Wordfence is the preferred WordPress security plugin for malware scanning, firewall, and login protection.
Install and Initial Setup
- Install Wordfence > Activate > Get free license key
- Wordfence Dashboard shows: firewall status, recent scan results, blocked IPs, login attempts
- Run initial scan immediately after install
Firewall Configuration
Wordfence > Firewall > Manage Firewall:
| Setting | Value | |---------|-------| | Firewall Status | Learning Mode for 7 days, then "Enabled and Protecting" | | Brute Force Protection | ON | | Rate Limiting | ON | | Block fake Googlebots | ON | | Immediately block known attackers | ON (paid) |
Login Security
Wordfence > Login Security:
| Setting | Value | |---------|-------| | Two-Factor Authentication | Enable for all admin users | | reCAPTCHA on login | ON | | reCAPTCHA on registration | ON | | Limit Login Failures | 20 per 4 hours | | Lock out after failures | 24-hour lockout | | Disable XML-RPC authentication | ON (if not using Jetpack) |
Scan Settings
Wordfence > Scan:
- Scan Frequency: Daily (free tier)
- Scan files outside WordPress root: ON
- Scan for known malware signatures: ON
- Check file permissions: ON
- Run scan: manually after any plugin/theme update
Live Traffic
Wordfence > Tools > Live Traffic:
- View all requests in real time
- Filter by: Humans, Bots, Logged In, Blocked
- Block individual IPs directly from this view: click IP > Block IP
Block IP Addresses
# Via WP-CLI (Wordfence WP-CLI extension)
wp wordfence block ip 192.168.1.100
# Via .htaccess (Apache — immediate effect, no plugin needed)
<Limit GET POST>
order allow,deny
deny from 192.168.1.100
allow from all
</Limit>
Email Alert Configuration
Wordfence > All Options > Email Alert Preferences:
Enable alerts for:
- New admin user created
- Existing user promoted to admin
- IP blocked by brute force
- Malware found in scan
- Scan complete (daily digest)
Alert email: Willie's/agency email — not client email. Managed sites = agency owns monitoring.
Wordfence on MainWP
Use MainWP Wordfence extension to:
- Run scans across all sites from central dashboard
- View scan results per site
- Bulk-apply firewall settings
- See blocked IPs across fleet