Ports & Expansions】Equipped with 4 x 2.5GbE Intel i226-v LAN ports. Includes 2 x USB3.0, 1 x HDMI. 1 x VGA ports.Supports optional Wi-Fi and 3G/4G module expansion, plus a VESA mounting kit.
- 【Fanless & Low-Power Design】6W fanless design with an aluminum alloy chassis for quiet, low-maintenance operation. Design for 24/7 continuous use and suitable for home networks, small office and network labs.
- 【RAM & Storage】Includes 8G DDR3 RAM and a 128GB mSATA SSD. Supports up to 8GB RAM and 512GB mSATA storage. HDD storage is not supported. Compact 5.27 x 4.98 x 1.43-inch design weighs only apporximately 500g.
- 【Warranty & Support】Tested with pfSense, OPNsense, Ubuntu and other popular open-sourse OS. Supports Proxmox VE for virtualization and home lab applications. Includes a 12-month hardware warranty and lifetime technical support. (Press "DEL" to the BIOS)
7. Monitor, rehearse and respond
Baseline before an incident
Record normal requests per second, cache-hit rate, origin CPU and memory, database latency, PHP workers, 5xx responses and bandwidth. Know where your proxy exposes security events and origin-health signals.
When an attack starts
- Confirm whether traffic reaches the proxy, the origin directly, or both.
- Enable the provider’s emergency or managed mitigation mode if your plan offers it.
- Apply a narrowly targeted rule to the attacked endpoint; avoid broad blocks made without evidence.
- Contact the host with timestamps, source patterns, affected IPs and error graphs. Request filtering or an origin-IP rotation if direct traffic is saturating the server.
- Protect administrators through the separate management path and preserve logs for later analysis.
Afterward
Review which controls acted, which legitimate requests failed, and whether the origin address leaked. Remove temporary rules that are no longer justified, rotate exposed credentials, and update the runbook with exact provider contacts and rollback commands.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failures and fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| Origin CPU is high although proxy protection is on | Direct origin access, uncached URLs or a rule bypass | Restrict firewall access to proxy ranges, investigate uncached paths and verify DNS |
| Legitimate users receive challenges or 429 responses | Threshold too low or rule covers public traffic | Review events, separate APIs and trusted clients, raise or narrow the limit |
| Only login is unavailable | Login rate limit or brute-force lockout is misconfigured | Check proxy and plugin counters; restore administrator access and tune per-account/IP rules |
| Site is slow but bandwidth looks normal | Low-and-slow HTTP requests or expensive dynamic endpoints | Use an HTTP reverse proxy, inspect request duration and protect the costly path |
| Changing DNS did not help | Record is DNS-only, stale, or the attacker has the origin IP | Enable proxying, purge stale records and coordinate an origin-IP change with the host |
How to choose a provider or plan
Compare services on the mitigation layer and attack types covered, whether the origin can be locked to proxy addresses, managed and custom WAF controls, rate-limit flexibility, event visibility, origin-health response, support escalation, performance impact and the risk of blocking legitimate traffic. Recheck plan details before purchasing because thresholds and entitlements change. No service makes a WordPress site immune; resilience comes from layered controls and a tested response process.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Best Value
- 【CPU Optimized for Firewall Mini PCs】This firewall appliance is powered by Intel Quad-Core Celeron J1900, 64-bit, up to 2.0 GHz, supporting software-based encryption. Energy-efficient and reliable, it runs 24/7 for home or small office networks, handling VPNs, multi-WAN routing, and basic firewall tasks efficiently.
- 【4×Intel i210 Ports】Equipped with four Intel i210 network controllers, each delivering up to 1 GbE for reliable multi-WAN routing, VPN connections, VLAN management, and stable performance in small office or home firewall deployments
- 【Memory & Storage】This Firewall Mini PC comes with 4 GB DDR3L RAM and a 64 GB mSATA SSD, providing reliable performance for basic networking tasks. AMI BIOS with ACPI support ensures stable system operation and energy-efficient 24/7 use
- 【Flexible System Compatibility】Compatible with Windows 10, Linux, and professional firewall systems such as pfSense, OPNsense, and VyOS, ensuring stable network management for home or small office use
- 【After-Sales Support:】This compact, fanless, and silent firewall keeps your network secure. Includes lifetime technical support and a 30-day money-back guarantee!
Or skip the browser setup
If you need clean screenshots of your WordPress status pages, incident dashboards or public URLs while documenting an event, ScreenshotNeo provides a website screenshot API and MCP server. It accepts consent banners before capture and removes more than 60 known consent platforms, newsletter popups and chat widgets; bot checks, blank pages, timeouts, failed loads and cache hits are not billed, with the result identified by X-Page-Verdict and X-Billed headers. AI agents can use its MCP tools take_screenshot, get_page_info and capture_pdf.
One request returns an image or PDF:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the complete options and authentication details in the ScreenshotNeo documentation. The free plan includes 1,000 screenshots a month with no card; paid plans start at $5 for 3,000. Create a free ScreenshotNeo account.
Frequently asked questions
Will Cloudflare stop every DDoS attack on WordPress?
No. A reverse proxy and managed controls can absorb or filter many network and HTTP attacks, but an exposed origin, unusual application workload or provider limit still requires host and rule changes.
Should I install a DDoS protection plugin?
Use plugins for login and application abuse controls, but put edge or server-level mitigation in front of WordPress for large attacks because plugin code still consumes PHP resources.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can I rate-limit the whole site?
Usually that creates unnecessary false positives. Begin with login and other expensive endpoints, account for legitimate APIs and integrations, then expand only when event data supports it.
What should I ask my host before an attack?
Ask about network mitigation, firewall and proxy allowlists, origin-IP rotation, monitoring, backups, service limits and the emergency escalation contact.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
