Bedrock can run next to a page builder or a cache. Elementor, Gutenberg, WP Rocket, LiteSpeed Cache, WP Super Cache, W3 Total Cache, and similar tools are not a conflict by themselves. Elementor saves widget HTML over its own REST route. Bedrock does not scan that POST body as an attack, so the editor can save custom HTML. Front-end forms still scan. If a cache plugin adds advanced-cache.php or object-cache.php, leave it. Bedrock will note a new drop-in on the next scan so you can confirm it was you.

LiteSpeed Cache (and other page caches) can serve saved HTML to anonymous visitors without running PHP. Bedrock inspects a request only when PHP runs: login, wp-admin, POST, REST, logged-in cookies, and any cache miss. Lockouts and the firewall still run on those. Cached public pages skip inspect until the cache expires. Security headers the plugin sends apply to uncached responses. A cached page keeps the headers that were stored with that HTML. Login, xmlrpc, and block pages send a no-cache signal (DONOTCACHEPAGE) so LiteSpeed Cache, WP Super Cache, and W3 Total Cache do not store a lockout page as public HTML. The malware scanner and WP-Cron always run in PHP. WordPress loads advanced-cache.php before plugins, so the optional must-use loader does not recover a cache hit. On nginx or Apache without a LiteSpeed web server, LiteSpeed Cache often cannot honor a native page-cache HIT, so PHP and Bedrock still run on every request.

Two request firewalls is the one pairing to watch. Wordfence, Solid Security, Sucuri, All-In-One WP Security, and similar plugins also inspect logins and requests. Two lockouts can block the same visitor twice. Leave one firewall on, or put Bedrock in monitor-only for a few days, then pick one.

The plugin dashboard shows a one-line note when it sees another security plugin or a page cache. We do not turn anything off for you. You never change DNS.

What the firewall blocks or How to connect.