The blog of WordFence has been quite informative over the years. Many plugins, and even WordPress Core, have had security issues. Some really bad ones get used

The blog of WordFence has been quite informative over the years. Many plugins, and even WordPress Core, have had security issues. Some really bad ones get used from a very early stage. So I do think there is some merit in being more on top of it. Updates and backups are also part of your strategy, being hacked and having to comb through the live database for 'eval()' and 'base64()' and other scary stuff is not that great. The thing about mod_security is that it is server based. If you are on a shared host you have no control over this and every shared host has a different setup. And if you maintain the server, well, mod_security is not that easy to get right and to stay on top of things. Wordfence adds its own weaknesses ofcourse, it is more code that needs to be vetted. But for recognizing an intrusion or hack, it can work quite well I think. (haven't been hacked in years). This thing about server or account based is similar when it comes to caching of generated html pages, Varnish is server wide, a plugin is WP wide.