“Firewall” is one of the most stretched words in WordPress security. It’s used for everything from a cloud service that reroutes your DNS to a plugin that checks a blocklist. So it’s worth being precise about what an application firewall actually does — and, just as importantly, what it can’t.
What it does
An application firewall inspects each incoming request — the URL, query string, POST body, cookies and headers — before your plugins run, and blocks the ones that carry an attack. The key word is technique: instead of matching one specific known exploit, a good firewall recognises the shape of an attack class (SQL injection, cross-site scripting, path traversal, remote code execution). That’s why it can stop a brand-new exploit that uses an old technique, without waiting for a specific patch.
It also sees through disguises. Attackers URL-encode, base64 and otherwise obfuscate their payloads to slip past naive filters; the firewall decodes each request first, so the trick doesn’t help.
What it can’t do
A firewall is not a magic shield. It can’t fix a weak admin password, it can’t recover a site that’s already infected, and no honest vendor will claim it blocks every possible threat. A genuinely novel technique, or a legitimate-looking request from a logged-in account that’s already been compromised, is outside what request inspection can catch.
That’s why a firewall is the first layer, not the only one. Pair it with login protection, two-factor authentication, sensible hardening and an integrity scanner, and you’ve covered the doors attackers actually use. A firewall alone is a strong front gate — defence in depth is the whole fence.
