Wordfence is a security plugin for WordPress websites that scans files for malware and blocks attacks. It includes a web application firewall (WAF), which filters web requests before they reach the site, and an audit log that records changes and logins.
History of Wordfence
Creator: Mark Maunder and Kerry Boyte, founders of Defiant Inc. Year: 2012.
Wordfence is made by Defiant Inc. Defiant Inc is registered in Delaware. It is based in Seattle, Washington. The company's about page names Mark Maunder and Kerry Boyte as founders. Maunder is the chief executive officer (CEO). Boyte is the chief financial officer (CFO). Maunder has worked in security for more than 25 years.
The plugin was added to the WordPress.org plugin directory on 21 April 2012. The WordPress.org page lists it as a tool for WordPress sites. The company's about page says the plugin has more than 5 million active installs.
The firm says it has about 40 team members. Most are in the United States. Others work in Europe, the United Kingdom and Australia. The firm is fully remote, according to its about page. Its business hours and support levels are listed on the website.
Defiant Inc also runs a threat intelligence service named Wordfence Intelligence. It has a vulnerability data feed. It also posts weekly reports on WordPress flaws. The firm puts out a quarterly threat report. It also puts out monthly reports from its bug bounty program. The company page lists a copyright period of 2012 to 2026.
Changelog and latest update
Wordfence lists a dated changelog with each release. It is on the WordPress.org plugin page. The changelog groups changes as Change, Improvement and Fix. Entries cover the firewall. They cover the malware scanner, login protection and the audit log.
Recent entries show work on compatibility and the REST API. Version 9.0.2 improved the REST API. It guards the API against user enumeration. Enumeration lets attackers list user names. The same release works better with WordPress Playground. It also fixed PHP 8.1 deprecation notices.
Other entries in version 9.0.2 change the Internet Protocol version 6 (IPv6) diagnostics result. It now only gives information. They add a help link to emails that report a rise in attack rates. A fix upgraded a dependency. The old one made the Firefox tab crash on pages with many elements, such as a running scan.
Latest update: Wordfence 9.0.2, 2026-09-30
The WordPress.org changelog dates version 9.0.2 at 30 September 2026. The IPv6 diagnostics result now only gives information. A help link now appears in attack rate emails. The plugin works better with WordPress Playground. The REST API is harder to probe for user names. A missing return value is added to the audit log filter for upgrader_pre_install. The login page translation now works. The web application firewall (WAF) handles JSON with array values better.
Usage examples
Wordfence runs inside WordPress and is managed with the WP-CLI command line tool. The examples below install the plugin, read its latest version from the WordPress.org data feed, check the installed version from PHP and update the plugin. Each example runs on a site where WordPress and the command line tools are already installed.
cd /var/www/html
wp plugin install wordfence --activateWP-CLI installs the wordfence plugin from the WordPress.org directory and turns it on in one command. The install step downloads the newest release. The activate option switches the plugin on so that its firewall and scanner start running.
API=https://api.wordpress.org/plugins
curl -s "$API/info/1.0/wordfence.json" \
| jq -r '.version'This command reads the public plugin information record and prints the version number. The jq tool picks the version field from the JSON response. On 12 October 2026 the record reported version 9.0.2.
<?php
require_once ABSPATH
. 'wp-admin/includes/plugin.php';
$file = WP_PLUGIN_DIR
. '/wordfence/wordfence.php';
$data = get_plugin_data($file);
echo $data['Version'];This snippet reads the plugin header of the installed Wordfence file and prints the Version field. The get_plugin_data function is part of WordPress. The path points to the main plugin file in the wordfence folder.
cd /var/www/html
wp plugin update wordfence
wp plugin get wordfence --field=versionThe update command installs the newest Wordfence release when a newer version is listed. The get command then prints the installed version number, so the administrator can confirm the update finished.
References
These sources are outside Websnoogie and were checked on 2026-10-12.
Wordfence Security on WordPress.org
WordPress.org
The official plugin directory page for Wordfence. It lists the current version, the release date, the tested WordPress versions and the changelog for each release of the security plugin.
Wordfence Plugin Information API
WordPress.org
The public data record for the plugin in JSON format. It gives the version number, the last updated date, the date the plugin was added to the directory and the full changelog text.
Wordfence Support Forum
WordPress.org
The support forum for the Wordfence plugin on WordPress.org. Site owners post questions and reports about scans, firewall rules and login protection on their WordPress sites, and the threads are public.
Plugin Security Guidelines
WordPress Developer Resources
The official WordPress guidance on writing secure plugins. It explains input validation, output escaping and nonce checks, which security plugins such as Wordfence rely on to protect sites.
Wordfence on GitHub
GitHub, Wordfence
The public GitHub organization page for Wordfence. It lists the code repositories that the company publishes, which developers can open to read the source of its WordPress security tools.
Wordfence Launches Superhero Challenge
WP Tavern
A news article from WP Tavern, a WordPress news site, about the Wordfence WordPress Superhero Challenge. The article title names the contest, and the article reports the launch of the challenge by Wordfence.
Is your login page guarded?
Does your site have a login page that anyone on the internet can reach? If so, automated bots will try to guess passwords. A security plugin, such as Wordfence, watches for those attempts and blocks them. The plugin adds a shield. It works best with strong passwords, current software and a host that filters traffic. We set up each of those parts before we call a site ready.
The host plays a large role. Our hosting runs at 99.999% uptime. WordPress sites need CMS (content management system) hosting, which costs $149 a year. Plain HTML and PHP sites can run on a $129 yearly plan with free SSL and no database. A site with no database has fewer parts that attackers can target, so that plan suits many brochure sites.
Our checks cover the login page, the admin account, the software versions and the backups. We review each user account and remove any account nobody needs. We set strong passwords and keep a written list of who has access. We check that updates are installed, and we tell you what changed in each one.
Call 402-813-4034 to ask how your site handles logins today. Tell us which pages need protection, and we will answer in plain words. Ask us about a new build that is guarded from the first day, or request the $300 website.
