They do plenty more than that: - Can section off certain requests - Can rate limit - Can catch basic injection attacks With the wafs that integrate with WP

They do plenty more than that: - Can section off certain requests - Can rate limit - Can catch basic injection attacks With the wafs that integrate with WP such as wordfence they can also do things like: - Check for bad file permissions - Check for bad web server configuration - Recieve ruleset updates for zero days that are actually threat surface specific Having a WAF in place that is threat surface specific isn't as much about saying "its not needed if the code is good" as much as it is saying "the code might not always be good. We are not perfect. I'm at least going to have an extra layer or two of defence to try and stay safe(r) and give me some breathing room between an exploit and a patch".