How to Setup Wordfence for Dual WordPress

Hi @shaileshghadge, thanks for your question.

It is recommended to have a Wordfence installation for each WordPress site, rather than relying on one for the whole contents of a parent directory.

You should be able to install Wordfence from WordPress > Plugins > Add New directly on the “child” Site B like you would with Site A. Subdirectory installations of WordPress where the parent installation is being picked up is usually fine to replace/override the auto_prepend_file when prompted.

Please check the documentation on firewall optimization for more information about picking the override option: https://www.wordfence.com/help/firewall/optimizing-the-firewall/troubleshooting/

For efficiency, you can exclude the subdirectories from being checked by the parent site in Wordfence > All Options > Advanced Scan Options > Exclude files from scan that match these wildcard patterns and Wordfence > All Options > Activity Report > List of directories to exclude from recently modified file list.

More about how to format wildcard patterns: https://www.wordfence.com/help/scan/options/#exclude-files

Thanks,
Peter.

Thanks for your reply.

1. I have setup wordfence on both domain.com (Site A) & domain.com/blog (Site B)
2. I have not done the  auto_prepend_file  process via the top notification to further optimize wordfence. Due to fear of breaking the Sites. I presume this is optional.
3. My Both Sites went down at 12:45am around. After reboot the AWS Instance, both came up. I installed crontab plugin and noticed that only Wordfence cron daily & wordfence cron update are scheduled for 12:43am. So. I have disabled autoupdate, that reduced one cron, but the wordfence cron daily is still present which might again cause a downtime at 12:45am. Pl help what to do for this.
4. “Whether I should add anything in htacess of SiteA, so that URL of /blog/ are not processed through the htaccess;s wordpress code and goes directly to execute on wordpress of SiteB.” (this 4th point, non-wordfence query. But, will really appreciate help on this,)

• This reply was modified 1 year, 10 months ago by Shailesh.
• This reply was modified 1 year, 10 months ago by Shailesh.

Hi @shaileshghadge,

Regarding your second point, optimization is technically optional but highly recommended as Basic Protection is simply not as secure. An optimized firewall deals with bad/malicious requests before any of your site content is hosted to the visitor.

The daily cron shouldn’t take the sites down, although if you have access logs for the time of day when it occurs, we could see if wp-cron is running twice at the same time, which could cause an error on busy sites since WordPress locking for cron jobs is not perfect.

Unfortunately I’m unable to assist with non-Wordfence queries but you should be able to redirect /blog via a Google search about .htaccess syntax if necessary.

Thanks,
Peter.