How your site is protected

The layers that run before a request reaches your code, and what they stop.

Protection runs at the edge, before a request reaches PHP. That is deliberate: filtering in a plugin means the attack already consumed your CPU.

The layers

• DDoS mitigation — volumetric attacks are absorbed at the Cloudflare edge.
• Web application firewall — managed rules for the common injection and traversal patterns, plus WordPress-specific rules.
• Bot management — known bad crawlers are blocked; search engines and monitoring tools are allowed.
• Rate limiting — brute-force attempts against wp-login.php and XML-RPC are throttled per IP.
• File integrity monitoring — core files are compared against the official checksums daily.
• Malware scanning — the document root is scanned daily, with known signatures quarantined.

What is still your responsibility

• Keeping plugins and themes updated, and removing those you no longer use.
• Strong, unique passwords, and two-factor on every administrator.
• Not installing nulled or pirated plugins. They are the single most common infection route we see.
• Removing access for people who have left.