Sucuri: Website firewall and CDN

Explore Sucuri’s website firewall, CDN and virtual patching, how it works with an existing host, and what site owners still need to maintain.

Updated 8 September 2026

What Sucuri is used for

Sucuri combines a cloud website firewall with content delivery and website security services. Its firewall sits in the request path before the hosting server, where it can reject traffic that matches protective rules. This is different from a plugin that runs only after a request has reached the CMS.

An agency maintaining several client sites could use a firewall as one shared layer of protection while continuing to manage each site’s themes, extensions and hosting separately. The firewall does not become the place where editors write content.

Virtual patching and CDN caching

Sucuri describes virtual patching as blocking exploit attempts without modifying the vulnerable site code. It can provide interim protection when an update is delayed by a compatibility problem. The original software issue still exists until the affected component is updated or removed.

The CDN also caches eligible content. For example, a public article can have different delivery requirements from an editor’s preview. Treat security filtering and cache freshness as two settings to test, rather than assuming that activating the firewall settles both.

Monitoring, malware cleanup and recovery

Sucuri’s Website Security Platform includes monitoring and response services alongside the firewall. Monitoring looks for signs of compromise; malware removal addresses an already-infected website. Blocklist assistance helps with the consequences of a compromised site, while backups support recovery. These are different stages of protection and remediation.

For example, a firewall may prevent a known exploit from reaching a site, but an earlier infection can still need file cleanup and credential changes. Sucuri’s broader service addresses that response work, with the included features determined by the selected plan.

Connecting and maintaining a protected site

A typical firewall activation changes DNS so web requests pass through Sucuri. Check that the certificate, origin connectivity and normal site workflows work after the change. Include contact forms, uploads and administrator access in that verification.

Keep backups and updates on their own schedule. Website monitoring, malware cleanup and traffic filtering address different stages of an incident; seeing a Sucuri response does not establish which services a customer has purchased.

How DNSTrace.dev detects Sucuri

Detection correlates independent public signals. A single match is reported as strong evidence; agreement between a response header and the announcing network is reported as confirmed.

x-sucuri-id — Identifies the Sucuri node that handled the request.
x-sucuri-cache — Cache outcome at the Sucuri edge.
server: Sucuri/Cloudproxy — The Sucuri proxy software.

What a detection proves

A Sucuri firewall node answered the request.

What it does not prove

The origin host, or that the site is free of the malware the firewall is meant to block. A firewall in front of a site is not an assessment of the site itself.

Common questions about Sucuri

Can Sucuri protect a site without moving its hosting?

Yes. The cloud firewall can sit in front of an existing website by changing its DNS routing. The hosting server continues to run the site while Sucuri filters the requests that pass through its network.

Does a Sucuri detection mean the site was hacked?

No. Sucuri is bought both after an incident and as ordinary protection. Its presence says nothing about the state of the site behind it.

Security edge and WAF