FAQ
Short answers to common SiteFort questions on setup order, scan types, performance, licensing, Cloudflare Sync, IP Detection, security headers, and sensitive tools.
SiteFort FAQ
What should I enable first after installing SiteFort?
Run the setup wizard rather than configuring modules one by one. It walks you through the order that actually matters: activate your license, apply the core hardening controls, verify IP Detection, turn on firewall protection, then run your first security scan. Once that baseline is stable, layer on the stricter controls, Cloudflare Sync, country rules, CAPTCHA, Content Security Policy, and custom notification routing.
Will SiteFort slow down my site?
No meaningfully noticeable slowdown for normal traffic. Malware scanning runs through cloud-based analysis rather than tying up your own server's CPU, and the firewall's request checks are designed to add negligible overhead per request. If a page does feel slower right after installation, it's almost always something else, a heavy Deep Scan running mid-day, or Content-Security-Policy still in a testing phase, not the plugin's baseline footprint.
Should I use Standard Scan or Deep Scan?
Use Standard Scan for normal daily protection. Reach for Deep Scan specifically when you suspect a compromise, right after a cleanup, before a launch, or when a Standard Scan finding suggests something deeper is going on.
What happens if my scan credits run out?
Cloud scanning pauses until credits reset for your billing period or you upgrade. Origin-level protection, the firewall and hardening controls, keeps running the whole time; only the cloud-powered malware analysis is affected. Don't work around this by excluding folders from scanning just to conserve credits, that just creates a blind spot instead of solving the actual limit.
Can I use Cloudflare Sync without Cloudflare DNS proxying?
You can connect the account and SiteFort will verify credentials and prepare rules for the configured zone, but edge blocking only affects traffic that actually routes through Cloudflare. If your DNS records aren't proxied, requests go straight to your server and none of the edge-level enforcement applies.
Do I need Cloudflare or MaxMind to use Country Blocking?
Yes, Country Blocking needs a GeoIP source to know where a request is coming from. If the site is behind Cloudflare, SiteFort can use Cloudflare's country headers directly. If not, connect MaxMind GeoIP under Settings > Integrations, both are free to set up.
Why is IP Detection so important?
Every firewall decision starts with knowing the real visitor IP. If the wrong header is being read, whether because of a proxy, CDN, or load balancer in front of WordPress, bans, allowlists, country rules, rate limits, and lockouts can all end up targeting the wrong person entirely.
Will Trusted IPs bypass all firewall checks?
Yes, completely. Trusted IPs skip every firewall rule, including scanner detection, rate limiting, and the community blocklist. Reserve the list for IPs you actually control: a stable office connection, an agency VPN, or a monitoring service, never a broad range or a shared exit node.
Can Security Headers break a WordPress site?
Most headers are low risk and safe to turn on right away. Content-Security-Policy and HSTS are the two that need a careful rollout: test CSP in Report Only mode before enforcing it, and only enable HSTS preload once every subdomain is actually HTTPS-ready, since it's difficult to walk back afterward.
What should I do before using sensitive tools?
Back up the site first, and know exactly what you're about to change before you click confirm. Salt regeneration logs every user out immediately, encryption key rotation touches every stored secret, a database prefix change modifies tables directly, and migrating User ID 1 forces a logout for the account being changed. None of these are reversible with an undo button.
Does SiteFort conflict with other security plugins?
Running two active firewalls or two login-lockout systems side by side is where most conflicts actually come from, duplicate rules, contradictory rate limits, or a visitor getting blocked by one plugin while the other insists they're fine. If you're migrating from another security plugin, disable its firewall and login protection features before turning SiteFort's on, rather than running both simultaneously.
What's the difference between SiteFort Free, Pro, and Managed?
Free includes full hardening and firewall protection at no cost. Pro adds cloud-powered malware scanning, scheduled scans, and priority features for $99 per year. Managed is built for teams that want the heaviest lifting handled for them, incident response support included, at $299 per year for a single site, or $249 per site per year at five or more sites. Agencies managing several client sites can also connect them all to the free Securewp Console for centralized monitoring regardless of which SiteFort plan each site runs.
Can I use SiteFort on a WordPress Multisite network?
Yes. Network Security, available to Multisite network administrators specifically, lets you enforce firewall and hardening policy across every subsite from one place, or propagate the main site's configuration out as a starting template, instead of configuring each subsite individually.