Wordfence Keeps Guarding Your Site, Know What It Sees After You Offload
Wordfence scans the files on your server. Infinite Uploads moves your images and videos to cloud storage and a global CDN. Your firewall, login security, and core scans carry on. A file that lives only in the cloud is not on your server, so a local scan cannot read it.
150k+
Sites use our WordPress plugins
Free Plan
10 GB Included
Wordfence and Infinite Uploads: Security on Your Server, Media in the Cloud
Wordfence is a security plugin with a firewall, a malware scan, and login protection. Its scan runs on your web server and reads files on disk, including wp-content and every folder under it. That covers your uploads folder. It does not manage media, so your Media Library works as usual.
Infinite Uploads offloads the Media Library to cloud storage and serves it from a global CDN, with AVIF and WebP Image Optimization on the Business plan. Once local copies are freed, your server holds far fewer files. That helps disk space and backups. It also changes what a local scan can read.
Video Cloud, included on every plan, adds adaptive streaming and a customizable player for videos you upload to the Video Library. Wordfence's default scan skips the contents of common video files such as MP4, so video changes little there. Media Library videos serve from the CDN as-is.
Four Things Infinite Uploads Does for a Wordfence Site
Offloading is not a security feature. These are the parts that matter when your site also runs a scanner and a firewall.
Fewer Files for the Scan to Walk
Wordfence's own docs say a large number of files can make scans slow on weaker servers. Offloading removes media from disk, so a scan has fewer files to walk. If your host limits scan time, Wordfence also offers a low-resource scanning option.
Wordfence Keeps Its Files Out of Uploads
Wordfence stores firewall data and settings in wp-content/wflogs, not in uploads. Infinite Uploads only syncs your uploads folder, so those files stay put. One optional setting can place an .htaccess file in uploads, covered in the table below.
PHP Files in Uploads Stay on Disk
Wordfence's default scan reads PHP files in uploads. Infinite Uploads keeps existing PHP files, such as .php and .phtml, on local disk by default, along with .log and .lock files. They stay where the scan can read them.
Video With No Platform Bill
Host video from your own library instead of paying a video platform. Upload to the Video Library for adaptive streaming in a customizable player, included on every plan. An MP4 in the Media Library serves from the CDN as-is.
Why Sites Pair Wordfence With Infinite Uploads
A Smaller Server, a Smaller Bill
Cloud storage, a global CDN, and Video Cloud on one monthly price. Media leaves your server, so hosting plans stay smaller, backups run lighter, and a media-heavy site does not force an upgrade.
You Choose What to Free Up
Sync first, then decide. Freeing local copies is a separate step, and Download & Disconnect returns them to local disk. Keep copies local for as long as you want Wordfence to read them.
Every Site on One Account
Running Wordfence on every client site? Connect them all to one Infinite Uploads account. Unlimited sites, one invoice, one dashboard, and no cloud credentials to hand over. WordPress Multisite is supported too.
What Works, Feature by Feature
Feature
What you get
Firewall, brute force protection, and login security
The firewall runs in PHP on requests that reach your site. Your rules, 2FA, and blocking settings do not change. Media served from the CDN does not pass through your server.
Works
Core, theme, and plugin file scans
These files, and Wordfence's own firewall data in wp-content/wflogs, sit outside uploads. Infinite Uploads only syncs uploads, so Wordfence reads and compares them as before.
Works
PHP files in uploads
Infinite Uploads keeps existing .php, .phtml, and .phar files in uploads on local disk by default, where Wordfence's default scan can read them.
Works
Image, video, and audio contents
Wordfence's default scan skips the contents of common image, audio, and video files. If you turn on its image and binary option, it reads local files only, so freed copies are not read.
Local files only
SVG, JavaScript, and HTML in uploads
Wordfence's default scan reads these, and Infinite Uploads can offload them. Once the local copy is freed, the file is not on your server for a local scan to read.
Scan first
New uploads after cloud delivery is on
WordPress then writes new uploads straight to cloud storage. They do not land in your local uploads folder, so a local Wordfence scan does not read them.
Not on disk
Code execution block for uploads
Wordfence's optional setting writes an .htaccess file to the uploads path WordPress reports, which is a cloud path while Infinite Uploads is on. Check wp-content/uploads on disk.
Test first
Images and Image Optimization
Photos offload and serve from the CDN. Image Optimization, on the Business plan, adds right-sized AVIF and WebP. Wordfence's default scan does not read image contents, so nothing changes there.
Works
Video on Video Cloud
Upload to the Infinite Uploads Video Library and embed with the Infinite Uploads block or shortcode. Adaptive streaming in the customizable player, included on every plan.
Works, Video Cloud
Up and Running in Three Steps
1. Scan, Then Connect
Run a Wordfence scan and review any findings. Then install Infinite Uploads, connect your account, and sync. Scanning first means a flagged file is dealt with before it is copied to the cloud.
2. Check Your Uploads Folder
If you use Wordfence's code execution setting, look for wp-content/uploads/.htaccess on disk. Then run another scan and confirm it completes and your firewall status is unchanged.
3. Decide on Freeing Local Storage
Free local copies only if you accept that Wordfence will no longer read those files. Keep them if you want it to. Download & Disconnect returns freed files to your server.
Good to Know Before You Switch
Wordfence scans files on your server, not in cloud storage. Its scan covers wp-content and everything under it, and its docs say scanning happens on your web server. Once Infinite Uploads frees a local copy, that file is not on disk to read. Infinite Uploads does not scan files for malware.
Scan before you connect, and decide what to free. Wordfence can only judge files that are on disk. Once cloud delivery is on, new uploads are written to cloud storage instead. Keep local copies of anything you want checked, or free them to save space. This page is not security or legal advice.
Check the code execution setting after you connect. If you enabled Disable Code Execution for Uploads directory, confirm the .htaccess file is still in wp-content/uploads. If it is missing, ask your host about blocking PHP in uploads at the server level. Check the pricing calculator to size your storage.
How We Checked
- Read Wordfence's scan option and firewall documentation.
- Read Wordfence's source for the file types its scan reads by default.
- Read Wordfence's source for what it writes under uploads.
- Read the Infinite Uploads source for kept-local file types and upload paths.
- Reviewed the compatibility scan findings for Wordfence.
Result: the firewall and core scans are unaffected. Local scans read local files only, and the uploads .htaccess needs a check.
Frequently Asked Questions
Does Wordfence scan files stored in cloud storage?
No. Wordfence says its scans run on your web server and read files on disk. A file that exists only in cloud storage is not on your server, so a local scan cannot read it.
Does Infinite Uploads scan for malware?
No. Infinite Uploads offloads and delivers your media. It is not a security scanner and makes no malware claims. Keep Wordfence or another security tool for that job, and check what each one can read.
Does the Wordfence firewall still protect my site?
It still filters requests that reach your server, such as logins and page loads. Media served from the CDN goes to the CDN, so those requests do not pass through the Wordfence firewall.
Does Wordfence scan new uploads?
Once cloud delivery is on, WordPress writes new uploads to cloud storage instead of your local uploads folder, so a local scan does not see them. The firewall still sees the upload request.
Can I keep Wordfence reading my existing media?
Yes. Existing files stay on disk until you free them. Keep them if you want Wordfence's scan to read them. Download & Disconnect copies freed files back to your server.
Where does Wordfence keep its own files?
Firewall data and settings live in wp-content/wflogs, outside uploads. The only Wordfence file that touches uploads is an optional .htaccess, written if you enable its code execution setting.
Can I host video without a video platform?
Yes. Upload to the Video Library for adaptive streaming in a customizable player, included on every plan. An MP4 in the Media Library serves from the CDN as-is, without transcoding.
What if a file is bigger than my upload limit?
Add our free Big File Uploads plugin. It lifts the WordPress upload limit without server changes, so large files upload normally and Infinite Uploads delivers them.
More Plugins That Work With Infinite Uploads
- Infinite Uploads and UpdraftPlus
- Infinite Uploads and WPvivid
- Infinite Uploads and MainWP
- See all integrations
Try Infinite Uploads on the Free Plan
No cloud accounts. No access keys. Install the plugin, connect your site, and your images, videos, and files start moving to the cloud automatically, alongside your Wordfence setup.
Free plan, no credit card. Paid plans from $8.25/mo. Unlimited sites.