Wordfence includes features that inspect files, evaluate requests, and record security activity. On most sites, these features are appropriate to leave enabled. Sites on entry-level hosting, sites with very large file or user counts, and high-traffic sites may want to reduce peak CPU usage, file reads, or database writes.

Start with the lowest-impact changes first. Change one setting at a time, then monitor CPU usage, database load, scan behavior, and security results before making additional changes.

Scan Settings

Wordfence scans can read many files and use CPU time while checking for malware, modified files, vulnerable software, suspicious content, and weak passwords.

If you want to reduce periodic resource usage, consider disabling automatic scans and running manual scans after updates, site changes, or suspected security issues. The tradeoff is that Wordfence may not detect some problems until you run a scan manually.

A better first option for many sites is “Use low resource scanning”. This reduces server load by lengthening the scan duration and pausing between scan stages. Scans will take longer, but they should create less peak load.

If you are not actively cleaning up a known compromise, you can usually leave “Scan images, binary, and other files as if they were executable” disabled. This option can be useful during cleanup, but it increases the amount of file content Wordfence reviews. In many cases, malicious code in these file types would also require malicious executable code in other files that would still be scanned, before it could be used.

You can disable “Scan files outside your WordPress installation” unless your site structure or an investigation requires it. This can significantly increase the number of files scanned on some sites, especially if you have additional WordPress installations in subfolders.

Sites with a large number of users may disable “Check the strength of passwords” if they are not concerned about existing weak passwords. This scan checks existing user passwords and can take longer on large user lists. This is separate from login-time protections such as “Prevent the use of passwords leaked in data breaches” and password-change protections such as “Enforce strong passwords”, which apply only when a password is used or changed.

On very large content sites, scanning posts, comments, and options for dangerous URLs or suspicious content may add work during scans. Disabling those checks can reduce scan activity, but it also reduces detection of malicious links, spam, or suspicious content stored in the database.

Rate Limiting

Wordfence rate limiting can help control aggressive crawlers, scrapers, and repeated requests, but it runs inside PHP and requires database writes on most requests,in order to track when an IP has reached a limit. For high-traffic sites, rate limiting at the host, CDN, reverse proxy, or web server layer is usually more efficient because unwanted traffic can be limited before WordPress and PHP run.

If your host or proxy already provides rate limiting, consider using that instead of Wordfence rate limiting.

Firewall Settings

The Wordfence firewall is generally designed to run with low overhead, and it provides important protection against malicious requests. Disabling the firewall is usually not the first performance change to make.

If you are concerned about false positives, it is best to tune firewall behavior or allowlist known-safe activity rather than disabling the firewall entirely. Turning off the firewall reduces active protection against malicious requests.

Country Blocking

Premium customers can use Country Blocking to reduce resource usage by visits from countries that are not part of the site’s target audience. This can reduce the resources used to serve pages to visitors or bots, by providing a block page before the remaining plugin, theme, and WordPress core code runs.

Use this carefully. Blocking countries can affect legitimate visitors, search engines, payment providers, uptime monitors, staff, customers who travel, or users on VPNs.

Live Traffic

Live Traffic can record activity directly on the server, including traffic that JavaScript-based analytics may not show. On busy sites, recording all visits can create unnecessary database writes.

To reduce this, set “Traffic logging mode” to “Security only” instead of “All traffic”. This keeps the most security-relevant records while avoiding logging every normal visit.

You can also reduce “Amount of Live Traffic data to store” and “Maximum days to keep Live Traffic data”. This limits how much traffic history Wordfence keeps in the database.

Diagnostics and Debugging

Keep “Enable debugging mode” turned off unless Wordfence support specifically asks you to enable it. Debugging mode can increase database load since it records a large number of status messages during scans, and it is intended for troubleshooting, not normal operation.