Security Plugins That Slow the Site Down

Three plugins for one worry

It usually starts with a scare: a news story about hacked sites, a warning from the host, or a business down the road whose site was defaced.

A security plugin goes on. A few months later, a second one goes on beside it, because an article praised it. Then a third, just for login protection.

The dashboard is now slow to open, pages are slower than they were, and the host has started sending emails about resource limits. The site is not noticeably safer than it was with one.

Where the time goes

• A firewall inside WordPress that checks every request before the page builds.
• Traffic logging that writes every visit to the database.
• Full scans that read every file on the site.
• Scans scheduled in the middle of the business day.
• Two plugins doing the same job twice.
• Alert emails for every blocked login attempt.

The second is the one that grows quietly. A table recording every visit, bots included, can swell until it slows the database, inflates every backup and is never read by anyone.

Why inside WordPress is the expensive place

A security plugin is part of WordPress, so it can only act once WordPress has started. For each request, the server starts PHP and loads WordPress and the plugin before anything can be refused.

That is a lot of work to spend on a bot that should have been turned away at the door. On a busy shared server, it is also work that counts against your account's limits.

Some security features can also interfere with page caching, one of the main things keeping a WordPress site fast.

What the server can do instead

Much of what security plugins do can be done earlier and more cheaply, before a request ever reaches WordPress.

A good host can run a firewall in front of every site, block addresses after repeated failed logins, scan files for known malware on a schedule, and keep each account walled off from the others on the same server.

Ask your host which of those are in place. If the answer is all of them, a plugin duplicating them is spending your site's speed on work already done.

Updates do more than any plugin

The usual way into a small business site is not a clever attack. It is an outdated plugin or theme with a publicly known flaw, and a fix that nobody installed.

A security plugin can sometimes block attempts to use a known flaw. Updating removes the flaw, and deleting plugins and themes that are no longer used removes the code altogether.

A site with a few well-kept plugins, all current, is better placed than one with three security plugins guarding thirty others that nobody has touched in two years.

Updates do occasionally break things, which is why they belong with whoever maintains the site, tested on a copy where it matters, rather than switched off.

A worked example

An independent hardware store had a WordPress site with a product catalogue, a store hours page and a contact form, on a shared hosting plan.

Over two years it had collected three security plugins. One logged every visit, one ran a full scan every morning at ten, and one limited login attempts, a job the first also did.

The host began warning that the account was hitting its limits during the day. The database had grown to many times the size of the site's content, almost all of it visit logs.

Whoever maintained the site removed two of the plugins, emptied the log table and switched logging off. The remaining scan moved to the middle of the night.

The host confirmed its server firewall and login blocking were already active. Plugins and themes have been updated weekly since, and both administrator accounts now use two-factor login.

The warnings stopped, and the dashboard became usable again.

One plugin, set up carefully

Where a plugin is still worthwhile, its settings matter more than its name.

Turn off live traffic logging, or keep only a few days of it. Schedule full scans for the quietest hours of the night.

Send alerts only for events that need a person, such as an administrator login from somewhere new or a changed core file, not for every blocked bot.

And switch off any feature the host already provides, so the same work is not done twice on every request.

Measuring what it costs

Before removing anything, measure, so the decision rests on figures rather than on which plugin sounds safer.

On a copy of the site, time how long the server takes to start sending a page, the time to first byte, with the plugin active and then switched off.

Test a page that is not served from a cache, or the difference hides.

Then check the database size in the hosting control panel, and its largest tables. A log table bigger than everything else combined answers the question on its own.

Protections that cost nothing in speed

Some of the most effective security on a WordPress site adds no weight to any page.

Two-factor login for every administrator. Long, unique passwords kept in a password manager. As few administrator accounts as the business needs, with former staff removed promptly. Backups stored away from the server.

None of these runs when a page loads. All of them close doors that intruders commonly use.

The counter-case

Some sites do need a capable security plugin, and should accept its cost.

Where a host offers no server-level protection, the plugin may be the main line of defence.

A site that has been hacked before benefits from file change monitoring while confidence returns, and a shop may want closer watching than a brochure site.

In those cases, choose one, configure it with care and measure what it costs. Protection works best in layers, starting at the server, with updates and strong logins doing most of the work.

Where to start

1. List every security plugin installed.
2. Ask your host what runs at server level.
3. Remove plugins that duplicate each other.
4. Update everything and delete what is unused.
5. Turn off live traffic logging.
6. Schedule scans for the quietest hours.
7. Add two-factor login for administrators.

Step four matters most. Intrusions on small sites commonly use a flaw that an available update had already fixed, and removing the flaw is more reliable than any plugin's attempt to block it.

The same principle of closing the opening rather than guarding it applies in file upload forms and what people upload.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.