Wordfence Security
PluginFirewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team. Make security a priority with Wordfence.
- 0 Sterne
- 0 Beobachter
- 0 Downloads
- GPL-3.0-only
Versionen 28
-
9.1.1 Neueste
Improvement: Updated bundled cacert.pem Versionshinweise
-
Change: Changed IPv6 diagnostics result to be informational only Versionshinweise
-
Fix: Fixed an issue with inetpton introduced by a recent patch to PHP 8.1+ that could cause a fatal error if a malformed IP address was pass... Versionshinweise
-
Improvement: Updated the bundled geoip database Versionshinweise
-
Improvement: Updated the bundled geoip database Versionshinweise
-
Fix: Compatibility fixes for WordPress 6.8 Versionshinweise
-
Improvement: Improved error handling and messaging for some responses from our servers Versionshinweise
-
Improvement: Added support for hosts relocating the WAF's auto-prepend file via the constant/envvar WORDFENCEWAFPREPENDDIRECTORY Versionshinweise
-
Improvement: General compatibility improvements and better error handling for PHP 8+ Versionshinweise
-
Improvement: Updated GeoIP database Versionshinweise
18 ältere Versionen anzeigen
-
Improvement: Introduced the Wordfence Audit Log, a new premium feature to monitor all changes and actions in security-sensitive areas of the... Versionshinweise
-
Improvement: Optimized scan performance by reducing database queries by approximately 38% along with CPU usage Versionshinweise
-
Improvement: Revised the strong password requirements notice to be more readable Versionshinweise
-
Fix: Revised the behavior of the reCAPTCHA verification to use the documented expiration period of the token and response to avoid sending v... Versionshinweise
-
Change: CAPTCHA verification when enabled now additionally applies to 2FA logins (may send an email verification on low scores) and no longe... Versionshinweise
-
Fix: Fixed an issue with sites containing invalid Wordfence Central site data where they could throw an error when viewing Wordfence pages Versionshinweise
-
Improvement: Enhanced the vulnerability scan to check and alert for WordPress core vulnerabilities and to adjust the severity of the scan re... Versionshinweise
-
Improvement: Added ".env" to the files checked for "Scan for publicly accessible configuration, backup, or log files" Versionshinweise
-
Improvement: Added new functionality for trusted proxy presets to support proxies such as Amazon CloudFront, Ezoic, and Quic.cloud Versionshinweise
-
Fix: Compatibility fix for WordPress 6.4 on the login page styling Versionshinweise
-
Fix: Addressed an issue with multisite installations when the wpoptions tables had different encodings/collations Versionshinweise
-
Improvement: Updated GeoIP database Versionshinweise
-
Fix: Prevented bundled sodiumcompat library from conflicting with versions included with older WordPress versions Versionshinweise
-
Improvement: Added support for processing arrays of files in the WAF Versionshinweise
-
Improvement: Added translation support for strings from login security plugin Versionshinweise
-
Improvement: Added exception handling to prevent WAF errors from being fatal Versionshinweise
-
Improvement: Updated GeoIP database Versionshinweise
-
Launch of Wordfence Care and Wordfence Response Versionshinweise
124 noch nicht verfügbare Versionen anzeigen
Releases, die im Changelog des Anbieters oder auf WordPress.org genannt werden und die das Repository noch nicht enthält.
-
9.1.0 Noch nicht verfügbar
Improvement: Added security news widget to the WordPress and Wordfence dashboards
-
9.0.1 Noch nicht verfügbar
Improvement: UX enhancements for passkey authentication and general login security
-
9.0.0 Noch nicht verfügbar
Improvement: Added support for passkey authentication
-
8.2.2 Noch nicht verfügbar
Improvement: Better presentation of Live Traffic data on wide screens
-
8.2.1 Noch nicht verfügbar
Fix: Fixed issue with some i18n plugins/themes when a user has no 2FA recovery codes
-
8.2.0 Noch nicht verfügbar
Improvement: Migrated all deprecated JavaScript libraries in use to a Vue-based infrastructure
-
8.1.1 Noch nicht verfügbar
Improvement: Improved localization support for the various block screens and messages
-
8.1.0 Noch nicht verfügbar
Improvement: Added password scanning support for WordPress 6.8 and later
-
7.10.5 Noch nicht verfügbar
Improvement: Updated the bundled GeoIP database
-
7.10.4 Noch nicht verfügbar
Improvement: "Admin created outside of WordPress" scan results may now be reviewed and approved
-
7.9.2 Noch nicht verfügbar
Improvement: The vulnerability severity score (CVSS) is now shown with any vulnerability findings from the scanner
-
7.9.1 Noch nicht verfügbar
Improvement: Further improved performance when viewing 2FA settings and hid user counts by default on sites with many users
-
7.9.0 Noch nicht verfügbar
Improvement: Added 2FA management shortcode and WooCommerce account integration
-
7.8.2 Noch nicht verfügbar
Fix: Releasing same changes as 7.8.1, due to wordpress.org error
-
7.8.1 Noch nicht verfügbar
Improvement: Added more granualar data deletion options to deactivation prompt
-
7.8.0 Noch nicht verfügbar
Improvement: Added feedback when login form is submitted with 2FA
-
7.7.1 Noch nicht verfügbar
Fix: Prevented scan resume attempts from repeating indefinitely when the initial scan stage fails
-
7.7.0 Noch nicht verfügbar
Improvement: Added configurable scan resume functionality to prevent scan failures on sites with intermittent connectivity issues
-
7.6.2 Noch nicht verfügbar
Improvement: Hardened 2FA login flow to reduce exposure in cases where an attacker is able to obtain privileged information from the databas...
-
7.6.1 Noch nicht verfügbar
Fix: Prevented XSS that would have required admin privileges to exploit (CVE-2022-3144)
-
7.6.0 Noch nicht verfügbar
Improvement: Added option to start scans using only IPv4
-
7.5.11 Noch nicht verfügbar
Improvement: Added option to toggle display of last login column on WP Users page
-
7.5.10 Noch nicht verfügbar
Improvement: Improved scan support for sites with non-standard directory structures
-
7.5.7 Noch nicht verfügbar
Improvement: Made preliminary changes for compatibility with PHP 8.1
-
7.5.6 Noch nicht verfügbar
Fix: Prevented login errors with WooCommerce integration when manual username entry is enabled on the WooCommerce registration form
-
7.5.5 Noch nicht verfügbar
Improvement: Enhanced accessibility
-
7.5.4 Noch nicht verfügbar
Fix: Resolve conflict with woocommerce-gateway-amazon-payments-advanced plugin
-
7.5.3 Noch nicht verfügbar
Improvement: Expanded WAF capabilities including better JSON and user permission handling
-
7.5.2 Noch nicht verfügbar
Fix: Fixed fatal error on single-sites running WordPress
-
7.5.1 Noch nicht verfügbar
Fix: Fixed fatal error when viewing the Login Security settings page from an allowlisted IP.
-
7.5.0 Noch nicht verfügbar
Improvement: Translation-readiness: All user-facing strings are now run through WordPress's i18n functions.
-
7.4.14 Noch nicht verfügbar
Improvement: Added option to disable application passwords.
-
7.4.12 Noch nicht verfügbar
Improvement: Initial integration of i18n in Wordfence.
-
7.4.11 Noch nicht verfügbar
Improvement: Added diagnostic debug button to clear Wordfence Central connection data from the database.
-
7.4.10 Noch nicht verfügbar
Improvement: Prevent author sitemap from leaking usernames in WordPress >= 5.5.0.
-
7.4.9 Noch nicht verfügbar
Improvement: Added list of known malicious usernames to suspicious administrator scan.
-
7.4.8 Noch nicht verfügbar
Fix: Fixed issue with fatal errors encountered during activation under certain conditions.
-
7.4.7 Noch nicht verfügbar
Improvement: Updated bundled GeoIP database.
-
7.4.6 Noch nicht verfügbar
Improvement: Enhanced the detection ability of the WAF for SQLi attacks.
-
7.4.5 Noch nicht verfügbar
Improvement: Improved WAF coverage for an Infinite WP authentication bypass vulnerability.
-
7.4.4 Noch nicht verfügbar
Fix: Fixed a UI issue where the scan summary status marker for malware didn't always match the findings.
-
7.4.3 Noch nicht verfügbar
Improvement: Added WAF coverage for an Infinite WP authentication bypass vulnerability.
-
7.4.2 Noch nicht verfügbar
Improvement: Increased performance of IP CIDR range comparisons.
-
7.4.1 Noch nicht verfügbar
Improvement: Updated the bundled GeoIP database.
-
7.4.0 Noch nicht verfügbar
Improvement: Added a MySQL-based configuration and data storage for the WAF to expand the number of hosting environments supported. For more...
-
7.3.6 Noch nicht verfügbar
Improvement: Multiple "php.ini file in core directory" issues are now consolidated into a single issue for clearer scan results.
-
7.3.5 Noch nicht verfügbar
Improvement: Improved tagging of the login endpoint for brute force protection.
-
7.3.4 Noch nicht verfügbar
Improvement: Added security events and alerting features built into Wordfence Central.
-
7.3.3 Noch nicht verfügbar
Improvement: Added support for managing the login security settings to Wordfence Central.
-
7.3.2 Noch nicht verfügbar
Improvement: Updated sodiumcompat to address an incompatibility that may occur with the pending WordPress 5.2.1 update.
-
7.3.1 Noch nicht verfügbar
Improvement: Two-factor authentication is new and improved, now available on all Premium and Free installations.
-
7.2.5 Noch nicht verfügbar
Improvement: Added additional data breach records to the breached password check.
-
7.2.4 Noch nicht verfügbar
Improvement: Updated vulnerability database integration.
-
7.2.3 Noch nicht verfügbar
Improvement: Country names are now shown instead of two letter codes where appropriate.
-
7.2.2 Noch nicht verfügbar
Improvement: Updated GeoIP database.
-
7.2.1 Noch nicht verfügbar
Improvement: Integrated Wordfence with Wordfence Central, a new service allowing you to manage multiple Wordfence installations from a singl...
-
7.1.20 Noch nicht verfügbar
Fix: Fixed a commit error with 7.1.19
-
7.1.19 Noch nicht verfügbar
Improvement: Speed optimizations for WAF rule compilation.
-
7.1.18 Noch nicht verfügbar
Improvement: Removed unused font glyph ranges to reduce file count and size.
-
7.1.17 Noch nicht verfügbar
Improvement: Increased frequency of filesystem permission check and update of the WAF config files.
-
7.1.16 Noch nicht verfügbar
Improvement: Service allowlisting can now be selectively toggled on or off per service.
-
7.1.15 Noch nicht verfügbar
Fix: Addressed a plugin conflict with the composer autoloader.
-
7.1.14 Noch nicht verfügbar
Improvement: Reduced queries and potential table size for rate limiting-related data.
-
7.1.12 Noch nicht verfügbar
Improvement: Updated bundled GeoIP database.
-
7.1.11 Noch nicht verfügbar
Improvement: Added a custom message field that will show on all block pages.
-
7.1.10 Noch nicht verfügbar
Improvement: Better labeling in Live Traffic for 301 and 302 redirects.
-
7.1.9 Noch nicht verfügbar
Improvement: Added an "unsubscribe" link to plugin-generated alerts.
-
7.1.8 Noch nicht verfügbar
Improvement: Better detection of removal status when uninstalling the WAF's auto-prepend file.
-
7.1.7 Noch nicht verfügbar
Improvement: Added better support for keyboard navigation of options.
-
7.1.6 Noch nicht verfügbar
Fix: Added a workaround for sites with inaccessible WAF config files when reading php://input
-
7.1.5 Noch nicht verfügbar
Improvement: GDPR compliance updates.
-
7.1.4 Noch nicht verfügbar
Improvement: Added additional XSS detection capabilities.
-
7.1.3 Noch nicht verfügbar
Improvement: Improved the performance of our config table status check.
-
7.1.2 Noch nicht verfügbar
Improvement: Added support for filtering the blocks list.
-
7.1.1 Noch nicht verfügbar
Improvement: Added the ability to sort the blocks table.
-
7.1.0 Noch nicht verfügbar
Improvement: Added a new feature to prevent attackers from successfully logging in to admin accounts whose passwords have been in data breac...
-
7.0.4 Noch nicht verfügbar
Change: Live Traffic records are no longer created for hits initiated by WP-CLI (e.g., manually running cron).
-
7.0.3 Noch nicht verfügbar
Improvement: Added an "All Options" page to enable developers and others to more rapidly configure Wordfence.
-
7.0.2 Noch nicht verfügbar
Improvement: Added CSS/JS filename versioning to address caching plugins not refreshing for plugin updates.
-
7.0.1 Noch nicht verfügbar
Comprehensive UI refresh.
-
6.3.22 Noch nicht verfügbar
Fix: Addressed a warning that could occur on PHP 7.1 when reading php.ini size values.
-
6.3.21 Noch nicht verfügbar
Improvement: Updated bundled GeoIP database.
-
6.3.20 Noch nicht verfügbar
Improvement: The scan will now alert for a publicly visible .user.ini file.
-
6.3.19 Noch nicht verfügbar
Emergency Fix: Updated wpdb::prepare calls using %.6f since it is no longer supported.
-
6.3.18 Noch nicht verfügbar
Improvement: Reduced size of some JavaScript for faster loading.
-
6.3.17 Noch nicht verfügbar
Improvement: Prepared code for upcoming scan improvement which will greatly increase scan performance by optimizing malware signatures.
-
6.3.16 Noch nicht verfügbar
Improvement: Introduced a new scan stage to check for malicious URLs and content within WordPress core, plugin, and theme options.
-
6.3.15 Noch nicht verfügbar
Improvement: Reduced memory usage on scan forking and during the known files scan stage.
-
6.3.14 Noch nicht verfügbar
Improvement: Introduced smart scan distribution. Scan times are now distributed intelligently across servers to provide consistent server pe...
-
6.3.12 Noch nicht verfügbar
Improvement: Adjusted the password audit to use a better cryptographic padding option.
-
6.3.11 Noch nicht verfügbar
Improvement: The scan will alert for plugins that have not been updated in 2+ years or have been removed from the wordpress.org directory. I...
-
6.3.10 Noch nicht verfügbar
Improvement: Reduction in overall memory usage and peak memory usage for the scanner.
-
6.3.9 Noch nicht verfügbar
Improvement: Malware signature checking has been better optimized to improve overall speed.
-
6.3.8 Noch nicht verfügbar
Fix: Addressed an issue that could cause scans to time out on sites with tens of thousands of potential URLs in files, comments, and posts.
-
6.3.7 Noch nicht verfügbar
Improvement: All URLs are now checked against the Wordfence Domain Blocklist in addition to Google's.
-
6.3.6 Noch nicht verfügbar
Improvement: Optimized the malware signature scan to reduce memory usage.
-
6.3.5 Noch nicht verfügbar
Improvement: Sites can now specify a list of trusted proxies when using X-Forwarded-For for IP resolution.
-
6.3.4 Noch nicht verfügbar
Improvement: Added a path for people blocked by the IP blocklist (Premium Feature) to report false positives.
-
6.3.3 Noch nicht verfügbar
New: Malicious IPs are now preemptively blocked by a regularly-updated blocklist. [Premium Feature]
-
6.3.2 Noch nicht verfügbar
Improvement: Improved the WAF's ability to inspect POST bodies.
Readme
GPL-3.0-onlyWordfence Security
Firewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team. Make security a priority with Wordfence.
https://www.youtube.com/watch?v=i4ZN2TwlaBE
THE MOST POPULAR WORDPRESS FIREWALL & SECURITY SCANNER
WordPress security requires a team of dedicated analysts researching the latest malware variants and WordPress exploits, turning them into firewall rules and malware signatures, and releasing those to customers in real-time.
Choose the right protection for you: Wordfence Free, Premium, Care or Response
Wordfence is widely acknowledged as the number one WordPress security research team in the World. Our plugin provides a comprehensive suite of security features, and our team’s research is what powers our plugin and provides the level of security that we are known for.
At Wordfence, WordPress security isn’t a division of our business – WordPress security is all we do. We employ a global 24-hour dedicated incident response team that provides our priority customers with a 1 hour response time for any security incident.
The sun never sets on our global security team and we run a sophisticated threat intelligence platform to aggregate, analyze and produce ground breaking security research on the newest security threats.
Wordfence Security includes an endpoint firewall, malware scanner, robust login security features, live traffic views, and more. Our Threat Defense Feed arms Wordfence with the newest firewall rules, malware signatures, and malicious IP addresses it needs to keep your website safe.
Rounded out by passkeys, 2FA, and a suite of additional features, Wordfence is the most comprehensive WordPress security solution available.
🔥 WORDPRESS FIREWALL
- Web Application Firewall identifies and blocks malicious traffic. Built and maintained by a large team focused 100% on WordPress security.
- Real-time firewall rule and malware signature [Premium] updates via the Threat Defense Feed (free version is delayed by 30 days).
- Real-time IP Blocklist [Premium] blocks all requests from the most malicious IPs, protecting your site while reducing load.
- Protects your site at the endpoint, enabling deep integration with WordPress. Unlike cloud alternatives, it does not break encryption, cannot be bypassed and cannot leak data.
- Integrated malware scanner blocks requests that include malicious code or content.
- Protection from brute force attacks by limiting login attempts.
📡 WORDPRESS SECURITY SCANNER
- Malware scanner checks core files, themes and plugins for malware, bad URLs, backdoors, SEO spam, malicious redirects and code injections.
- Real-time malware signature updates [Premium] via the Threat Defense Feed (free version is delayed by 30 days).
- Compares with WordPress.org repository your core files, themes and plugins, checking their integrity and reporting any changes to you.
- Repair WordPress core, theme, and plugin files that have changed by overwriting them with a pristine, original version. Delete any files that don’t belong easily within the Wordfence interface.
- Malware Removal Tools "Delete File" and "Delete All Deletable Files" options allow for efficient malware removal. Remember to investigate the scan results and backup files first!
- Checks your site for known security vulnerabilities and alerts you to any issues. Also alerts you to potential security issues when a plugin has been closed or abandoned.
- Checks your content safety by scanning file contents, posts and comments for dangerous URLs and suspicious content.
- Checks to see if your site or IP have been blocklisted [Premium] for malicious activity, generating spam or other security issues.
🔒 LOGIN SECURITY
- Passkeys let users sign in with touch, facial recognition, a device password, or a PIN as a simple and secure alternative to a password and two-factor credentials.
- Two-factor authentication (2FA), one of the most secure forms of remote system authentication available via any TOTP-based authenticator app or service.
- Login Page CAPTCHA stops bots from logging in.
- Passkey and 2FA management for WooCommerce and custom integrations allows users to manage credentials on custom account pages.
- XML-RPC options including disabling or adding 2FA.
- Password Security: Block logins for administrators using known compromised passwords.
📋 SECURITY AUDIT LOG [Premium]
- The Audit Log monitors all changes and actions in security-sensitive areas of the site.
- Remote tamper-proof data storage via Wordfence Central.
- Monitor events and actions ranging from user creation and editing to plugin/theme installation and updates to post and page changes.
- Configurable to log all events or significant events only, which includes all authentication, site configuration, and site functionality events.
🌐 WORDFENCE CENTRAL
- Wordfence Central is a powerful and efficient way to manage the security for multiple sites in one place.
- Centralized management: Efficiently assess the security status of all your websites in one view. View detailed security findings without leaving Wordfence Central.
- Powerful templates make configuring Wordfence a breeze.
- Highly configurable alerts can be delivered via email, SMS or Slack. Improve the signal to noise ratio by leveraging severity level options and a daily digest option.
- Track and alert on important security events including administrator logins, breached password usage and surges in attack activity.
- Free to use for unlimited sites.
🛠️ SECURITY TOOLS
- Live Traffic monitors visits and hack attempts not shown in other analytics packages in real time; including origin, their IP address, the time of day and time spent on your site.
- Block attackers by IP or build advanced rules based on IP Range, Hostname, User Agent and Referrer.
- Country blocking available with Wordfence Premium.
Was es mitbringt
- Integration mit WooCommerce
Installation
Secure your website using the following steps to install Wordfence:
- Install Wordfence automatically or by uploading the ZIP file.
- Activate the Wordfence through the 'Plugins' menu in WordPress. Wordfence is now activated.
- Go to the scan menu and start your first scan. Scheduled scanning will also be enabled.
- Once your first scan has completed, a list of threats will appear. Go through them one by one to secure your site.
- Visit the Wordfence options page to enter your email address so that you can receive email security alerts.
- Optionally, change your security level or adjust the advanced options to set individual scanning and protection options for your site.
- Click the "Live Traffic" menu option to watch your site activity in real-time. Situational awareness is an important part of website security.
To install Wordfence on WordPress Multi-Site installations:
- Install Wordfence via the plugin directory or by uploading the ZIP file.
- Network Activate Wordfence. This step is important because until you network activate it, your sites will see the plugin option on their plugins menu. Once activated that option disappears.
- Now that Wordfence is network activated it will appear on your Network Admin menu. Wordfence will not appear on any individual site's menu.
- Go to the "Scan" menu and start your first scan.
- Wordfence will do a scan of all files in your WordPress installation including those in the blogs.dir directory of your individual sites.
- Live Traffic will appear for ALL sites in your network. If you have a heavily trafficked system you may want to disable live traffic which will stop logging to the DB.
- Firewall rules and login rules apply to the WHOLE system. So if you fail a login on site1.example.com and site2.example.com it counts as 2 failures. Crawler traffic is counted between blogs, so if you hit three sites in the network, all the hits are totalled and that counts as the rate you're accessing the system.
Faq
How does Wordfence Security protect sites from attackers?
The WordPress security plugin provides the best protection available for your website. Powered by the constantly updated Threat Defense Feed, Wordfence Firewall stops you from getting hacked. Wordfence Scan leverages the same proprietary feed, alerting you quickly about security issues or if your site is compromised. The Live Traffic view gives you real-time visibility into traffic and hack attempts on your website. A deep set of additional tools round out the most comprehensive WordPress security solution available.
What features does Wordfence Premium enable?
We offer a Premium API key that gives you real-time updates to the Threat Defense Feed which includes a real-time IP blocklist, firewall rules, and malware signatures. Premium support, country blocking, more frequent scans, and spam and spamvertising checks are also included. Click here to sign-up for Wordfence Premium now or simply install Wordfence free and start protecting your website.
How does the Wordfence WordPress Firewall protect websites?
- Web Application Firewall stops you from getting hacked by identifying malicious traffic, blocking attackers before they can access your website.
- Threat Defense Feed automatically updates firewall rules that protect you from the latest threats. Premium members receive the real-time version.
- Block common WordPress security threats like fake Googlebots, malicious scans from hackers and botnets.
What checks does the Wordfence Security Scanner perform?
- Scans core files, themes and plugins against WordPress.org repository versions to check their integrity. Verify security of your source.
- See how files have changed. Optionally repair changed files that are security threats.
- Scans for signatures of over 44,000 known malware variants that are known WordPress security threats.
- Scans for many known backdoors that create security holes including C99, R57, RootShell, Crystal Shell, Matamu, Cybershell, W4cking, Sniper, Predator, Jackal, Phantasma, GFS, Dive, Dx and many more.
- Continuously scans for malware and phishing URL’s including all URLs on the Google Safe Browsing List in all your comments, posts and files that are security threats.
- Scans for heuristics of backdoors, trojans, suspicious code and other security issues.
What security monitoring features does Wordfence include?
- See all your traffic in real-time, including robots, humans, 404 errors, logins and logouts and who is consuming most of your content. Enhances your situational awareness of which security threats your site is facing.
- A real-time view of all traffic including automated bots that often constitute security threats that Javascript analytics packages never show you.
- Real-time traffic includes reverse DNS and city-level geolocation. Know which geographic area security threats originate from.
- Monitors disk space which is related to security because many DDoS attacks attempt to consume all disk space to create denial of service.
What login security features are included
- See all your traffic in real-time, including robots, humans, 404 errors, logins and logouts and who is consuming most of your content. Enhances your situational awareness of which security threats your site is facing.
- A real-time view of all traffic including automated bots that often constitute security threats that Javascript analytics packages never show you.
- Real-time traffic includes reverse DNS and city-level geolocation. Know which geographic area security threats originate from.
- Monitors disk space which is related to security because many DDoS attacks attempt to consume all disk space to create denial of service.
How will I be alerted if my site has a security problem?
Wordfence sends security alerts via email. Once you install Wordfence, you will configure a list of email addresses where security alerts will be sent. When you receive a security alert, make sure you deal with it promptly to ensure your site stays secure.
Do I need a security plugin like Wordfence if I’m using a cloud based firewall (WAF)?
Wordfence provides true endpoint security for your WordPress website. Unlike cloud based firewalls, Wordfence executes within the WordPress environment, giving it knowledge like whether the user is signed in, their identity and what access level they have. Wordfence uses the user’s access level in more than 80% of the firewall rules it uses to protect WordPress websites. Learn more about the Cloud WAF identity problem here. Additionally, cloud based firewalls can be bypassed, leaving your site exposed to attackers. Because Wordfence is an integral part of the endpoint (your WordPress website), it can’t be bypassed. Learn more about the Cloud WAF bypass problem here. To fully protect the investment you’ve made in your website you need to employ a defense in depth approach to security. Wordfence takes this approach.
What blocking features does Wordfence include?
- Real-time blocking of known attackers. If another site using Wordfence is attacked and blocks the attacker, your site is automatically protected.
- Block entire malicious networks. Includes advanced IP and Domain WHOIS to report malicious IP’s or networks and block entire networks using the firewall. Report WordPress security threats to network owner.
- Rate limit or block WordPress security threats like aggressive crawlers, scrapers and bots doing security scans for vulnerabilities in your site.
- Choose whether you want to block or throttle users and robots who break your WordPress security rules.
- Premium users can also block countries and schedule scans for specific times and a higher frequency.
What differentiates Wordfence from other WordPress Security plugins?
- Wordfence Security provides a WordPress Firewall developed specifically for WordPress and blocks attackers looking for vulnerabilities on your site. The Firewall is powered by our Threat Defense Feed which is continually updated as new threats emerge. Premium customers receive updates in real-time.
- Wordfence verifies your website source code integrity against the official WordPress repository and shows you the changes.
- Wordfence scans check all your files, comments and posts for URLs in Google's Safe Browsing list. We are the only plugin to offer this very important security enhancement.
- Wordfence scans do not consume large amounts of your bandwidth because all security scans happen on your web server which makes them very fast.
- Wordfence fully supports WordPress Multi-Site which means you can security scan every blog in your Multi-Site installation with one click.
- Wordfence includes passkeys and Two-Factor authentication to help secure WordPress accounts against phishing and brute-force attacks.
- Wordfence fully supports IPv6 including giving you the ability to look up the location of IPv6 addresses, block IPv6 ranges, detect IPv6 country and do a whois lookup on IPv6 addresses and more.
Will Wordfence slow down my website?
No. Wordfence Security is extremely fast and uses techniques like caching its own configuration data to avoid database lookups and blocking malicious attacks that would slow down your site.
What if my site has already been hacked?
Wordfence Security is able to repair core files, themes and plugins on sites where security is already compromised. You can follow this guide on how to clean a hacked website using Wordfence. If you are cleaning your own site after a hack, note that site security cannot be assured unless you do a full reinstall if your site has been hacked. We recommend you only use Wordfence Security to get your site into a running state in order to recover the data you need to do a full reinstall. If you need help with a security issue, check out Wordfence Care, which offers hands-on support from our team, including dealing with a hacked site. For mission-critical sites, check out Wordfence Response.
Does Wordfence Security support IPv6?
Yes. We fully support IPv6 with all security functions including country blocking, range blocking, city lookup, whois lookup and all other security functions. If you are not running IPv6, Wordfence will work great on your site too. We are fully compatible with both IPv4 and IPv6 whether you run both or only one addressing scheme.
Does Wordfence Security support Multi-Site installations?
Yes. WordPress Multi-Site is fully supported. Using Wordfence you can scan every blog in your network for malware with one click. If one of your customers posts a page or post with a known malware URL that threatens your whole domain with being blocklisted by Google, we will alert you in the next scan.
What support options are available for Wordfence users?
Providing excellent customer service is very important to us. Our free users receive volunteer-level support in our support forums. Wordfence Premium customers get paid ticket-based support. Wordfence Care customers receive hands-on support including help with security incidents and a yearly security audit. Wordfence Response customers get 24/7/365 support from our incident response team, with a 1 hour response time, and a maximum of 24 hours to resolve a security issue.
Where can I learn more about WordPress security?
Designed for every skill level, The WordPress Security Learning Center is dedicated to deepening users’ understanding of security best practices by providing free access to entry-level articles, in-depth articles, videos, industry survey results, graphics and more.
Where can I find the Wordfence Terms of Service and Privacy Policy?
These are available on our website: Terms of Service and Privacy Policy
Screenshots
Secure your website with Wordfence.
- The dashboard gives you an overview of your site's security including notifications, attack statistics and Wordfence feature status.
- The firewall protects your site from common types of attacks and known security vulnerabilities.
- The Wordfence Security Scanner lets you know if your site has been compromised and alerts you to other security issues that need to be addressed.
- Wordfence is highly configurable, with a deep set of options available for each feature. High level scan options are shown above.
- Brute Force Protection features protect you from password guessing attacks.
- Block attackers by IP, Country, IP range, Hostname, Browser or Referrer.
- The Wordfence Live Traffic view shows you real-time activity on your site including bot traffic and exploit attempts.
- Take login security to the next level with Two-Factor Authentication.
- Logging in is easy with Wordfence 2FA.
Installieren
composer require meteorgpl-plugin/wordfenceDie Lizenzprüfungen des Anbieters sind unverändert: Aktivieren Sie das Plugin in WordPress mit einem beim Anbieter gekauften Lizenzschlüssel.
Lizenz
Deklarierte Lizenz: GPL-3.0-only. Der Code wird unter der Lizenz weiterverbreitet, die der Anbieter in den eigenen Headern des Plugins deklariert hat. Lizenzprofil: gpl-full.
Grafiken, Schriften, Medien und Dokumente, die möglicherweise separat lizenziert sind, werden nicht weiterverbreitet; die Lizenzseite erklärt, was ersetzt oder entfernt wird, und der Sicherheits-Tab listet es pro Version auf. Der Anspruch auf Support und Updates ergibt sich aus der Lizenz, die Sie beim Anbieter kaufen.