{"slug":"wordfence-security-setup","title":"Wordfence Security Plugin Setup","tags":["wordfence","security","firewall","malware-scan","login-protection"],"agent_summary":"Wordfence installation and configuration: firewall learning mode, brute force protection, rate limiting, scan schedule, two-factor authentication, live traffic monitoring, IP blocking, and email alert configuration for managed WordPress sites.","trigger_phrases":["wordfence setup","wordfence configuration","wordfence firewall","wordpress security plugin","wordfence scan","block ip wordfence","wordfence 2fa","wordfence alerts","wordpress malware scan"],"runnable":true,"markdown":"\nWordfence is the preferred WordPress security plugin for malware scanning, firewall, and login protection.\n\n## Install and Initial Setup\n\n1. Install Wordfence > Activate > Get free license key\n2. Wordfence Dashboard shows: firewall status, recent scan results, blocked IPs, login attempts\n3. Run initial scan immediately after install\n\n## Firewall Configuration\n\nWordfence > Firewall > Manage Firewall:\n\n| Setting | Value |\n|---------|-------|\n| Firewall Status | Learning Mode for 7 days, then \"Enabled and Protecting\" |\n| Brute Force Protection | ON |\n| Rate Limiting | ON |\n| Block fake Googlebots | ON |\n| Immediately block known attackers | ON (paid) |\n\n## Login Security\n\nWordfence > Login Security:\n\n| Setting | Value |\n|---------|-------|\n| Two-Factor Authentication | Enable for all admin users |\n| reCAPTCHA on login | ON |\n| reCAPTCHA on registration | ON |\n| Limit Login Failures | 20 per 4 hours |\n| Lock out after failures | 24-hour lockout |\n| Disable XML-RPC authentication | ON (if not using Jetpack) |\n\n## Scan Settings\n\nWordfence > Scan:\n- Scan Frequency: Daily (free tier)\n- Scan files outside WordPress root: ON\n- Scan for known malware signatures: ON\n- Check file permissions: ON\n- Run scan: manually after any plugin/theme update\n\n## Live Traffic\n\nWordfence > Tools > Live Traffic:\n- View all requests in real time\n- Filter by: Humans, Bots, Logged In, Blocked\n- Block individual IPs directly from this view: click IP > Block IP\n\n## Block IP Addresses\n\n```bash\n# Via WP-CLI (Wordfence WP-CLI extension)\nwp wordfence block ip 192.168.1.100\n\n# Via .htaccess (Apache — immediate effect, no plugin needed)\n<Limit GET POST>\norder allow,deny\ndeny from 192.168.1.100\nallow from all\n</Limit>\n```\n\n## Email Alert Configuration\n\nWordfence > All Options > Email Alert Preferences:\n\nEnable alerts for:\n- New admin user created\n- Existing user promoted to admin\n- IP blocked by brute force\n- Malware found in scan\n- Scan complete (daily digest)\n\n**Alert email:** Willie's/agency email — not client email. Managed sites = agency owns monitoring.\n\n## Wordfence on MainWP\n\nUse MainWP Wordfence extension to:\n- Run scans across all sites from central dashboard\n- View scan results per site\n- Bulk-apply firewall settings\n- See blocked IPs across fleet\n","html":"<p>Wordfence is the preferred WordPress security plugin for malware scanning, firewall, and login protection.</p>\n<h2>Install and Initial Setup</h2>\n<ol>\n<li>Install Wordfence > Activate > Get free license key</li>\n<li>Wordfence Dashboard shows: firewall status, recent scan results, blocked IPs, login attempts</li>\n<li>Run initial scan immediately after install</li>\n</ol>\n<h2>Firewall Configuration</h2>\n<p>Wordfence > Firewall > Manage Firewall:</p>\n<p>| Setting | Value |\n|---------|-------|\n| Firewall Status | Learning Mode for 7 days, then \"Enabled and Protecting\" |\n| Brute Force Protection | ON |\n| Rate Limiting | ON |\n| Block fake Googlebots | ON |\n| Immediately block known attackers | ON (paid) |</p>\n<h2>Login Security</h2>\n<p>Wordfence > Login Security:</p>\n<p>| Setting | Value |\n|---------|-------|\n| Two-Factor Authentication | Enable for all admin users |\n| reCAPTCHA on login | ON |\n| reCAPTCHA on registration | ON |\n| Limit Login Failures | 20 per 4 hours |\n| Lock out after failures | 24-hour lockout |\n| Disable XML-RPC authentication | ON (if not using Jetpack) |</p>\n<h2>Scan Settings</h2>\n<p>Wordfence > Scan:</p>\n<ul>\n<li>Scan Frequency: Daily (free tier)</li>\n<li>Scan files outside WordPress root: ON</li>\n<li>Scan for known malware signatures: ON</li>\n<li>Check file permissions: ON</li>\n<li>Run scan: manually after any plugin/theme update</li>\n</ul>\n<h2>Live Traffic</h2>\n<p>Wordfence > Tools > Live Traffic:</p>\n<ul>\n<li>View all requests in real time</li>\n<li>Filter by: Humans, Bots, Logged In, Blocked</li>\n<li>Block individual IPs directly from this view: click IP > Block IP</li>\n</ul>\n<h2>Block IP Addresses</h2>\n<pre><code class=\"language-bash\"># Via WP-CLI (Wordfence WP-CLI extension)\nwp wordfence block ip 192.168.1.100\n\n# Via .htaccess (Apache — immediate effect, no plugin needed)\n&#x3C;Limit GET POST>\norder allow,deny\ndeny from 192.168.1.100\nallow from all\n&#x3C;/Limit>\n</code></pre>\n<h2>Email Alert Configuration</h2>\n<p>Wordfence > All Options > Email Alert Preferences:</p>\n<p>Enable alerts for:</p>\n<ul>\n<li>New admin user created</li>\n<li>Existing user promoted to admin</li>\n<li>IP blocked by brute force</li>\n<li>Malware found in scan</li>\n<li>Scan complete (daily digest)</li>\n</ul>\n<p><strong>Alert email:</strong> Willie's/agency email — not client email. Managed sites = agency owns monitoring.</p>\n<h2>Wordfence on MainWP</h2>\n<p>Use MainWP Wordfence extension to:</p>\n<ul>\n<li>Run scans across all sites from central dashboard</li>\n<li>View scan results per site</li>\n<li>Bulk-apply firewall settings</li>\n<li>See blocked IPs across fleet</li>\n</ul>\n"}