I’ve experimented quite a bit with Wordfence in terms of server load and page speed. Main thing is to only use the scan feature during times of least traffic, but that’s not possible without buying the Premium version, which in my opinion gives very little or nothing for your money, thus not recommended. In Free version of Wordfence, after running full scan a few times, just cripple the scan. The scan settings are confusing, it appears you can do settings on the Scan page by clicking “Scan” in the sidebar menu, but the settings appear to be more robust if you click “All Options” in the sidebar menu, then use browser page search to find “Scan Options” on the “All Options” page. Once you’re there, after a day or two letting Wordfence scan in its full resource intensive glory, uncheck just about everything, and adjust any other options you can find that reduce Scanning resource use, such as “Use Low Resource Scanning.”
As for the day-to-day speed hit from running Wordfence, it is imperceptible (hundredths of a second as observed using GTmetrix) on our sites, including one site with more than 4,000 pages and quite a bit of traffic. Page speed is a big deal to us, if Wordfence was a problem in that regard, we’d deep six it in a minute.
That said, we do balance the necessity of any plugin with resource demand, and any security plugin receives favor in that regard. In other words, we will delete a “pretty” plugin in favor of leaving a security plugin.
As to how Wordfence plays with caching plugins, we found that WordPress caching plugins are more trouble than they are worth due to most of our resource intensive page content being dynamic, and the non-dynamic stuff being highly optimized. And, yes, we tested a few plugins that didn’t seem to work well in our plugin stack, the stack which includes Wordfence. Instead of caching plugins, we use several different forms of caching that are implemented upstream of the Wordfence plugin level. For example, we have mod_expires and mod_deflate settings in our .htaccess files, as well as the PHP caching enabled. I’ve spent literally days experimenting with WordPress caching software, even paid versions, and found nothing that was any real help compared to simply speed optimizing site as well as using server settings as mentioned above.
