Wordfence Security – Firewall, Malware Scan, and Login Security

95 Quality Score

Active Installs

30/30

With 5 million active installs, Wordfence is by a wide margin the most deployed security plugin in the WordPress ecosystem, signalling strong real-world trust.

Update Freshness

25/25

Updated within the past day and tested against WordPress 7.0, the plugin is clearly maintained on an extremely active release cadence.

User Rating

14/15

A 94 out of 100 average across nearly 5,000 ratings reflects broadly positive user sentiment, though some friction exists around alerts and support for premium features.

Support Health

11/15

145 of 168 public threads resolved gives an 86.3 percent support closure rate, which is solid but not exceptional among heavily used security plugins.

WP Compatibility

15/15

Requiring WordPress 4.7 and PHP 7.0 with confirmed testing on 7.0 means it runs on essentially any reasonably modern WordPress install.

Scores higher than 99% of indexed plugins

About

Firewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team. Make security a priority with Wordfence.

Active Installs 5M+

Rating ★★★★½ 4.7/5

Last Updated 2026-09-08 3:40pm GMT

Requires WordPress 4.7+

Tested Up To 7.1

Requires PHP 7.0+

Security History

12 known vulnerabilities, all patched

5 High 7 Medium

Most recent: September 6, 2022

View details ▸

Wordfence Security – Firewall & Malware Scan <= 7.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

September 6, 2022 Patched in ["7.6.1"] CVE-2022-3144

Wordfence Security – Firewall & Malware Scan <= 7.1.13 - Reflected Cross-Site Scripting and Information Disclosure Medium

October 2, 2018 Patched in ["7.1.14"]

Wordfence Security – Firewall & Malware Scan 6.1.1 - 6.1.6 - Reflected Cross-Site Scripting Medium

May 10, 2016 Patched in ["6.1.7"]

Wordfence <= 5.1.4 - Reflected Cross-Site Scripting Medium

December 8, 2014 Patched in ["5.1.5"] CVE-2014-4932

Wordfence Security <= 5.2.3 - Stored Cross-Site Scripting via HTTP_HOST High

September 27, 2014 Patched in ["5.2.4"]

Wordfence <= 5.2.3 - Multiple Protection Mechanism Bypasses Medium

September 14, 2014 Patched in ["5.2.4"]

Wordfence <= 5.2.3 - Stored Cross-Site Scripting via REQUEST_URI High

September 14, 2014 Patched in ["5.2.4"]

Wordfence <= 5.2.2 - Stored Cross-Site Scripting High

September 8, 2014 Patched in ["5.2.3"]

Wordfence Security <= 3.8.1 - Stored Cross-Site Scripting High

August 1, 2014 Patched in ["3.8.3"]

Wordfence Security – Firewall & Malware Scan <= 5.1.3 - Cross-Site Scripting High

July 30, 2014 Patched in ["5.1.4"] CVE-2014-4664

Wordfence Security - Firewall & Malware Scan <= 3.3.6 - Stored Cross-Site Scripting Medium

October 19, 2012 Patched in ["3.3.7"]

Wordfence < 3.3.7 - Reflected Cross-Site Scripting Medium

October 19, 2012 Patched in ["3.3.7"]

What It Does

Wordfence Security is a full-stack WordPress security plugin that combines a web application firewall, malware scanner, login security with brute force protection, and two-factor authentication. It monitors traffic in real time, blocks malicious requests, and alerts site owners when infections or compromised credentials are detected. Premium licensing adds real-time updated firewall rules and a malware signature database.

Who It's For

This plugin is best for site owners who want one consolidated security solution rather than stitching together multiple point plugins, especially those running business-critical or high-traffic sites. It fits small business websites, e-commerce stores, membership platforms, and any site handling sensitive data like healthcare, financial, or law firm content. Non-technical owners benefit from its guided setup, while more advanced users can dig into granular firewall rules and traffic logs.

Who Should Skip It

If you already rely on a host-level firewall (such as Cloudflare or a managed WordPress host like WP Engine or Kinsta) and a separate malware scanning service, Wordfence adds overlap without much incremental value. Very low-traffic static sites without login forms probably do not need its full feature set and would be fine with a simpler plugin like Limit Login Attempts Reloaded.

The Bottom Line

Wordfence delivers the most complete security toolkit available for WordPress and is backed by impressive real-world adoption and aggressive maintenance. The premium tier is where the most valuable real-time updates live, so budget-conscious users should weigh whether the free version is sufficient for their threat model. With an overall quality score of 97.05 out of 100, it remains a top-tier choice for any site owner who treats security as a priority.

Pick this if your main concern is HTTPS enforcement, mixed content fixes, and lightweight hardening rather than full firewall and malware scanning.

Jetpack – WP Security, Backup, Speed, & Growth 93/100

Pick this if you want security bundled with backups, performance, and analytics from a single Automattic-backed suite instead of Wordfence's security-only focus.

All-In-One Security (AIOS) – Security and Firewall 91/100

Pick this if you want a free, beginner-friendly dashboard with gradual security scoring and no premium upsell pressure.

Safe SVG 89/100

Pick this only as a complementary plugin if SVG uploads are a core part of your workflow, since it addresses a narrow XSS vector rather than general security.

Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention 89/100

Pick this if you only need brute force protection and basic login lockdown without the overhead of a full firewall and scanner.