This article is a localized edition of the Japanese original. Read the Japanese original
Bottom line: what Wordfence is and what the free version can do
Wordfence Security is a security plugin for WordPress (its author is Mark Maunder). It combines a firewall, malware scanning and login security in one package. Even the free version covers the basic defenses. However, in the free version, firewall rules and malware signatures are delivered with a 30-day delay. Real-time updates come with the paid Premium version.
This article is based on the official wordpress.org page as of October 16, 2026. Because the names of screen items change between versions, it does not include click-by-click instructions. For the actual operations, refer to Wordfence's official documentation.
Free vs Premium
| Free | Premium (paid) | |
|---|---|---|
| Web application firewall | Yes | Yes |
| Firewall rule and malware signature updates | 30-day delay | Real time |
| Malware scanning | Yes | Yes. Also more frequent scans and scheduling at a set time |
| Integrity check | Yes | Yes |
| Vulnerability check | Yes | Yes |
| Login security (passkeys, two-factor authentication, CAPTCHA, etc.) | Yes | Yes |
| Brute force protection (limiting login attempts) | Yes | Yes |
| Blocking (IP, IP range, hostname, User Agent, referrer) | Yes | Yes |
| Live Traffic | Yes | Yes |
| Real-time IP blocklist | No | Yes |
| Country blocking | No | Yes |
| Checking whether your site or IP is on a blocklist | No | Yes |
| Security audit log | No | Yes |
| Support | Forums (volunteers) | Paid ticket-based support |
Note: "No" marks features the official page lists as Premium features and that do not appear in the free version's feature list. Pricing for the paid version is not included in this article; check the official page.
On wordpress.org it has more than 5 million active installations, and it is listed as tested up to WordPress 7.1.3.
What the free version can do
The wordpress.org description lists features such as the following.
Firewall and blocking
- The web application firewall identifies and blocks malicious traffic
- With the blocking feature, you can create rules based not only on IP addresses but also on IP ranges, hostnames, User Agents and referrers
- As brute force protection, you can limit the number of login attempts
Malware scanning and integrity checks
- It examines core files, themes and plugins to detect malware, suspicious URLs, backdoors, SEO spam, malicious redirects and more
- The integrity check compares files with the WordPress.org repository and reports changes. Modified files can be repaired with the original version
- The vulnerability check looks for known vulnerabilities and also warns you about abandoned plugins
Login security
- It supports passkeys and TOTP-based two-factor authentication
- It supports CAPTCHA on the login page, XML-RPC settings, and blocking administrator logins that use compromised passwords
Live Traffic
You can see visitors, bots and attack attempts in real time.
How to plan your setup
This is not a list of screen operations but the order of "what to decide".
- Install and activate the plugin
- Enable the firewall
- Run a malware scan once and review the results
- In login security, set up two-factor authentication or a passkey for administrators
- If needed, decide on IP and other conditions with the blocking feature
Because rule updates in the free version are delayed by 30 days, keeping WordPress core, themes and plugins up to date is a prerequisite.
Things to watch out for
- If you misconfigure blocking, you can lock yourself out of your own site. If you get a 403 error and can't get in, see How to clear a 403 error caused by Wordfence
- The official FAQ recommends a complete reinstall after a site has been compromised. Wordfence can repair core files, themes and plugins, but repair alone may not be enough
- The official page says that, thanks to caching of configuration data and similar measures, it does not slow down your site. The actual impact depends on your environment, so check your page speed after installing it
- Wordfence Central, which lets you manage multiple sites from one place, is described as free to use with no limit on the number of sites
Frequently asked questions
Can I use it for free?
The basic features are available in the free version. However, the 30-day delay in rule updates and the fact that country blocking and some other features are Premium-only are the free version's limits.
Can I block by country?
Country blocking is a Premium feature. With the free version's blocking feature, you can specify IP addresses, IP ranges, hostnames, User Agents and referrers.
Can I use two-factor authentication?
Yes, in the free version. It supports passkeys and TOTP-based two-factor authentication. For adding two-factor authentication to WordPress, also see How to implement two-factor authentication (2FA) in WordPress.
What if a scan finds malware?
For the steps to deal with it, see How to detect and remove malware with the Wordfence scan.
I want to compare it with other security plugins.
We compare them in WordPress security plugins: Wordfence vs Sucuri compared, and how to choose. For hiding the entrance by changing the login URL, see How to change the WordPress login URL.
Official sources used (checked October 16, 2026)
Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)