Wordfence Security – Firewall, Malware Scan, and Login Security

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

The recent download trend is too spiky to read.

Reviewers say Wordfence blocks real attacks reliably and rarely trips false positives, with long-time users calling it their most trusted security layer.

1. ★★★★★ ddwijtyk

   1mo ago

   We have been using Wordfence for many years and the upgrades and defenses are very effective. The latest Wordfence seems to cover the areas of attack on websites in a very layered fashion.

   Read on wp.org ↗
2. ★★★★★ shopnowbd

   1mo ago

   i’m using free plan but i i’m satisfied . This topic was modified 3 days ago by shopnowbd.

   Read on wp.org ↗
3. ★★★★★ gusbravo

   1mo ago

   Great and useful plugin to control attacks on my website

   Read on wp.org ↗
4. ★★★★★ Atef G

   1mo ago

   This is a great assistant and reliable partner securing and protecting our website – Thank you Atef G.

   Read on wp.org ↗
5. ★★★★★ snoob44

   1mo ago

   Very good and nice plugin! Does what it says, I can only recommend this!

   Read on wp.org ↗
6. ★★★★★ rachidelkraima

   1mo ago

   Great Security Plugin

   Read on wp.org ↗
7. ★★★★★ cortabro

   1mo ago

   The live traffic view alone is worth it for spotting suspicious activity early. Firewall rules update regularly and I haven’t had a false positive block a legitimate user yet.

   Read on wp.org ↗
8. ★★★★★ heishimatsu

   2mo ago

   Recommended security plugin for protecting WordPress against intrusions, malware, and automated attacks, featuring monitoring and periodic scans to identify potential vulnerabilities.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 8.2.2 Improvement: Better presentation of Live Traffic data on wide screens Improvement: Increased legibility of token fields Improvement: Reworked the pagination of the Blocking page for a better UX Improvement: Country block 8.2.2
2. — Version 8.2.1 Fix: Fixed issue with some i18n plugins/themes when a user has no 2FA recovery codes Fix: Toggled options with additional help links now correctly open the link rather than toggling the option Fix: Country Blocking editi 8.2.1
3. — Version 8.2.0 Improvement: Migrated all deprecated JavaScript libraries in use to a Vue-based infrastructure Improvement: GeoIP database update Improvement: Better coverage of aria- accessibility attributes Improvement: Added translat 8.2.0
4. — Version 8.1.4 Fix: Fixed an issue with inet_pton introduced by a recent patch to PHP 8.1+ that could cause a fatal error if a malformed IP address was passed to the call 8.1.4
5. — Version 8.1.3 Improvement: Updated the bundled geoip database Note: Verified compatibility with WordPress 6.9 8.1.3
6. — Version 8.1.2 Improvement: Updated the bundled geoip database 8.1.2

12 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 4.4 Wordfence Security – Firewall & Malware Scan <= 7.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
   2022-09-06 CVE-2022-3144 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.6.0 Patched in 7.6.1
2. Medium · 4.7 Wordfence Security – Firewall & Malware Scan <= 7.1.13 - Reflected Cross-Site Scripting and Information Disclosure ↗
   2018-10-02 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 7.1.14 Patched in 7.1.14
3. Medium · 6.1 Wordfence Security – Firewall & Malware Scan 6.1.1 - 6.1.6 - Reflected Cross-Site Scripting ↗
   2016-05-10 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects 6.1.1 - 6.1.6 Patched in 6.1.7
4. Medium · 6.1 Wordfence <= 5.1.4 - Reflected Cross-Site Scripting ↗
   2014-12-08 CVE-2014-4932 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.1.5 Patched in 5.1.5
5. High · 7.2 Wordfence Security <= 5.2.3 - Stored Cross-Site Scripting via HTTP_HOST ↗
   2014-09-27 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.2.3 Patched in 5.2.4
6. Medium · 6.5 Wordfence <= 5.2.3 - Multiple Protection Mechanism Bypasses ↗
   2014-09-14 Protection Mechanism Failure Affects < 5.2.4 Patched in 5.2.4
7. High · 7.2 Wordfence <= 5.2.3 - Stored Cross-Site Scripting via REQUEST_URI ↗
   2014-09-14 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.2.3 Patched in 5.2.4
8. High · 7.2 Wordfence <= 5.2.2 - Stored Cross-Site Scripting ↗
   2014-09-08 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.2.3 Patched in 5.2.3
9. High · 7.2 Wordfence Security <= 3.8.1 - Stored Cross-Site Scripting ↗
   2014-08-01 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.8.1 Patched in 3.8.3
10. High · 7.2 Wordfence Security – Firewall & Malware Scan <= 5.1.3 - Cross-Site Scripting ↗
    2014-07-30 CVE-2014-4664 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.3 Patched in 5.1.4
11. Medium · 6.5 Wordfence Security - Firewall & Malware Scan <= 3.3.6 - Stored Cross-Site Scripting ↗
    2012-10-19 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.3.6 Patched in 3.3.7
12. Medium · 6.1 Wordfence < 3.3.7 - Reflected Cross-Site Scripting ↗
    2012-10-19 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.3.7 Patched in 3.3.7

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 41 languages, 15 at 90% or more

Plus 17 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-02-06 4M+ → 5M+ up after 1 days in tier
2. 2026-02-05 5M+ → 4M+ down after 3 days in tier
3. 2026-02-02 4M+ → 5M+ up after 3 days in tier
4. 2026-01-30 5M+ → 4M+ down after 352 days in tier
5. 2025-02-12 4M+ → 5M+ up after 21 days in tier
6. 2025-01-22 5M+ → 4M+ down after 352 days in tier
7. 2024-02-05 4M+ → 5M+ up after 1 days in tier
8. 2024-02-04 5M+ → 4M+ down after 1 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… 2K+ installs · 4.6★ · 5 shared tags A
• Atomic Edge Security – Firewall, Malware Scan and Login Security 700+ installs · 4.2★ · 5 shared tags A
• Security Plugin, Firewall & Malware Scanner with Auto Removal 40K+ installs · 4.7★ · 4 shared tags A
• Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention 1M+ installs · 4.8★ · 3 shared tags A
• Sucuri Security – Auditing, Malware Scanner and Security Hardening 600K+ installs · 4.2★ · 3 shared tags A
• Anti-Malware Security and Brute-Force Firewall 100K+ installs · 4.9★ · 3 shared tags A

Embed this report card

Drop a live Pulse card for Wordfence Security – Firewall, Malware Scan, and Login Security into a readme, a review or a deck. It updates itself.

Wordfence Security – Firewall, Malware Scan, and Login Security: 5M+ active installs, 4.7★ (4,979 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/wordfence