If you run a WordPress site, something is already trying to log into it. Not because anyone singled you out — because automated scanners work through the whole web looking for weak logins and known-vulnerable plugins. Wordfence is the most widely installed plugin for dealing with that, it is made by Defiant Inc., and the free version is genuinely worth having.
It is also narrower than its reputation, and the most valuable thing it offers costs nothing and is easy to miss. So this guide covers three things: the one setting to turn on first, what Wordfence actually protects against and what it does not, and where the free version stops.
Start here: turn on two-factor authentication
Two-factor authentication is free in Wordfence. It is not a paid add-on, and it is the single most effective thing on this page.
The reason is arithmetic. Brute-force and credential-stuffing attacks work by trying passwords. Two-factor authentication means a correct password on its own is not enough — an attacker also needs a code from your phone. That defeats the entire category of attack, no matter how many passwords they try or where they leaked from.
Wordfence’s 2FA works with any TOTP-based authenticator app — Google Authenticator, Authy, 1Password, Bitwarden, whichever you already use. You scan a QR code once, and afterwards logging in asks for a six-digit code that changes every thirty seconds.
If you do nothing else after reading this, do that. Turn it on for every administrator account on the site, not just your own: an unprotected admin account is the whole door, regardless of how well protected yours is.
Wordfence also now supports passkeys, which let you sign in with a fingerprint, face, device password or PIN instead of a password and a code. If your devices support them, they are easier than 2FA and at least as strong.
What Wordfence actually stops — and what it doesn’t
This is where most write-ups overclaim, and being precise matters, because a false sense of coverage is its own risk.
Wordfence runs inside WordPress, in PHP, on your own server. Its own documentation calls this protecting your site “at the endpoint,” and describes the advantage plainly: unlike a cloud service in front of your site, it “does not break encryption, cannot be bypassed and cannot leak data.” It sees requests with full context — which user, which plugin, which parameters — and that is why it can make good decisions.
The trade-off is the important part. By the time Wordfence sees a request, that request has already reached your server and consumed bandwidth, a PHP worker and probably a database connection.
So Wordfence can:
- block requests carrying known-malicious payloads before they reach vulnerable code
- limit and lock out repeated failed logins
- block, throttle or rate-limit abusive IP addresses, ranges, hostnames and user agents
- identify fake Googlebots and malicious scanners
- detect changed core, theme and plugin files, and warn you about known-vulnerable ones
And Wordfence cannot stop a distributed denial-of-service attack. A DDoS works by exhausting your bandwidth or your server’s capacity to answer requests at all. A plugin that runs after the request arrives cannot prevent the arrival. Blocking abusive IPs and throttling aggressive crawlers is real and useful, and it is a different job from absorbing a flood — that one belongs upstream, at a CDN or your host’s network edge.
Treat Wordfence as the layer that understands WordPress, not the layer that absorbs volume.
Free versus paid: the difference that actually matters
The free version includes the firewall, the malware scanner, brute-force protection, file-integrity checking against the WordPress.org repository, vulnerability alerts, login security, and the traffic tools. That is a lot, and for most small sites it is enough.
But there is one distinction worth understanding before you decide, and it is not a feature list. Wordfence’s firewall rules and malware signatures come from what it calls the Threat Defense Feed, and the plugin’s own documentation states the split in a single line:
“Real-time firewall rule and malware signature [Premium] updates via the Threat Defense Feed (free version is delayed by 30 days).”
On the free version, protection against a newly discovered threat can arrive up to thirty days after paying customers get it. For a personal blog that is usually an acceptable risk. For a site that takes payments, holds customer data, or would cost you real money to have offline for a week, thirty days is a long window — and that, not the feature bullets, is the honest argument for paying.
Per Wordfence’s own FAQ, a Premium key adds “real-time updates to the Threat Defense Feed which includes a real-time IP blocklist, firewall rules, and malware signatures,” plus “Premium support, country blocking, more frequent scans, and spam and spamvertising checks.” There are four tiers — Free, Premium, Care and Response — where the paid ones differ mainly in how much hands-on help you get if something goes wrong. Check current prices on Wordfence’s own site rather than trusting any figure you read in an article, including this one.
The scan, and what to do with its results
After installing, Wordfence scans your site and hands you a list of findings. Two habits make that list useful rather than alarming.
First, read the severity, not the count. A scan reporting thirty items is not thirty emergencies. “A plugin has an update available” and “a core file has been modified” are very different findings.
Second, understand what file comparison means. Wordfence compares your core files, themes and plugins against the versions published on WordPress.org. When it says a file changed, it means it differs from the official release. That is how it catches injected code — and also why a deliberate customisation will be flagged. The scanner can overwrite a changed file with the pristine original, which is genuinely useful during a cleanup, but it means you should look before you let it act.
The scan also checks your posts, pages and comments for dangerous URLs, and warns you when an installed plugin has been closed or abandoned in the plugin directory. That last alert is quietly one of the most valuable things Wordfence does: abandoned plugins do not announce themselves, they simply stop receiving security fixes while sitting in your site.
Four settings worth changing
Most of Wordfence’s defaults are sensible. These four repay a few minutes.
Limit login attempts. Set a cap on failed logins and a lockout period. This is what turns a brute-force attempt from an open-ended guessing game into a handful of tries.
Block the username-discovery trick. WordPress will, by default, reveal valid usernames through a URL pattern like ?author=1, which enumerates accounts. Half of a login attempt is knowing the username, so closing this is worthwhile. Wordfence has an option for it.
Stop WordPress confirming valid usernames at login. Out of the box, entering a real username with a wrong password produces a different error than an unknown username — which tells an attacker they have found a real account. Wordfence can make both failures look identical.
Do not use a guessable administrator username. admin, root, test, guest, user, administrator and your own domain name are all tried first. If your admin account uses one of these, create a new administrator with a different name and demote the old one.
If you last set this up years ago
Wordfence has changed considerably, and several of the additions are free:
- Passkeys, as above.
- Login page CAPTCHA, to stop bots reaching the login form at all.
- Password security, which blocks administrator logins using passwords known to have appeared in breaches.
- Two-factor authentication for XML-RPC, or the option to disable XML-RPC outright — a common attack surface that older guides rarely mention.
- Passkey and 2FA management for WooCommerce and custom account pages, so store customers can protect their own logins.
A few things moved the other way. Wordfence no longer ships a caching engine; page caching is now a separate concern, handled by a dedicated caching plugin or by your host. If you remember Wordfence as a performance tool, that is why you cannot find the setting. The security audit log, which records changes in sensitive areas of the site, is a Premium feature, as is country blocking.
Wordfence is one layer, not a security plan
A plugin cannot carry the whole job, and the things it cannot do are the things that most often save a site.
Keep WordPress, themes and plugins updated. The overwhelming majority of compromised WordPress sites are running a known vulnerability with an available patch. No firewall substitutes for applying it.
Install fewer plugins. Every plugin is code you did not write running with your site’s permissions. The smallest set that does the job is the most secure set.
Have backups you have actually restored. A backup you have never tested is a hope. Restoring one into a staging site once a year tells you whether you have a recovery plan or a folder of files.
Know what your host does. Some hosts filter attacks, rate-limit and block bad IPs at the network level before anything reaches your WordPress installation. That is the layer that handles volume, and it is worth knowing whether you have it.
Wordfence’s real contribution is that it understands WordPress specifically — it knows what your files should look like, which plugins are dangerous this week, and which login attempts are part of a pattern. That is worth having, and it is free. Turn on two-factor authentication, keep everything updated, and treat the rest as defence in depth.
Frequently asked questions
Is Wordfence free version good enough? For most small sites, yes. The main limitation is that firewall rules and malware signatures reach free users up to 30 days after paying users. If an outage or a data exposure would cost you real money, that delay is the reason to upgrade.
Does Wordfence slow down a site? It adds some work to each request, since it inspects traffic in PHP. Wordfence says it minimises this by caching its own configuration data to avoid database lookups. On a well-hosted site the effect is usually small; on very constrained shared hosting it can be noticeable.
Is two-factor authentication free in Wordfence? Yes. So are passkeys and login page CAPTCHA. Country blocking and the security audit log are the paid features people most often confuse with these.
Can Wordfence stop a DDoS attack? No. It can block and throttle abusive addresses, but it runs after traffic has already reached your server. Genuine denial-of-service protection happens upstream, at a CDN or your host’s network.
Do I still need Wordfence if my host has a firewall? They do different jobs. A network firewall filters by volume and pattern without knowing anything about WordPress. Wordfence knows which plugin is being attacked and which of your files changed. Running both is normal.
What should I do if my site is already hacked? Do not start by deleting things. Take a backup of the compromised state first so you can investigate, then work through the scan results, replace modified core and plugin files with clean versions, change every password, and force all users to log out. If customer data may be involved, treat it as an incident rather than a cleanup.
More on protecting yourself and your site is collected under securing your use of the digital world. You may also want to read about safe browsing and judging security tools and what your browser stores about you.