Wordfence Security runs its Web Application Firewall inside WordPress, where it identifies and blocks malicious requests. The plugin also scans site files and content, includes login controls, and shows live traffic. Its paid plans change the timing of threat updates and the level of support available.

How the security tools work

The firewall can limit login attempts to help protect against brute-force attacks. Login Security includes passkeys, TOTP-based two-factor authentication, login page CAPTCHA, and an option to block administrator logins that use known compromised passwords.

The scanner checks WordPress core, themes, and plugins for malware, backdoors, bad URLs, SEO spam, malicious redirects, and code injections. It compares files with repository versions, checks for known vulnerabilities, and scans files, posts, and comments for dangerous URLs or suspicious content. Scan results can report changed files and issues with closed or abandoned plugins. You can overwrite changed files with original versions or delete files that do not belong. Review findings and back up files before using file-management tools.

Live Traffic records visits and hack attempts with details such as origin, IP address, time, and time spent on the website. Blocking rules can use an IP address or range, hostname, visitor agent, or referrer. Country blocking is included with Premium.

What the paid plans include

• Wordfence Premium: A Premium API key enables real-time Threat Defense Feed updates, including firewall rules, malware signatures, and a real-time IP blocklist. Premium also includes premium support, more frequent scans, spam and spamvertising checks, and the Security Audit Log. The log monitors changes and actions in security-sensitive areas, with remote tamper-proof storage through Wordfence Central.
• Wordfence Care: Includes hands-on support with security incidents and a yearly security audit.
• Wordfence Response: Provides 24/7/365 incident response team support. The stated response time is one hour, with a maximum of 24 hours to resolve a security issue.

Wordfence works with WordPress Multisite. A network administrator can scan every blog in the installation with one click; Live Traffic can show activity across the network. After installing and activating the extension, start a scan and review its findings. Set email recipients for security alerts, then choose a paid plan based on the feed updates, audit, or incident support your site needs.