A security scan reads every file and every row you have. Run it on a host with no headroom and the plugin protecting the site is the thing taking it offline.
Wordfence does real work on a schedule, and it needs to be paid for out of headroom rather than out of your visitors' page loads.
A full scan hashes every file and checks every post for injected content. It is scheduled into quiet hours and given resources, rather than competing with traffic at midday.
Recording every hit including bots produces a table that grows faster than anything else on the site. Retention is set deliberately instead of being left to fill the disk.
Wordfence's extended protection needs to load before WordPress does, which depends on a PHP setting that many hosts do not allow to be changed. Here it is set correctly.
Two systems blocking the same requests can lock out real people. Wordfence's thresholds and the platform's are set to complement rather than stack.
Detection tells you something got in. Daily backups are what get the site back to before it did.
Most sites that disable their security plugin do it because scans were making the site slow. That is a capacity problem being solved by removing the protection.
The number that matters is not how fast the site is normally. It is how fast it is at three in the morning with a full scan running.
The plugin is well built; what it needs is somewhere with room to do its job. Each row is a way of giving it that.
| Setting | What we do | Why |
|---|---|---|
| Scan scheduling | Pinned to off-peak hours with resources reserved | A full scan hashes every file and inspects every row, and running that against live traffic is the reason people end up switching scanning off. |
| Live traffic retention | Bounded, with a deliberate window | Logging every request including crawlers produces the fastest-growing table on the site, and an unbounded one fills the disk before anybody looks at it. |
| Extended protection | PHP configured so the firewall loads before WordPress | The optimised mode depends on a prepended file, which many hosts do not allow, so the firewall silently runs in its weaker mode instead. |
| Rate limiting | Thresholds coordinated with platform-level blocking | Two independent systems throttling the same client can compound into a lockout for a legitimate visitor nobody can explain. |
| Scan file scope | Backups and cache directories excluded | Hashing a directory of generated files and archives is most of the scan's runtime and none of its value. |
Every plan includes free migration, daily backups, SSL and 24/7 support.
Move the site across — migration is free, security config reviewed.