Wordfence Security Plugin Setup for WordPress

Wordfence Security Plugin Setup for WordPress

Wordfence is the most widely used WordPress security plugin. It includes a Web Application Firewall (WAF), malware scanner, IP blocking, two-factor authentication, and real-time traffic monitoring.

Basic Setup After Installation

Firewall → Manage WAF:

• Optimization: Switch to Extended Protection mode (requires code addition to auto_prepend_file PHP)
• Web Application Firewall Status: Learning Mode → Protected (after 7 days of learning)

Firewall → Brute Force Protection:

• Lock out after X login failures: 5
• Count failures over X minutes: 5
• Lock out for X minutes: 60
• Immediately lock out invalid usernames: ✓
• Immediately lock out invalid email: ✓

Scan: Run the initial scan. Wordfence compares core files, themes, and plugins against the WordPress repository — identifies modified and added files.

Geolocation-Based Blocking (Wordfence Premium)

Geoblocking is unavailable in the free version. In Premium: Firewall → Country Blocking — block countries from which legitimate users never come.

Rate Limiting

Throttle requests from humans: 240/minute (DEFAULT)
Throttle requests from crawlers: 120/minute
Throttle 404 errors from humans: 60/minute
Throttle 404 errors from crawlers: 20/minute
How long is an IP address blocked: 5 minutes

Notifications

Login Security → Configure email notifications:

• Alert when an administrator signs in: ✓ (only for small sites)
• Alert on critical problems: ✓
• Alert when someone is locked out from login: ✓

Do not enable all notifications — you will receive hundreds of emails and stop paying attention.

Two-Factor Authentication

Login Security → Two-Factor Authentication:

• Activate 2FA for administrators: ✓
• Require 2FA for all admins: ✓

Supports Google Authenticator, Authy, any TOTP application.

WAF Exceptions

The WAF sometimes falsely blocks legitimate requests — for example, from payment systems or REST API clients. Add exceptions: Firewall → Allowlisted URLs.

Important Additional Measures

Wordfence is not a replacement, but a supplement to basic security:

// wp-config.php — restrictions
define('DISALLOW_FILE_EDIT', true);   // disable file editor
define('DISALLOW_FILE_MODS', true);   // disable plugin/theme installation

# Nginx — close xmlrpc.php if not in use
location = /xmlrpc.php { deny all; }
# Close wp-login.php for everyone except your IP
location = /wp-login.php {
    allow 1.2.3.4;  # your IP
    deny all;
}

Timeline

Installation and setup of Wordfence with initial scan — 2–3 hours.