Simple steps to configure Sucuri firewall on WordPress

Every WordPress website is exposed to increasing security risks, from hacking attempts to automated bot attacks. Implementing the Sucuri Firewall is one of the most effective methods to reduce these threats and protect your digital assets. Known for its ease of use and comprehensive security features, Sucuri helps both beginners and experienced users maintain a stable and secure website.

In this article, we will cover simple steps to configure Sucuri Firewall on WordPress, helping you set up strong protection with minimal effort while improving your site’s overall performance and reliability.

What is the Sucuri firewall?Link to heading

The Sucuri Firewall is a cloud-based Web Application Firewall (WAF) designed to protect websites from a wide range of cyber threats before they ever reach the origin server. Instead of operating at the application level inside the website, Sucuri sits between incoming traffic and your hosting environment. All traffic is routed through its global Anycast network, where malicious requests are filtered out and only legitimate visitors are allowed to reach the site. 

This architecture significantly reduces server load, speeds up response times, and prevents harmful traffic from causing damage.

At its core, the Sucuri Firewall aims to block exploitation attempts targeting website vulnerabilities. It includes advanced, continuously updated security rules specifically tailored for platforms like WordPress, Magento, Joomla, and other content management systems. 

When an attacker tries to exploit outdated plugins, themes, or known CVEs, Sucuri’s virtual patching system intercepts the request automatically - even if the site has not yet been manually patched.

Sucuri also provides strong protection against Distributed Denial of Service (DDoS) attacks across multiple layers. By absorbing and filtering abnormal spikes in traffic at the network and application layers, the firewall ensures that high-volume attacks do not overwhelm the website’s server resources. This makes it extremely effective for businesses that require uptime and stability during traffic surges or targeted cyberattacks.

Another key component of the Sucuri Firewall is its ability to detect and block malicious bots. It uses behavioral analysis, rate limiting, and machine-learning-based threat intelligence to identify harmful automated activities, such as brute-force login attempts, credential stuffing, form spam, and content scraping. These automated threats are filtered out before they interact with the site, improving both security and server performance.

Beyond protection, the Sucuri Firewall enhances overall website performance. Its built-in CDN (Content Delivery Network) distributes website content across strategically located global servers, reducing latency and speeding up load times. This dual function - security plus performance optimization - makes Sucuri a comprehensive solution for website owners who want both speed and robust cybersecurity.

Preparing to configure Sucuri firewallLink to heading

Requirements before setupLink to heading

Before beginning the configuration process, you must verify a few core requirements. 

First, ensure that you have full administrative access to both your WordPress dashboard and your hosting control panel, as you may need to update security configurations or adjust caching settings. 

Second, confirm that you have access to your domain registrar, since applying Sucuri’s firewall protection requires changing DNS records. You should also disable any conflicting security plugins or firewalls during setup to avoid overlapping rules. 

Lastly, review your hosting provider’s DNS propagation timeline to anticipate any short service interruptions while DNS changes take effect.

Understanding DNS-level protectionLink to heading

Sucuri operates primarily as a DNS-level Web Application Firewall (WAF), meaning your website traffic flows through Sucuri’s secure network before reaching your server. This approach allows the firewall to filter malicious requests, block bots, and mitigate DDoS attacks before they ever touch your infrastructure. 

DNS-level protection is significantly more effective than local firewalls because it reduces server load, prevents resource exhaustion, and ensures threat detection occurs at the network edge. Understanding this mechanism is essential, as it explains why updating DNS records is a critical part of enabling Sucuri’s protection.

How to locate DNS records at your domain registrarLink to heading

To configure the Sucuri Firewall, you must first locate the DNS records that control your domain. Log in to your domain registrar’s dashboard - such as GoDaddy, Namecheap, Cloudflare, or another provider - and navigate to the DNS Management or Zone Editor section. Here, you will find key DNS records including A, CNAME, and MX entries. 

Identifying your current A record (the IP address pointing to your server) is crucial because Sucuri will replace this value with their firewall IP. If your domain registrar offers advanced features like DNS templates, record locking, or propagation monitoring, review them before making changes to ensure a smooth and controlled transition.

Guide to configuring Sucuri firewallLink to heading

Generate a Firewall IPLink to heading

Before you activate the firewall, you must first add your website to the Sucuri network so the system can generate a dedicated Firewall IP for your domain. Once the network finishes copying your site’s content and preparing the environment, you will be able to update your DNS records and point your domain (www.example.com) to the new Sucuri Firewall IP.

To generate your Firewall IP from the Sucuri dashboard, start by selecting Website Firewall at the top of the page. Then choose Protect My Site Now. Enter your website URL and review the available options:

• I am currently under a DDoS attack: Use this only if your site is actively being overwhelmed or taken offline by a DDoS incident.
• I want you to restrict access to admin directories to only allowlisted IP addresses: Ideal for CMS platforms such as WordPress or Drupal, this option limits access to administrative areas so only approved IP addresses can reach them.

After selecting the appropriate settings, click Add Site to complete the process.

Test the Internal DomainLink to heading

After you add your website to the firewall network, a notice will appear indicating that the service is not yet active. At this stage, the firewall has begun caching your site’s content, so you need to test the internal domain to confirm that these temporary addresses are functioning correctly.

To test the internal domain, return to the first step in the Activating Website Firewall Instructions and open each link listed under Internal Domains. If any link displays an error, wait a few minutes and try again. Once your site loads properly on every internal domain, you can continue with the activation process.

Activate your website firewall protectionLink to heading

Activating the firewall requires updating your domain’s DNS settings (example.com) to point to your new Firewall IP. This change ensures that Sucuri can block harmful traffic before legitimate users reach your site.

You can enable the firewall using several methods:

• Automatic Integration with cPanel/Plesk.
• Use Sucuri DNS manager.
• Manually change DNS records.

Automatic Integration with cPanel/Plesk

To activate the firewall through cPanel or Plesk, choose I use cPanel or I use Plesk under the Automatic Integration section. Enter your domain, username, and password, then select Login to Plesk or Login to cPanel to complete the process.

Manually change DNS records

If you prefer to update your DNS manually, go to the second step in the Activating Website Firewall instructions. Copy the second IP address displayed in the grey box, then sign in to your hosting provider or domain registrar to access your DNS settings. Guidance for many major hosts is available in the knowledge base article. Update the A Record according to the instructions shown in the grey box.

Allowlist firewall IPLink to heading

If your hosting environment uses its own firewall - such as CSF, ModSecurity, or a similar system - you should allowlist the Sucuri IP addresses shown in step four of the Activating Website Firewall instructions. This prevents your server from blocking Sucuri’s requests and ensures the firewall can properly cache your site’s content. If you are unsure whether your server includes additional firewalls, contact your hosting provider and ask them to allowlist the provided IP addresses.

Upload your SSL certificateLink to heading

If your site does not use an SSL certificate, you may skip this section. The Sucuri Firewall automatically provides free Let’s Encrypt certificates for your Firewall IP, but you can upload your own certificate if you want full end-to-end encryption between Sucuri and your origin server.

To upload your SSL certificate, open HTTPS/SSL, select Upload Certificate, and paste the contents of your .key and .crt files into the appropriate fields. Save the changes to complete the setup.

Prevent firewall bypassLink to heading

After your DNS updates finish propagating (you can verify this with a DNS testing tool), all traffic directed to your domain (www.example.com) will flow through the Sucuri Firewall. However, if someone knows your origin server’s IP address, they can bypass the firewall entirely by connecting to that IP directly instead of using your domain.

To stop this from happening, you need to restrict access to your hosting server so that only Sucuri’s IP addresses are allowed to reach it. In your Sucuri dashboard, go to Settings => Security, choose the correct server setup for your hosting configuration, and apply the generated code to your server’s configuration file. This ensures that all visitors must pass through the firewall before reaching your website.

Optimizing Sucuri firewall for better securityLink to heading

Core security enhancementsLink to heading

Restrict Admin Access (IP Whitelisting)

For content management systems (CMS) like WordPress (/wp-admin) or Joomla (/administrator), restrict access to these sensitive directories to only your trusted IP addresses. This is a critical step to prevent brute-force and targeted login attacks.

Enable Advanced Blocking Rules

• Stop Upload of Executable Content: Enable the setting to block users from uploading PHP, Perl, or other executable files. Only disable this if your site explicitly requires user uploads of these file types (e.g., development teams).
• Stop Unfiltered HTML: Prevent users from sending unfiltered HTML content, which helps block cross-site scripting (XSS) attacks by preventing the use of <iframe> and script calls.
• Aggressive Bot Filter: Enable the filter to block invalid user agents that don't match real browsers (like user agents starting with PHP/) to mitigate automated attacks.
• Country/Geo-Blocking: Consider blocking traffic from specific countries or regions that you do not serve and where you see a high volume of malicious traffic or attack attempts.

Security Headers & Virtual Patching

• Additional Security Headers: Enable recommended security headers (like X-XSS-Protection, X-Frame-Options, X-Content-Type-Options) to protect against XSS and clickjacking.
• Virtual Patching: Sucuri's WAF includes virtual patching to protect against exploits targeting known vulnerabilities in outdated software, acting as a temporary shield until you can apply the actual software update.

Emergency and High-Level ProtectionLink to heading

Under Attack Mode/Emergency DDoS Protection

Activate this feature only when your site is under a Distributed Denial of Service (DDoS) attack or severe brute-force attempts. This mode aggressively filters traffic and may temporarily block legitimate visitors, so remember to turn it off immediately after the attack subsides.

Security Level

Explore the "Paranoid" security level if you need maximum protection. Be aware that this mode often prevents POST requests, which can break functionality like comments or form submissions, so test thoroughly before implementing.

Ongoing Configuration and MonitoringLink to heading

Prevent Firewall Bypass

Restrict access to your hosting server so that only Sucuri's Firewall IP addresses can connect directly, ensuring all traffic is filtered by the WAF.

Enable SSL/HTTPS

Ensure SSL is properly configured and enabled on your firewall to encrypt all data in transit and ensure PCI compliance. Sucuri can automatically provide Let's Encrypt certificates.

Integrate Monitoring & Scanning

Utilize Sucuri's built-in malware scanning and file integrity monitoring to regularly check for harmful files and unauthorized changes. Configure alert notifications for suspicious activity and scan results.

Sucuri Firewall vs Cloudflare: Which is better?Link to heading

In summary, both Sucuri Firewall and Cloudflare deliver strong protection, but they excel in different areas. Cloudflare is the superior choice for high-speed content delivery, large-scale DDoS mitigation, and ease of deployment, making it ideal for sites focused on performance and global reach. 

Sucuri, on the other hand, provides deeper application-level security, built-in malware detection, and professional cleanup services - features that make it especially valuable for WordPress websites facing ongoing security threats. The best solution ultimately depends on your priorities: choose Cloudflare for speed and network defense, or Sucuri when maximum security and expert remediation are your top requirements.

>>> Don’t struggle with complex firewalls - let W7SFW protect your website with an easy, effective setup.

ConclusionLink to heading

Securing your WordPress website requires a dependable and well-structured defense strategy, and the Sucuri Firewall remains one of the most trusted solutions for strengthening online protection. By configuring and maintaining it properly, you can significantly reduce exposure to attacks and ensure long-term website stability.