Using wordfence instead of bitninja?

Hi @thetankgirl, thanks for getting in touch!

We can only really support Wordfence questions here on the forums, and most thoughts on another third-party product would be opinion. However, I will say that I couldn’t find any solid hits on the internet for Bitninja and VPN blocking settings so it’d certainly be worth approaching their support (or your hosting support if they provide it for Bitninja on their platform) to see whether this is configurable to your liking.

My general recommendation is that Wordfence is an endpoint firewall so executes before your WordPress site content is served to the browser when optimized. Whilst we offer rate limiting and brute force protection, it works for many of our customers as a compliment to any server-side load balancers and/or firewalls as we also catch malware using our extensive signature database, unwanted WordPress login attempts and scanning your installation for compromized plugins and files.

You can find more information on: https://www.wordfence.com/blog/2017/01/how-wordpress-firewall-works/

I hope this helps you out!

Peter.

Hello Peter,

Thank you for your answer!

I already contacted bitninja and my hosting support, but they only want to whitelist ip addresses per address that gets blocked. And my hosting says the same thing.

And that’s a problem because VPN’s use several IP addresses, and I do not get to see when an IP address of a customer gets blocked.

It’s because of customers asking if my site is down that this issue got my attention, it blocks before it even gets to my site logs. Even I get blocked when I use my paid VPN. And I mean no warning, just a timeout/connection error.

So can it be used instead of the firewall on my hosting? Not a compliment, but a replacement. Sorry if I misunderstood your answer, English is not my first language.

Kind regards!

Hi @thetankgirl, thanks for the extra clarification.

For clarity, Wordfence does not actively block VPN or Tor users largely as they (especially VPNs) are almost indistinguishable from regular internet traffic. Many privacy conscious people use these to protect their online presence, so blocking them isn’t something we generally consider good practice.

To (kind of) answer your question, we don’t like to recommend potentially reducing your site’s general security by disabling server-side firewalls BUT if the solution available to you is incompatible with your use-case then there are customers using Wordfence as the primary protection on their website. An alternative solution would be to find a host that uses a different server-side firewall service and run your site from there together with Wordfence.

Thanks,

Peter.