A Small Wordfence Tweak That Made a Big Difference
I stumbled across a curious performance issue while checking a WordPress installation. The site itself was loading extremely quickly from cache, but the WordPress admin felt sluggish and some admin-ajax.php requests were taking 4–6 seconds.
Testing with Wordfence temporarily disabled immediately made the AJAX requests fast, confirming that Wordfence was adding significant overhead to uncached WordPress requests.
The simple fix for the admin interface was even easier: switching “Expand All Results” off in Wordfence Live Traffic made the WordPress admin noticeably quicker.
This could be particularly noticeable on shared hosting, where resources are limited. If you're investigating a performance problem, temporarily disabling Wordfence can be a useful diagnostic test — but only for the shortest possible period needed to identify whether it is contributing to the problem. Don't leave a live site unprotected.
Nothing dramatic and no security settings needed changing — just a small Wordfence tweak that made a surprisingly big difference.
A useful reminder when troubleshooting WordPress performance: test the components individually before blaming the plugin or the hosting.
To Note
A useful diagnostic test: WordPress has its own built-in AJAX endpoint, admin-ajax.php. Testing ?action=heartbeat can help determine whether you're looking at a plugin-specific problem or a wider WordPress/hosting issue. If WordPress's own AJAX requests are slow, the problem may be occurring before the plugin's code even runs
open https://yourdomain.com/wp-admin/admin-ajax.php?action=heartbeat in a incognito private browser tab with wordfence Expand All Results on and off testing that url you can compare loading speed result times.