Wordfence Security brings an endpoint firewall, malware scanner, login security, and Live Traffic into your WordPress site. The firewall identifies and blocks malicious requests, while login protection can limit attempts to help guard against brute-force attacks.

Choose a plan for the support you need

• Wordfence Premium: A Premium API key provides real-time Threat Defense Feed updates, including firewall rules, malware signatures, and a real-time IP blocklist. Feed updates in the free version are delayed by 30 days. Premium also includes premium support, country blocking, more frequent scans, spam and spamvertising checks, and the Security Audit Log, which monitors changes and actions in security-sensitive areas.
• Wordfence Care: Hands-on support, including help with security incidents, plus a yearly security audit.
• Wordfence Response: 24/7/365 support from the incident response team. The described service terms specify a one-hour response time and a maximum of 24 hours to resolve a security issue.

Use scan results to investigate changes

The scanner checks core documents, themes, and extensions for malware, bad URLs, backdoors, SEO spam, malicious redirects, and code injections. It compares files with versions in the official WordPress repository and reports changes. If a file has changed, Wordfence can optionally overwrite it with an original version. The interface also lets you delete files that do not belong. Review scan findings and back up files before deleting them.

The scanner also checks for known security vulnerabilities and suspicious URLs or content in files, posts, and comments. Alerts can flag issues such as a add-on being closed or abandoned.

Review traffic and block attackers

Live Traffic shows visits and hack attempts, including their origin, IP address, time, and time spent on your website. You can block an attacker by IP or create rules using an IP range, hostname, visitor agent, or referrer. Country blocking is included with Wordfence Premium. Security alerts can track administrator logins, breached password use, and increases in attack activity.

Install and start scanning

1. Install Wordfence Security on your WordPress site.
2. Choose a paid plan for the feed updates, support, audit, or incident response you need.
3. If using Premium, enter the Premium API key for paid Threat Defense Feed updates.
4. Review firewall, scanning, Live Traffic, login security, and alert settings.
5. Use scan results and traffic data to investigate suspicious activity and apply available blocking or file-management utilities.

WordPress Multisite is supported. Network-activate the plugin to scan blogs across the network, and start a scan from the Network Admin menu.