Wordfence

Public plugin, pinned via Composer. Activated in bootstrap.

Wordfence writes firewall rules and logs to wp-content/wflogs. Mount it as an emptyDir:

An emptyDir is correct here — the contents (attack-data cache, rule set) are regenerable, so losing them on a pod restart is acceptable and Wordfence rebuilds them.

Wordfence’s extended protection mode wants to write a wordfence-waf.php auto-prepend file at the web root and edit .user.ini / server config. On a read-only root filesystem it cannot install that, so run Wordfence in basic firewall + scanner + login-security mode. This is an accepted limitation of the immutable design; the scanner and login security (2FA, rate limiting, brute-force protection) work normally.