The Basic firewall inspects the WordPress request: SQL-injection shapes, script markers, path traversal, and probes for leftover files. It runs in PHP on your site. It is not an edge or DNS WAF.

You can run it in monitor-only for a few days on a new site, then switch to blocking. Logged-in admins and allowlisted IPs are treated carefully so wp-admin keeps working.

Floods that never reach PHP need an edge CDN, which requires a nameserver or CNAME change. That is optional and advanced, not part of Bedrock setup. Do I need Cloudflare?