Improve documentation for extended protection

Hi @prestonwordsworth, thanks for getting in touch.

The topic mentioned simply has our recommendations as some server configurations come with a small amount of RAM allocated to PHP, or a max_execution_time above 60 that can cause issues around timeouts during a scan. There are also considerations in our docs around noabort code on Litespeed and allowlisting IPs in Cloudflare, so the environment and server platform/APIs can make a difference – especially on shared servers.

It’s generally true that optimizing the WAF can make a site faster during attacks, by preventing the loading of WordPress altogether for each blocked hit. When the firewall isn’t optimized, Wordfence loads with WordPress rather than before so a quantity of data for page content, scripts and plugins has already been sent to the browser.

Throughout our millions of installations, we find slower performance can indicate another issue with something like file locking or general configuration on the server. We have discussed blogging speed tests, so may be able to provide insights in the future on how to improve the overall speed of Wordfence scans etc. but it shouldn’t be specifically affected by the WAF optimization.

Thanks,
Peter.

Dear Peter

The present topic isn’t related to the answer you provided in that topic. My link points to the following questions that that user asked there:

thanks for reply in detail. I have done some digging and found that the issue arises when we enable Extended Protection in wordfence. Can you please elaborate on this? Why extended protection may cause speed issues ?

I cited him simply to show that many people have experienced a performance hit when they turn on extended protection.

I was requesting that you document this performance trade-off on your website.

Hi @prestonwordsworth,

We believe that performance could be improved when Extended Protection is enabled due to the loading order of WordPress being after Wordfence on an optimized site. There may be only a small difference in many cases though, depending on available resources or the size of an attack.

I looked at the performance advice in the linked topic as that may be helpful in your, or other cases where customers are experiencing similar issues with speed or resources when using Wordfence. I have forwarded your request to the documentation/QA teams for their consideration, although can’t provide further details on possible updates here on the forums.

Thanks again,
Peter.

Dear Peter

It’s good to know WF actually believed that Extended Protection would speed up a site, and that the slowdown a lot of users have experienced with EP is news to the WF team. I would like to keep this topic open to keep track of the discrepancy, and see if further empirical research by WF would result in a different recommendation regarding EP.

Hi @prestonwordsworth, yes absolutely.

Wordfence runs on a wide variety of configurations. Our test sites at various hosts and with various configurations don’t exhibit slowness when the firewall is optimized. If users have a specific issue that we can see, we can suggest some known settings or take a look into the possibility of server configuration issues. We will always put forward plugin changes if we see other sites might share the same problem.

If you do wish to share your diagnostics with us as you’re experiencing poor performance, we’d be more than happy to look at them. You can send a copy to wftest @ wordfence . com directly using the link at the top of the Wordfence > Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

NOTE: It should look as follows – Screenshot of Tools > Diagnostic > Send by Email

Thanks again,
Peter.