WAF vs. Malware Scanning vs. Cleanup: What Hosting Security Includes
A web application firewall, a malware scan and a cleanup service answer different questions. When comparing hosting security, identify which protections are included, where they operate and who acts on their results. A bundle called “website security” may combine these services, but the name alone does not establish coverage.
Compare the task each feature performs
Cloudflare’s WAF documentation describes rules that inspect incoming web and API requests and filter unwanted traffic. That is a request-control function. A malware investigation asks whether harmful code or content is already present, while cleanup is the work of remediating the affected environment.
| Feature | Main question | Question to ask before purchase |
|---|---|---|
| Web application firewall (WAF) | Which incoming requests should be allowed, blocked or challenged? | Where does it run, what traffic reaches it and who tunes the rules? |
| Malware scanning | What suspicious code or behavior does this scan detect? | Which files, data or public responses are inspected, and what is excluded? |
| Malware cleanup | Who investigates and remediates an identified compromise? | Is removal included; what are its limits, prerequisites and fees? |
| Backups and restoration | Which earlier site state can be recovered? | How is a suitable recovery point selected and verified? |
| Application maintenance | Who keeps the installed application components current? | Which updates are handled and who checks functionality afterward? |
Use this table to compare written scopes, not to award a security score. Two products may use the same label while providing different tasks. Record the exact plan, required add-ons, activation steps and support route.
Check where firewall protection applies
For Cloudflare specifically, its managed-rule troubleshooting guidance says protection applies to proxied traffic. It also identifies undeployed rulesets and exceptions as things to check when attacks reach the origin. Ask your administrator to verify the applicable hostnames, traffic path and active configuration rather than assuming that DNS setup alone proves coverage.
Cloudflare’s origin protection guidance discusses restricting or authenticating access to the origin. Have the server owner choose an approach compatible with the hosting environment and legitimate integrations. A request path that bypasses an edge control needs separate consideration. The configuration for an application-level firewall is different, so use that product’s own documentation.
Verify legitimate workflows after rule changes
A new rule can affect a form submission, upload, login or integration callback. Keep a record of the rule change, the relevant request and the customer impact. Use provider-supported testing rather than sending exploit payloads to production.
If a legitimate workflow is blocked, investigate the matching event with the rule owner. Cloudflare documents false positives and recommends targeted changes instead of disabling an entire ruleset for one problematic rule. Write down the reason for any exception and review it later. For operational symptoms, use the website troubleshooting checklist.
Ask what a malware scan can actually inspect
WordPress’s incident guidance distinguishes external remote scanners from application-level scanners and notes that they look for different things. Ask a vendor to list its coverage rather than treating every clean result as equivalent.
- Does the scan inspect public pages, local files, database content or some combination?
- What happens to components the service cannot inspect?
- Who receives a finding, what detail is provided and how is an uncertain result investigated?
- Does the service only notify you, or does the plan include remediation?
- Who verifies the business workflows after cleanup?
Keep the answers with the security responsibility record. A notification is useful only when somebody owns the next action.
Keep cleanup and backups in the buying decision
Ask a host to walk through a suspected compromise on the exact plan you are considering. Identify who preserves evidence, investigates scope, authorizes recovery and checks the result. Use the malware recovery checklist to structure that conversation.
Backups can support recovery, but selecting a copy and addressing the incident remain separate decisions. Review retention and restore testing. Record any uncovered cleanup or maintenance cost alongside the hosting subscription.
For a shortlist, compare managed WordPress hosting and verify the service boundaries using the support scope guide. Choose the combination of services that covers your site’s tasks and gives each task an accountable owner.
Interpret one clean result within its coverage
If a hypothetical external scan finds no issue, record which URLs or exposed content it inspected. That result does not establish that files or private application data outside its coverage are clean. Similarly, a blocked request proves a firewall action on that request, not removal of an existing infection. Use incident recovery when evidence calls for investigation and remediation.
Sources and scope
Official Cloudflare and WordPress documentation checked October 5, 2026. Feature questions and the comparison table are HRL’s editorial guidance. This page does not report penetration tests, scanner accuracy tests or provider cleanup tests.