Is it worth it?
I have always been a great fan of Wordfence which is on most of my sites, but I am concerned that it may be starting to bloat websites and take up a lot of server resources. It is certainly a heavy weight these days compared to four years ago.
Of greater concern I keep visiting sites and finding Wordfence in a stalled state because it is waiting for user input following an upgrade, or some new feature. That condition is highly undesirable as most sites automatically upgrade themselves without user input, and if you have that sort of scheme in place, you don’t want to reconfigure it every month or so.
Hosting Protection
I have been talking to our hosting company which we all use. I have noted that when overseas and try to log into sites from another location additional protection pops up. The hosting company monitors site accesses and looks for certain behaviours and traps them. Their view is a plugin like WordFence is resource hungry and places a high load on the hosting, and does not provide any significant protection above that provided by the hosting company. It is also worth noting that not all hosting companies are the same. I am referring to my experience with our hosting company.
I have also used remote updating procedures, where I think Wordfence may be blocking uploads, or getting in the way. It is a pretty rare occurrence where it is deactivated for no apparent reason, or other things are broken on a site such as missing plugins. However it is highly undesirable.
The hosting company also detects multiple attempts at logging into sites one of the most common methods of accessing sites by hackers, so there is protection there as well. The hosting also scans all websites automatically, and you can initiate a scan from the dashboard of the hosting. File & Folder permissions can also be checked and verified from the hosting dashboard.
Two pieces of advice….
If you like the protection that Wordfence provides, then keep it. I think it has definitely served us well over the years we have been using it. However when you log into your site make sure there are no messages in the dashboard from WordFence requiring the user to do something. If there is, it may not be working. If you find any read them and if you are happy with them, accept them and set it off working again.
If you do not care, or your site seems slow….
Go to Plugins and deactivate it. This should stop it from working, and remove the protection from the site. You can then delete it. If you change your mind you can add it back in again.
My current understanding is that this action does not significantly add to the security risk of the website based on discussions with the hosting company.
If you found this message through an internet search….
My comments only apply to my user base using my hosting. Your circumstances may be different, and your host may or may not provide adequate protection for your site. You should do your own due diligence and decide what is best for you. I still have the greatest respect for the authors and developers behind Wordfence, but for us, we have had a few problems with it recently.