WP Ghost with Wordfence Security – Compatible Configuration and Feature Comparison
October 17, 2021
This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.
WP Ghost (formerly Hide My WP Ghost) and Wordfence Security are fully compatible and complement each other. WP Ghost focuses on hack prevention by changing paths and blocking bots before they reach vulnerable files. Wordfence focuses on threat detection with its application firewall, malware scanner, live traffic monitoring, and threat intelligence feed. Enable shared features (brute force, reCAPTCHA, IP blocking) in one plugin only.
How They Work Together
WP Ghost and Wordfence address security from opposite directions. WP Ghost prevents attacks by reducing the attack surface — changing paths so bots cannot find vulnerable files, blocking known attack patterns with 7G/8G firewall rules, and adding security headers. Wordfence detects and responds to attacks in progress — its application firewall inspects every request against a real-time threat intelligence feed, its malware scanner checks files against known signatures, and its live traffic view shows who is accessing your site. Together, they provide prevention (WP Ghost) plus detection and response (Wordfence).
What to Activate in Each Plugin
Use WP Ghost for:
All path changes (wp-admin, login, wp-content, wp-includes, uploads, plugins, themes, comments, REST API, author, admin-ajax), hide old paths, hide common files, 7G/8G firewall, security headers, 2FA with passkeys, text/URL/CDN mapping, country blocking, and change paths in cached files.
Use Wordfence for:
Application firewall (Web Application Firewall with real-time threat intelligence), malware scanner, file integrity monitoring, live traffic monitoring, and Wordfence Central for multi-site management.
Choose one plugin for shared features:
Both plugins can limit login attempts, enable reCAPTCHA, ban/whitelist IPs, and protect against brute force attacks. Enable these in one plugin only. Wordfence does not change the login path — use WP Ghost for login, lost password, register, logout, and activation path changes.
Feature Comparison
| Feature Category | WP Ghost | Wordfence |
|---|---|---|
| Path Security (wp-admin, login, plugins, themes, uploads, REST API, AJAX) | Yes | – |
| 7G and 8G Firewall (server-level rules) | Yes | – |
| Web Application Firewall (real-time threat intelligence) | – | Yes |
| Security Headers (HSTS, CSP, X-Frame-Options) | Yes | – |
| Two-Factor Authentication (Code, Email, Passkeys) | Yes | Yes |
| Brute Force Protection & reCAPTCHA | Yes | Yes |
| IP Blacklist / Whitelist | Yes | Yes |
| Country Blocking | Yes | Premium |
| Text, URL, and CDN Mapping | Yes | – |
| Malware Scanner | – | Yes |
| File Integrity Monitoring | – | Yes |
| Live Traffic Monitoring | – | Yes |
| Threat Intelligence Feed | – | Yes |
| Activity Log & Email Alerts | Yes | Yes |
| Magic Link Login & Temporary Logins | Yes | – |
Frequently Asked Questions
Will the two plugins conflict?
Not if you avoid enabling the same feature in both. The shared features (brute force, reCAPTCHA, IP blocking, 2FA) should be active in one plugin only. WP Ghost’s path security and Wordfence’s application firewall/malware scanner are unique to each plugin and will not conflict.
Does WP Ghost’s firewall overlap with Wordfence’s firewall?
They work differently. WP Ghost’s 7G/8G firewall uses server-level rewrite rules (.htaccess) that block known malicious patterns before PHP loads. Wordfence’s Web Application Firewall runs at the PHP level and uses a real-time threat intelligence feed. They complement each other — WP Ghost blocks generic attack patterns at the server level, Wordfence blocks specific known threats at the application level.
Do I need Wordfence if I use WP Ghost?
WP Ghost focuses on prevention. Wordfence adds detection (malware scanning, file integrity, live traffic). If you want both prevention and detection, using both is a strong combination. If you only need prevention and your hosting provides malware scanning, WP Ghost alone may be sufficient.
Does WP Ghost modify WordPress core files?
No. WP Ghost uses rewrite rules and WordPress hooks. No core files modified. Deactivating restores all defaults.
Related Tutorials
Customize All WordPress Paths – configure WP Ghost’s unique path security features.
Brute Force Protection – configure brute force in WP Ghost (disable in Wordfence if using this).
Header Security – enable HSTS, CSP, and other headers unique to WP Ghost.
Compatibility Plugins List – all tested security plugins.
Website Security Check – verify your combined configuration.
