by Mark Maunder 4.7 (5,002 reviews)

Wordfence Security - Firewall, Malware Scan, and Login Security

Name: Wordfence Security - Firewall, Malware Scan, and Login Security
Rating: 4.7 (5002 reviews)
Author: Mark Maunder

Firewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team. Make security a priority with Wordfence.

Wordfence Security ranks #11 among WordPress.org plugins with 5,000,000+ active installations, is #1 of 1,576 in the Authentication category, a 4.7/5 rating from 5,002 reviews, and was last updated Sep 8, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1

v9.0.1 Current Version v9.0.1

Updated 1 week ago Last Update on 08 Sep, 2026

Refreshed 10 hours ago Last Refreshed on

#1 of 1,576 in Authentication Top 1% by installs Downloads +328.3% this week Actively maintained

View on WordPress.org

Rank

#11

— No change

Active Installs

5M+

— No change

KW Avg Position

— No change

Downloads

406.9M

+43,818 today

Support Resolved

72%

— No change

Rating

94%

Review 4.7 out of 5

4.7 (5,002 reviews)

Next Milestone 6M

Total Progress 0%

5M+ 6M+

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 1,000,000 more installs to reach 6M+

Rank Changes

Current #11

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

4.7

5,002 reviews

Overall 94%

4,511 (90%)

119 (2%)

70 (1%)

45 (1%)

257 (5%)

Support Threads Overview

Resolved

Unresolved

178

Total Threads

128

Resolved

Unresolved

72%

Resolution Rate

Security History

Source: WPVulnerability

34 known vulnerabilities on record · 0 in the last 24 months · checked 1 week ago

Sep 6, 2022

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 7.6.1

CVE-2022-3144 · Fixed in v7.6.1
Apr 25, 2019

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] <= 7.2.3

CVE-2019-9669 · Affected <= 7.2.3
Oct 2, 2018

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 7.1.14

Fixed in v7.1.14
May 10, 2016

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 6.1.7

Fixed in v6.1.7
Jun 24, 2015

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4

Fixed in v5.2.4
May 15, 2015

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.3

Fixed in v5.2.3
May 15, 2015

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.3

Fixed in v3.8.3
May 15, 2015

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.3.7

Fixed in v3.3.7
May 15, 2015

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.5

Fixed in v5.2.5
May 15, 2015

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.7

Fixed in v3.8.7

Showing the 10 most recent of 34 records.

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 9.0.1
Last Updated: Sep 08, 2026
Requires WP: 4.7+
Tested Up To: 7.1
PHP Version: 7.0 or higher
Author: Mark Maunder

Support & Rating

Rating: ★ ★ ★ ★ ★ 4.7
Reviews: 5,002
Support Threads: 178
Resolved: 72%

Keywords

2FA firewall malware scanner security

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,752

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,007

WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

All-In-One Security (AIOS) – Security and Firewall

1M+ installs

#62

MainWP Child - Securely Connects to the MainWP Dashboard to Manage Multiple Sites

700K+ installs

#86

Kadence Security – Password, Two Factor Authentication, and Brute Force Protection

700K+ installs

#87

View all Authentication plugins

TL;DR

AI summary of the plugin's readme

This plugin is for WordPress site owners and administrators who need to protect their sites from hacking attempts and malware. It provides a web application firewall, malware scanning, and login security features to detect and block malicious traffic and code.

Web Application Firewall
Real-time firewall rule updates
Real-time IP Blocklist
Malware scanner
Core file integrity checking
Two-factor authentication (2FA)
Login Page CAPTCHA
Live Traffic monitoring

Frequently Asked Questions

Common questions about Wordfence Security - Firewall, Malware Scan, and Login Security

The WordPress security plugin provides the best protection available for your website. Powered by the constantly updated Threat Defense Feed, Wordfence Firewall stops you from getting hacked. Wordfence Scan leverages the same proprietary feed, alerting you quickly about security issues or if your site is compromised. The Live Traffic view gives you real-time visibility into traffic and hack attempts on your website. A deep set of additional tools round out the most comprehensive WordPress security solution available.

We offer a Premium API key that gives you real-time updates to the Threat Defense Feed which includes a real-time IP blocklist, firewall rules, and malware signatures. Premium support, country blocking, more frequent scans, and spam and spamvertising checks are also included. Click here to sign-up for Wordfence Premium now or simply install Wordfence free and start protecting your website.

Web Application Firewall stops you from getting hacked by identifying malicious traffic, blocking attackers before they can access your website. Threat Defense Feed automatically updates firewall rules that protect you from the latest threats. Premium members receive the real-time version. Block common WordPress security threats like fake Googlebots, malicious scans from hackers and botnets.

Scans core files, themes and plugins against WordPress.org repository versions to check their integrity. Verify security of your source. See how files have changed. Optionally repair changed files that are security threats. Scans for signatures of over 44,000 known malware variants that are known WordPress security threats. Scans for many known backdoors that create security holes including C99, R57, RootShell, Crystal Shell, Matamu, Cybershell, W4cking, Sniper, Predator, Jackal, Phantasma, GFS, Dive, Dx and many more. Continuously scans for malware and phishing URL’s including all URLs on the Google Safe Browsing List in all your comments, posts and files that are security threats. Scans for heuristics of backdoors, trojans, suspicious code and other security issues.

See all your traffic in real-time, including robots, humans, 404 errors, logins and logouts and who is consuming most of your content. Enhances your situational awareness of which security threats your site is facing. A real-time view of all traffic including automated bots that often constitute security threats that Javascript analytics packages never show you. Real-time traffic includes reverse DNS and city-level geolocation. Know which geographic area security threats originate from. Monitors disk space which is related to security because many DDoS attacks attempt to consume all disk space to create denial of service.

Wordfence sends security alerts via email. Once you install Wordfence, you will configure a list of email addresses where security alerts will be sent. When you receive a security alert, make sure you deal with it promptly to ensure your site stays secure.

Wordfence provides true endpoint security for your WordPress website. Unlike cloud based firewalls, Wordfence executes within the WordPress environment, giving it knowledge like whether the user is signed in, their identity and what access level they have. Wordfence uses the user’s access level in more than 80% of the firewall rules it uses to protect WordPress websites. Learn more about the Cloud WAF identity problem here. Additionally, cloud based firewalls can be bypassed, leaving your site exposed to attackers. Because Wordfence is an integral part of the endpoint (your WordPress website), it can’t be bypassed. Learn more about the Cloud WAF bypass problem here. To fully protect the investment you’ve made in your website you need to employ a defense in depth approach to security. Wordfence takes this approach.

Real-time blocking of known attackers. If another site using Wordfence is attacked and blocks the attacker, your site is automatically protected. Block entire malicious networks. Includes advanced IP and Domain WHOIS to report malicious IP’s or networks and block entire networks using the firewall. Report WordPress security threats to network owner. Rate limit or block WordPress security threats like aggressive crawlers, scrapers and bots doing security scans for vulnerabilities in your site. Choose whether you want to block or throttle users and robots who break your WordPress security rules. Premium users can also block countries and schedule scans for specific times and a higher frequency.

Wordfence Security provides a WordPress Firewall developed specifically for WordPress and blocks attackers looking for vulnerabilities on your site. The Firewall is powered by our Threat Defense Feed which is continually updated as new threats emerge. Premium customers receive updates in real-time. Wordfence verifies your website source code integrity against the official WordPress repository and shows you the changes. Wordfence scans check all your files, comments and posts for URLs in Google's Safe Browsing list. We are the only plugin to offer this very important security enhancement. Wordfence scans do not consume large amounts of your bandwidth because all security scans happen on your web server which makes them very fast. Wordfence fully supports WordPress Multi-Site which means you can security scan every blog in your Multi-Site installation with one click. Wordfence includes passkeys and Two-Factor authentication to help secure WordPress accounts against phishing and brute-force attacks. Wordfence fully supports IPv6 including giving you the ability to look up the location of IPv6 addresses, block IPv6 ranges, detect IPv6 country and do a whois lookup on IPv6 addresses and more.