Wordfence is a WordPress security plugin providing an endpoint web application firewall, malware and file-integrity scanning, and login security from inside the WordPress install. It is a security plugin, not a backup tool, a caching plugin or a cloud CDN firewall.
Who makes Wordfence
Wordfence is published by Defiant Inc., a US-headquartered WordPress security company that also runs a public threat-research operation. The plugin is distributed free on WordPress.org, with a paid Wordfence Premium licence and separately-sold Wordfence Care and Wordfence Response services in which vendor staff perform configuration, monitoring or incident handling.
Official website: www.wordfence.com ↗
What it actually does
Documented capabilities include an endpoint web application firewall running inside WordPress, a malware scanner that compares core, theme and plugin files against known-good versions, login security with two-factor authentication and brute-force protection, live traffic visibility, and a threat-intelligence feed of malware signatures and firewall rules. The paid licence documents real-time firewall rule updates, real-time malware signatures, real-time IP blocklisting, country blocking and reputation checks rather than the delayed community feed. Wordfence Central is a free hosted console for managing several Wordfence installations from one place.
Product family
- · Endpoint web application firewall
- · Malware and file-integrity scanning
- · Login security and two-factor authentication
- · Live traffic visibility
- · Threat-intelligence feed
- · Multi-site management (Wordfence Central)
What people hire it for
- Adding firewall and malware scanning to a commercially load-bearing WordPress site
- Enforcing two-factor authentication and brute-force protection on administrator accounts
- Detecting unexpected changes to core, theme or plugin files
- Consolidating security state across an agency or multi-site estate via Central
- Hardening a site on hosting whose patching and isolation policy cannot be verified
Where it runs
Where Wordfence appears
Featured in these buying guides
Not yet included in a Best-Of round-up. Editorial planned for the next update cycle.
Head-to-head
No comparisons scheduled yet.
Planned reviews
Full review published — read it here.
Read next
- WP RocketA premium WordPress caching and performance plugin — page caching, asset optimisation and Core Web Vitals work from one settings screen.
- UpdraftPlusThe WordPress backup plugin most sites end up on — and the reason to pay is incremental backups, remote storage choice and one-click migration.
- Rank MathA WordPress-native SEO plugin with an unusually generous free tier — the PRO decision is really about rank tracking, schema depth and client sites.
- WPFormsThe WordPress form builder most sites default to — worth buying for logic, uploads and point-of-submission payments, not for capture your CRM already does.
- ImagifyCloud image compression with WebP and AVIF conversion — worth buying for a real library of unoptimised originals, not for a job your CDN is already doing.