wordfence.comWordPress Security Plugin | Wordfence

Have you been hacked? Get Help Sign In Pricing Get Wordfence Premium Get Premium You care about what you build. Protect your websites with the best WordPress security available. Wordfence includes an endpoint firewall and malware scanner that were built from the ground up to protect WordPress. Our Threat Defense Feed arms Wordfence with the newest firewall rules, malware signatures and malicious IP addresses it needs to keep your website safe. Rounded out by a suite of additional features, Wordfence is the most comprehensive security option available. Get Wordfence Premium * Globe shows real-time view of attacks Wordfence is blocking (1% sample of the attacks per minute) Brute Force Complex Why choose an endpoint firewall like Wordfence? WordPress security is all we do. Wordfence runs at the endpoint, your server, providing better protection than cloud alternatives. Cloud firewalls can be bypassed and have historically suffered from data leaks. Wordfence firewall leverages user identity information in over 85% of our firewall rules, something cloud firewalls don’t have access to. And our firewall doesn’t need to break end-to-end encryption like cloud solutions. Learn More About Our Endpoint Firewall It's All About The Data Our data is what makes the firewall and scanner effective, upgrade to Premium to enable real-time protection. Learn More About Wordfence Premium Total Attacks Blocked 8,588,435,622 Last 30 Days Malicious IPs Blacklisted 249,852 Last 30 Days The best protection available WordPress Firewall Wordfence includes a Web Application Firewall (WAF) that identifies and blocks malicious traffic. It runs at the endpoint, enabling deep integration with WordPress. Unlike cloud alternatives it does not break encryption, cannot be bypassed and cannot leak data. An integrated malware scanner blocks requests that include malicious code or content. Defends against brute force attacks by limiting login attempts, enforcing strong passwords and other login security measures. Upgrading to Premium enables real-time firewall rule and malware signature updates as well as the Real-time IP Blacklist, which blocks all requests from the most malicious IPs, protecting your site while reducing load. Unrivaled detection capabilities WordPress Security Scanner The Wordfence scanner checks core files, themes and plugins for malware, bad URLs, backdoors, SEO spam, malicious redirects and code injections. It also compares your files with what is in the WordPress.org repository, checking their integrity and reporting any changes to you. Repair files that have changed by overwriting them with a pristine, original version and easily delete any files that don't belong. It also checks your site for known security vulnerabilities, abandoned and closed plugins. Content safety checks ensure that your files, posts and comments don't contain dangerous URLs or suspicious content. Upgrading to Premium enables real-time malware signature updates, reputation checks and better control over scan timing and frequency. The best threat intelligence in the industry Threat Defense Feed The Threat Defense Feed arms the Wordfence plugin with the newest firewall rules, malware signatures, and malicious IP addresses it needs to keep your website safe. Wordfence protects over 4 million WordPress websites, giving us unmatched access to information about how hackers compromise sites, where attacks originate from and the malicious code they leave behind. Our security analysts and developers are 100% focused on WordPress security, constantly adding updates as they discover new threats. Premium members receive the real-time version of the Threat Defense Feed. Free users receive the community version, which is delayed by 30 days. Wordfence Central Wordfence Central is a powerful and efficient way to manage the security for multiple sites in one place. Learn More More Powerful Features Leaked Password Protection Protect your site against attacks that leverage password information stolen in data breaches. Block logins for administrators using known compromised passwords. Leaked Password Protection Data breaches have become all too common lately, arming attackers with millions of usernames, passwords and other sensitive data. We are unfortunately seeing attacks on WordPress sites in the wild leveraging this info. Stay a Step Ahead of Attackers Wordfence now includes protection against this specific threat. The feature allows you to block logins for administrators that use a known compromised password. Any administrator using a password previously seen in a breach will need to reset their password to log in. And we keep up to date with the latest breaches as the occur. We’ve done this by integrating our login security with the database provided by Troy Hunt’s version 2 of the Pwned Passwords API. Troy has built a substantial list of hundreds of millions of compromised passwords across hundreds of data breaches. LEARN MORE Close Live Traffic Monitor visits and hack attempts not shown in other analytics packages in real time; including origin, their IP address and the time of day. Live Traffic Wordfence Live Traffic is a powerful tool that enables you to view activity on your site in real-time, including traffic not shown by Google Analytics and other Javascript loggers. Watch hackers trying to break into your site right now. Monitor visits and hack attempts not shown in other analytics packages and see attempts in real time; including where in the world they’re coming from, their IP address and the time of day. Watch visitors log in and out of your site in real time. There are many scenarios where it is helpful to see who is logging in and out of your site. If you think that you’ve been hacked you can look to see who has logged in, when they did and where they came from. If you are seeing a huge spike in brute force login attempts, you can use the information to develop a blocking strategy. Visibility into which usernames attackers are using during password guessing attacks alerts you to usernames you may need to change. Watch Google Crawl Your Site In Real Time. If you’re like most website owners, SEO matters. Monitor Google as it crawls your site to see which pages are being crawled and which aren’t. Identify issues like crawling non-existent pages and missing robots.txt files. Watch site visitors use your site in real time ; including where in the world they’re coming from, their IP address and the time of day. Protect your intellectual property from content thieves. Content thieves are crawlers that steal your site content and hard-earned brand recognition by crawling your site for content and republishing it on their own website. Keep your content under control. Block rogue crawlers in real-time. If someone or something is generating many “page not found errors” or consuming content too aggressively, they’re likely up to no good. Block them with Wordfence, and make room for Google crawlers to work unhindered. Close Advanced Manual Blocking Quickly and efficiently block entire malicious networks and any human or robot activity that indicates suspicious intentions based on pattern matching and IP ranges. Advanced Manual Blocking Powerful options allow you to block traffic from any source Quickly and efficiently dispatch site security threats by blocking entire malicious networks and any human or robot activity that indicates suspicious intentions based on pattern matching and IP ranges. Wordfence helps you intelligently block WordPress website threats by giving you the ability to: Block ranges of IP addresses (Think of these as networks) Specific web browsers and web browser patterns Referring websites Any combination of the above Close Country Blocking Blocking countries who are clearly engaging in malicious activity is an effective way to protect your site during an attack. Premium Feature. Country Blocking Put geographic protection in place Wordfence country blocking is designed to stop an attack...