Running with Wordfence

SafeHouse does not need Wordfence, and it works next to it. When Wordfence is active, the SafeHouse features Wordfence already provides step aside on their own, so the two plugins never do the same job twice. This page lists exactly what steps aside and when.

Who does what

Job	With Wordfence active
Firewall, malware scan, two-factor login	Wordfence. SafeHouse has none of these.
Known vulnerabilities in installed software	Wordfence. SafeHouse's Vulnerability alerts module is Unavailable.
Login attempt limits	Wordfence, while its brute force protection is on. Otherwise SafeHouse's Login limits.
Captcha on login and registration	Wordfence Login Security, while its reCAPTCHA is on. Otherwise SafeHouse's Bot protection with Cloudflare Turnstile.
Username discovery, login error masking, version hiding	Whichever Wordfence switches on. SafeHouse's Hardening covers the rest.
Everything else in SafeHouse	SafeHouse. Change alerts, Plugin health, Install lockdown, the rest of Hardening, caching, Omnibus and the site tools never overlap with Wordfence.

What steps aside, exactly

SafeHouse reads Wordfence's own settings on every request. When you change a setting in Wordfence, SafeHouse follows on the next page load.

SafeHouse feature	Steps aside when Wordfence has	What SafeHouse shows
Hardening: Block username discovery	"Prevent discovery of usernames through '/?author=N' scans, the oEmbed API, the WordPress REST API, and WordPress XML Sitemaps" on	"Handled by Wordfence, skipped here."
Hardening: Generic login errors	"Don't let WordPress reveal valid users in login errors" on, and WooCommerce is not active	"Handled by Wordfence, skipped here."
Hardening: Hide the WordPress version	"Hide WordPress version" on	"Handled by Wordfence, skipped here."
Vulnerability alerts (whole module)	Wordfence active, whatever its settings	Unavailable: "Wordfence is active and already warns about vulnerable plugins, themes and WordPress versions."
Login limits (whole module)	"Enable brute force protection" on	Unavailable: "Wordfence brute force protection is on and already limits login attempts."
Bot protection: Turnstile on login and Turnstile on registration	Wordfence Login Security's "Enable reCAPTCHA on the login and user registration pages" on. On a WooCommerce site, only when its "WooCommerce integration" is on too.	"Handled by Wordfence Login Security, skipped here."

Notes on the table:

• Generic login errors keep running on WooCommerce sites even when Wordfence masks login errors, because Wordfence covers wp-login.php and not the WooCommerce My Account login form.
• Bot protection's honeypot on registration, and Turnstile on lost password, comments and checkout, never step aside.
• A field that steps aside is locked on the settings page and keeps its saved value. The feature does not run while Wordfence covers it, even though its switch still shows on.

SafeHouse detects Wordfence by its version constant and its settings class, and the setting names were checked against Wordfence 8.1.4 and 9.0.2.

See what steps aside

On the settings page, look for "Handled by Wordfence, skipped here." next to a field, and for Unavailable badges.

With WP-CLI, the overlaps column lists every field another plugin covers:

wp shouse status

module           enabled  running  source    overlaps
hardening        yes      yes      settings  user_enumeration: Wordfence
...
vulnerabilities  yes      no       settings

The Integrations tab shows whether Wordfence is installed and active, and what SafeHouse does with it.

Run both anyway

To run SafeHouse's features even where Wordfence provides them, add this to wp-config.php:

define( 'SHOUSE_IGNORE_OVERLAPS', true );

Every field that stepped aside runs again, and Vulnerability alerts and Login limits become available. The settings page shows "SHOUSE_IGNORE_OVERLAPS is on: features run even where another plugin already provides them." as a reminder.

Use this only for a reason, for example while you move from Wordfence to SafeHouse. Two login limiters on one site lock people out sooner than either would alone, and two captchas on one form confuse visitors.

The same constant also lets SafeHouse run where other plugins or wp-config.php cover a feature: Jetpack and WooPayments (XML-RPC), the LiteSpeed Cache plugin, other Omnibus plugins and DISALLOW_FILE_EDIT.

Sites without Wordfence

SafeHouse can be the only security plugin. With the default modules on, it warns about known vulnerabilities, limits logins, hardens WordPress and reports risky changes. For a firewall, malware scanning and two-factor login, add Wordfence or rely on your host and Cloudflare. Scope and limits lists what SafeHouse does not do.

Related pages

• Scope and limits
• Hardening
• Login limits
• Vulnerability alerts
• Bot protection