bwt
// plugin

Wordfence

by Defiant

Endpoint firewall and malware scanner for WordPress. Free core, paid threat intelligence feeds.

Visit Wordfence → Docs WP.org
// decision data
Lighthouse
88 / 100
Tested May 30, 2026
Accessibility
WCAG AA
3 axe issues
Open CVEs
0
No known open advisory
Last release
May 31, 2026 v8.1.4
WP.org rating
4.7
4.9K reviews · 5M+ installs
Security plugin Free, Pro from $149 GPL Since 2012 Tested up to WP 7.0.1 Requires WP 4.7+ PHP 7.0+
// editorial verdict

Wordfence is the default WordPress security plugin: WAF (web application firewall), malware scanner, login security, two-factor authentication, and live traffic monitoring. The free version is fully functional. Premium adds the real-time threat intelligence feed (vulnerabilities the moment they are disclosed) and country blocking. Owned by Defiant Inc.

Pros

  • Free version is a complete security baseline for most sites
  • Premium threat feed publishes CVE intel within hours of disclosure
  • Highly trusted in the WordPress security community
  • Genuine technical team behind it (Defiant publishes vulnerability research)

Cons

  • WAF runs as plugin-level WAF, less effective than edge-level (Cloudflare) for high-volume sites
  • Default settings can be aggressive on legitimate traffic
  • Premium annual cost is significant
When to pick Wordfence

Pick Wordfence when you want a respected, free WordPress security plugin and you are comfortable with plugin-level WAF for most threats. Excellent for small-to-medium sites that do not already route through a CDN WAF.

When to avoid Wordfence

Avoid if your site already terminates traffic through Cloudflare WAF, or you prefer the lighter Patchstack-only approach to vulnerability monitoring.

// faq

Frequently asked questions

Is Wordfence free?
Yes. The free version is a fully functional security baseline: WAF, malware scanner, login security, two-factor auth, live traffic monitoring. Wordfence Premium ($149 per year) adds the real-time threat intelligence feed and country blocking.
Should I use Wordfence with Cloudflare?
You can, but the layering is partly redundant. Cloudflare's WAF runs at the edge before traffic ever reaches WordPress; Wordfence's WAF runs at the plugin layer after WordPress is loaded. If you're already on Cloudflare Pro or above, the marginal value of Wordfence Premium is lower.
How is Wordfence different from Sucuri?
Wordfence focuses on plugin-level WAF and detailed traffic monitoring inside WordPress. Sucuri pairs a cloud-based WAF (DNS-level proxy) with a malware cleanup service. Sucuri is closer to a managed service; Wordfence is closer to a power-user tool.
What's in Wordfence Premium?
Real-time threat intelligence (CVE feeds published within hours of disclosure), country blocking, premium support, two-factor auth via app, and reputation checks on visitor IPs. The free version handles the baseline; Premium is for sites with elevated threat profiles or compliance requirements.
// activity & context

Recent releases

  1. v8.1.4 May 31, 2026

    Threat feed delivery optimization

  2. v8.1.3 May 9, 2026

    Login security bug fix for 2FA codes

  3. v8.1.2 April 12, 2026

    WAF rule updates for recent CVEs

  4. v8.1.1 March 20, 2026

    Patch release for live traffic dashboard

  5. v8.1.0 March 2, 2026

    New: granular country blocking controls

  6. v8.0.5 February 8, 2026

    Maintenance release

  7. v8.0.4 January 20, 2026

    Malware scanner performance optimization

  8. v8.0.3 January 4, 2026

    Patch release

// similar plugins
// methodology

Performance testing

Tested on Kinsta Starter (Google Cloud C3D, Iowa). Configuration: Wordfence default settings, Twenty Twenty-Four theme, mobile, 4G simulated, cold cache. 5 runs, median reported. Raw Lighthouse JSON downloadable on request.

Vulnerability tracking

Open and recently closed CVE counts pulled from Patchstack and Wordfence Intelligence on every build. Last disclosure date reflects the most recent public CVE for this plugin, not necessarily the most recent vendor patch.