Fair comparisons at the category level — what each approach actually does, and where they're complementary rather than competing.
Running-WordPress security plugin (firewall, malware scanning, login protection)
Wordfence protects and monitors WordPress while it keeps running normally — a web application firewall, malware scanning, and login-security features, all operating on the live PHP application.
Running-WordPress hardening plugin (login/2FA, firewall, security headers)
Really Simple Security focuses on hardening a running WordPress install directly — stronger login protection, two-factor authentication, and security headers, applied while WordPress serves every request as normal.
Cache plugins and manual static-export tools
WordPress has a long history of caching plugins (page caching, object caching) and manual static-export tools that dump pages to flat files. Both can improve performance; neither is designed primarily around reducing what's publicly reachable.
Architecture: WordPress as a pure content API behind a separately built frontend
Headless WordPress decouples the frontend entirely — WordPress becomes a content API, and a separate application (often a JavaScript framework) renders the actual site. It's a real architecture change, not a plugin.
Tulapp