Plugin
Updated
Wordfence
Wordfence Security Premium is a WordPress security plugin by Wordfence. It combines an endpoint firewall and a malware scanner with a real-time threat defense feed, so malicious traffic can be blocked and infected files spotted on your site.
- Version
- 9.0.2
- Released
- Sep 30, 2026
- Developer
- Wordfence
- Type
- WordPress plugin
- Licence
- GPL
- Included in
- Every plan, or $10.39 on its own
- Topics
- Security Plugins
What’s new in Wordfence 9.0.2
Version 9.0.2 · Sep 30, 2026
Latest
- ImprovedChanged IPv6 diagnostics result to be informational only
- ImprovedAdded help link to increased attack rate emails
- ImprovedIncreased compatibility with WordPress Playground
- ImprovedHarden REST API user enumeration protection
- FixedUpgraded virtualizer dependency to fix Firefox tab crash on screens with a lot of DOM elements (e.g., a running scan)
- FixedBetter detection and handling of "module" script tagging to avoid conflict with renamed plugin directories
- FixedAdd missed return value from `upgrader_pre_install` audit log filter
- FixedPHP 8.1 deprecation notice fixes
What it does
Every WordPress site draws automated attacks, from brute force login attempts to bots probing for weak plugins and spam comment floods. This plugin puts a firewall in front of your site that checks incoming traffic and blocks requests it recognizes as malicious. A real-time threat defense feed and an IP blacklist of addresses known for malicious activity keep the firewall and scanner informed about new threats as they appear.
Beyond the firewall, the plugin scans your files for backdoors, trojans, suspicious code and phishing URLs, and scans can run on a schedule. Login protection adds two-factor authentication and reCAPTCHA, and you can restrict access by country. A dashboard brings together security alerts, live traffic monitoring and reports, which suits blogs, online stores and business sites where the owner wants clear visibility without deep security expertise.
Best for
- Bloggers who want login protection and malware scanning
- Online stores and business sites facing frequent attack traffic
- Freelancers and agencies securing multiple client WordPress sites
Features
Endpoint firewall
Inspects incoming requests and blocks malicious traffic before it reaches your WordPress site, guided by a real-time threat defense feed.
Malware scanner
Checks your site for backdoors, trojans, suspicious code and phishing URLs so you can find and clean up infected files.
Login security
Adds two-factor authentication and reCAPTCHA to the login process to help stop brute force attacks and unauthorized access attempts.
Real-time IP blacklist
Automatically blocks IP addresses that are known to engage in malicious activity, cutting off repeat attackers before they try your site.
Country blocking
Lets you restrict access from countries you consider high risk, reducing the amount of attack traffic your site has to handle.
Spam blocking
Filters out spam comments and malicious content submitted to your site, keeping comment sections cleaner.
Security dashboard and live traffic
Shows security alerts and live traffic in one place, so you can see who is visiting and what the plugin has flagged.
Scheduled scans and reports
Runs security checks on a schedule and provides summaries of your site's security status and incidents for ongoing monitoring.
Wordfence older versions
- 9.0.1Sep 92 improvements, 4 fixes
- 9.0.0Aug 125 improvements, 5 fixes
- 8.2.2May 146 improvements, 4 fixes, 1 removal
- 8.2.1May 7
- 8.2.0Apr 30
- 8.1.4Dec 22, 2025
- 8.1.3Dec 4, 2025
- 8.1.2Nov 13, 2025
- 8.1.1Nov 6, 2025
- 8.1.0Aug 26, 2025
Members and buyers of this product can download older versions.
34 older versions in all. If you need one that is not listed, ask support.
Questions about Wordfence
Does it protect against brute force login attacks?
Yes. The login security features include two-factor authentication and reCAPTCHA, and the firewall and IP blacklist block addresses known for malicious activity. Together these make it much harder for bots to guess passwords or keep hammering your login page.
What kinds of malware can the scanner find?
The scanner looks for backdoors, trojans, suspicious code and phishing URLs in your site. It uses the real-time threat defense feed to keep up with newer threats, and you can set scans to run on a schedule instead of starting them by hand.
Can I block visitors from specific countries?
Yes. Country blocking lets you restrict access from countries you consider high risk. This is useful if your audience is local and most attack traffic arrives from regions where you have no real visitors.
Do I need security expertise to use it?
No. The dashboard presents security alerts, live traffic monitoring and reports in an easy-to-read format, so site owners can follow what is happening and respond to issues without specialist knowledge.
Is Wordfence free?
The code of Wordfence is licensed under the GPL, so anyone may use, change and share it. GPL Feast is a paid service: a plan or a single purchase gives you the download and automatic updates. The developer's own support, licence key and online services are not included.
Which version of Wordfence is this?
Version 9.0.2, released Sep 30, 2026. New versions appear here when the developer publishes them, and members get them as automatic updates.
How do I update Wordfence?
Install the free GPL Feast Updater on your site and connect it with your API key. It installs new versions of Wordfence automatically and keeps a backup, so you can roll back.
You might also like
