Can You Run WP Remote’s Firewall and Wordfence at the Same Time?

WP Remote and Wordfence can be installed on the same WordPress website, but there is an important distinction between:

Running both security plugins

and:

Running both firewalls in full blocking mode

Those are not the same decision.

WP Remote currently includes:

• a real-time firewall;
• bot protection;
• malware scanning;
• vulnerability detection;
• malware cleanup;
• IP allowlisting;
• country blocking on supported plans.

Its current API documentation also shows that the firewall can be enabled per site and that bot protection can be switched on or off independently.

Wordfence includes its own:

• Web Application Firewall;
• malware scanner;
• brute-force protection;
• login security;
• 2FA;
• blocking and rate-limiting features.

Technically, both products can coexist.

The question is whether allowing both WAFs to independently block requests is worth the additional complexity.

WP Remote Says Some Customers Already Run Both

WP Remote’s current malware-scanner documentation explicitly addresses users who already have Wordfence and states that many agencies run both products.

WP Remote has also published a customer case study where the user described running Wordfence while using WP Remote’s firewall/IP-blocking capabilities at the same time.

So this configuration is not inherently impossible.

However, that does not mean that enabling every overlapping security feature in both plugins is automatically the best setup.

Wordfence Recommends One Primary Security Solution

Wordfence takes a more conservative position.

Its current guidance recommends choosing one security solution because running multiple security plugins can create:

• overlapping functionality;
• contradictory firewall rules;
• blocked legitimate functionality;
• gaps caused by conflicting configuration.

That is a reasonable warning.

Consider a legitimate request such as:

POST /wp-admin/admin-ajax.php

or:

/wp-json/wc/v3/...

One firewall may decide:

ALLOW

while the other decides:

BLOCK

The request is still blocked.

You now have to determine which layer made the decision.

What Can Go Wrong With Two Active Firewalls?

The biggest problem is not usually that WordPress immediately crashes.

It is diagnostic complexity.

For example:

Customer submits checkout
        ↓
WP Remote allows request
        ↓
Wordfence blocks parameter
        ↓
Checkout fails

Or:

Webhook arrives
        ↓
Wordfence allows it
        ↓
WP Remote blocks IP/bot pattern
        ↓
Webhook never reaches plugin

You can get apparently random problems involving:

• WooCommerce checkout;
• payment webhooks;
• contact forms;
• REST API requests;
• admin-ajax.php;
• WordPress cron;
• XML-RPC;
• page builders;
• external integrations;
• uptime monitors;
• WP Remote management requests.

Wordfence’s troubleshooting documentation specifically warns that security plugins and complex access rules can accidentally block legitimate WordPress endpoints such as admin-ajax.php.

Recommended Setup: WP Remote Firewall + Wordfence Scanner/Login Security

If you specifically want WP Remote’s firewall but also want to retain Wordfence, this is the setup I would start with:

WP Remote
Firewall: ON
Bot protection: ON
Malware scanning: ON

Wordfence
Firewall: OFF
Malware scanner: ON
Login Security / 2FA: ON

This gives you one primary traffic-blocking firewall while retaining useful Wordfence detection and authentication functionality.

Wordfence officially allows its Web Application Firewall to be disabled independently from the rest of the plugin.

How to Disable Only the Wordfence WAF

In WordPress go to:

Wordfence → Firewall → All Firewall Options

Find:

Web Application Firewall Status

Change:

Enabled and Protecting

to:

Disabled

Then click:

Save Changes

Wordfence documents this exact method for disabling the firewall.

You do not need to uninstall Wordfence just to disable its WAF.

The Wordfence Dashboard tracks firewall and scan status independently, so its scanning configuration remains separately manageable.

Then Enable WP Remote’s Firewall

From WP Remote, open the site you want to protect.

Enable its security/firewall functionality.

WP Remote’s current feature/API documentation confirms that its firewall is controllable on a per-site basis and provides:

Enable firewall
Bot protection on/off
Firewall logs
Trusted IP allowlisting
Country blocking

The exact dashboard labels may change as WP Remote updates its interface, but the important point is to have one product acting as the primary request blocker.

Alternative Setup: Wordfence Firewall + WP Remote Management/Scanning

There is nothing wrong with choosing the opposite arrangement.

For example:

Wordfence
Firewall: Enabled and Protecting
Scanner: ON
Login Security: ON

WP Remote
Firewall: OFF
Malware scanning: ON
Backups: ON
Management: ON
Monitoring: ON

This is useful if:

• Wordfence is already carefully configured;
• you have existing Wordfence allowlist rules;
• you use Wordfence Premium firewall features;
• you primarily added WP Remote for centralized management, backups and remote malware scanning.

WP Remote’s current documentation says its malware scans run off-server rather than consuming the site’s CPU for the scan itself.

WP Remote also supports enabling/disabling firewall functionality per site, so keeping its management/scanning capabilities does not require that every overlapping security option be enabled.

If You Want Both Firewalls Active Anyway

You can test it, but do it deliberately.

Do not simply activate both on a busy production WooCommerce site and assume everything is fine because the homepage loads.

A safer sequence is:

Backup
     ↓
Enable WP Remote firewall
     ↓
Put Wordfence into Learning Mode
     ↓
Test the whole site
     ↓
Review both firewall logs
     ↓
Only then enable full Wordfence protection

Wordfence’s Learning Mode is specifically intended to observe legitimate site behavior and add safe requests to its allowlist before the WAF starts blocking them.

Wordfence normally recommends exercising all important site functionality during Learning Mode.

What to Test During Learning Mode

Do more than browse a few pages.

For a normal WordPress site test:

Login
Logout
Password reset
2FA
Post/page editing
Media upload
Plugin settings
Search
Comments
Contact forms

For WooCommerce also test:

Add to cart
Cart update
Checkout
Coupon
Payment gateway
Order confirmation
My Account
Password reset
Subscription/renewal if applicable
Refund or webhook flow if practical

Also test connected services:

REST API
WP-Cron
Payment webhooks
CRM forms
SMTP
Analytics
Backup callbacks
WP Remote management

Wordfence specifically recommends exercising normal site functionality while in Learning Mode so safe requests can be recognized.

Make Sure Your IP Is Trusted in Both Systems

If you are testing two blocking systems, add your administrator IP to any relevant allowlist in both products.

WP Remote documents trusted-IP allowlisting as part of its firewall management features.

Wordfence also has allowlisting under its firewall configuration.

Otherwise you can end up in this situation:

WP Remote
Your IP = allowed

Wordfence
Your IP/request = blocked

Allowlisting in one product does not automatically configure the other.

The Same Applies to External Services

Suppose a payment provider sends a webhook from:

203.0.113.50

You allow it through WP Remote.

That does not guarantee Wordfence will accept the request.

Similarly:

Wordfence allowlist ✓
WP Remote firewall block ✗

still results in a failed webhook.

If something must never be blocked, verify that requirement against both systems.

Examples include:

• payment processors;
• shipping systems;
• CRM services;
• uptime monitors;
• external cron systems;
• WordPress management services.

Do Not Duplicate Country Blocking Unless Necessary

If you use country blocking, choose one system to enforce it.

For example:

WP Remote → Geo-blocking
Wordfence → No country blocking

or the reverse.

Having both products maintain separate geographical access policies creates little practical benefit but doubles the number of places where you need to troubleshoot an unexpected block.

Wordfence also warns that country blocking can interfere with legitimate customers, search services, payment providers, staff, travelers and VPN users.

Avoid Duplicate Rate Limiting Too

The same principle applies to rate limiting.

Wordfence itself states that if another host or proxy already provides rate limiting, you can consider using that instead of Wordfence’s rate limiting.

That principle extends naturally to another WordPress security layer.

If WP Remote is already controlling aggressive bots, avoid making Wordfence’s rate-limiting thresholds unnecessarily restrictive.

Otherwise:

WP Remote threshold
+
Wordfence threshold
+
hosting threshold
+
Cloudflare threshold

can make a legitimate high-frequency request difficult to diagnose.

Watch Both Logs Initially

If you decide to run both firewalls, check both security logs during the first several days.

When something fails, determine:

Did WP Remote see/block it?

Did Wordfence see/block it?

Did the web host/WAF block it?

Do not automatically assume the plugin closest to the visible error caused it.

For example, if Wordfence never records the request, another firewall may have stopped it before the request reached Wordfence.

Performance Is Another Consideration

WP Remote currently markets its malware scanner as off-server and contrasts that with Wordfence’s scanner/firewall processing on the site’s server.

Wordfence says its firewall is designed for relatively low overhead, but also provides extensive resource-tuning guidance for scanning, Live Traffic and firewall-related options.

Running duplicate security systems naturally means:

more code
more logging
more configuration
more alerts

even if the site remains fast.

So the decision should be based on additional security value, not simply:

Two firewalls must be twice as secure

That is not necessarily true.

Current Versions Are Compatible With WordPress 7.1

As of September 2026, WordPress.org lists:

WP Remote: 6.72
Tested through WordPress 7.1

and:

Wordfence: 9.0.0
Tested through WordPress 7.1

That establishes current WordPress compatibility individually.

It does not constitute an official guarantee that every combination of their firewall rules is conflict-free.

Current WordPress.org Support Status

The current WordPress.org support question asking whether WP Remote’s firewall and Wordfence can run simultaneously is still unresolved and has not yet received an official Wordfence response.

So there is currently no Wordfence support reply saying:

Yes, enable every firewall feature in both products.

WP Remote does, however, explicitly acknowledge that many agencies already run WP Remote alongside Wordfence.

The distinction is important.

Running both products is clearly possible.

Running every overlapping firewall feature without coordination is where unnecessary risk appears.

Recommended Configuration

For most administrators wanting both products, I would use:

WP REMOTE
─────────────────────────
Firewall              ON
Bot protection        ON
Malware scanning      ON
Malware cleanup       ON
Backups/monitoring    ON

WORDFENCE
─────────────────────────
Web Application
Firewall              OFF

Malware scanner       ON
Login security / 2FA  ON
Security alerts       ON

Or reverse the primary firewall choice:

WORDfENCE
─────────────────────────
Firewall              ON
Scanner               ON
Login security        ON

WP REMOTE
─────────────────────────
Firewall              OFF
Scanner               ON
Backups               ON
Management            ON
Monitoring            ON

The important rule is:

One primary blocking firewall, multiple complementary security layers.

If You Need Maximum Protection

A layered security design is valuable when the layers protect different boundaries.

For example:

Cloud/host DDoS protection
        ↓
Primary WordPress WAF
        ↓
Strong authentication / 2FA
        ↓
Vulnerability monitoring
        ↓
Malware scanning
        ↓
Offsite backups

That is genuinely defense in depth.

Two WordPress security products attempting to make the same blocking decision on every request are more likely to create duplication than a fundamentally new security boundary.

Practical Conclusion

Yes, WP Remote and Wordfence can operate on the same WordPress site.

WP Remote even states that many agencies run both, and one of its published customer examples describes using WP Remote’s firewall/IP blocking while also using Wordfence.

However, Wordfence recommends using one primary security solution because multiple overlapping security plugins can produce conflicting firewall behavior.

Therefore, the most predictable setup is:

Choose ONE active Web Application Firewall
+
keep the complementary features you want
from the second security product

If WP Remote is your primary firewall, disable only Wordfence’s Web Application Firewall under:

Wordfence → Firewall → All Firewall Options → Web Application Firewall Status → Disabled

and retain Wordfence scanning/login-security features as required. Wordfence officially supports disabling its WAF independently.

If Wordfence is your primary firewall, leave it Enabled and Protecting and disable WP Remote’s firewall while continuing to use WP Remote for management, backups, monitoring and malware scanning.

If you insist on enabling both firewalls, first use Wordfence Learning Mode, exercise every important site function, configure trusted IPs in both products, and watch both firewall logs for false positives.