You do not need to change DNS to use Bedrock. Install the plugin, connect once, leave the defaults on. That is the product default.

Bedrock alone is enough for most of those sites. The plugin plus this Hub covers the WordPress request: a firewall, login lockouts, two-factor, a malware scan, and (on Pro) virtual patches.

What Bedrock covers (no DNS): SQL-injection and script-shaped requests, login stuffing, two-factor, file and malware scans, Hub-issued virtual patches on Pro, and the customer dashboard.

What only an edge layer covers: volumetric floods and other attacks that never reach PHP. A CDN or edge WAF (Cloudflare or similar) sits in front of the hostname. That inherently needs a nameserver change or a CNAME. We do not pretend otherwise, and we do not rebuild that edge in PHP.

If you want extra filtering with no DNS change, ask your host whether they already run a host-level WAF such as ModSecurity or Imunify. That is optional. We do not partner with a host.

Is Bedrock enough alone? or Cloudflare later (optional, needs DNS).