Wordfence Security Plugin – Pros, Cons, and Review

Is the Wordfence Security Plugin your Best Choice?

When it comes to WordPress security plugins, Wordfence is among the most popular out there. It includes a malware scanner, endpoint firewall, and a host of other options to protect your WordPress site.

Protecting websites, customer information, and their investments should always a priority when you have a business online. There are literally millions of people who use the WordFence Security plugin as a powerful ally to protect their website.

Wordfence is a property of Defiant Inc. It’s a Delaware-based company operated by a small team of software engineers and customer service reps. Users from around the world have downloaded the plugin over 150 million times and there are over 3 million WordPress websites that use Wordfence as the security plugin of choice.

Let’s look at the Wordfence Security Plugin and determine the pros, cons, and review some of the more important features.

What to Consider When Choosing a Security Plugin

WordPress is one of the largest content platforms online, and it is easy to upgrade your security with a plugin. But there are some things that you should consider before picking one.

The security of a WordPress site depends on the actual servers’ security first and then the person tasked with keeping your WordPress themes, plugin, and backups up-to-date. But where the admin’s job is done, the job of a security plugin begins.

• It should secure the login page from unauthorized logins.
• It should verify file permissions so no one can move or change your files.
• It should block suspicious visitors from trying to access your system.
• It should scan your system for malware or other vulnerabilities.

When researching security options for your WordPress site, make sure you look for these features. Wordfence security incorporates these features and many more that help to keep your website secure.

What is Wordfence Security, and What Does It Do?

Wordfence is comprised of two main things, an endpoint firewall which identifies and blocks malicious traffic and a malware scanner that checks your WordPress core files, themes, plugins, backdoors, SEO spam, malicious redirects or code injections, and anything else you may have installed in subdirectories. 

Setting Up Wordfence Security

Setting up Wordfence is a straightforward process. Once you download and launch the plugin, it asks for an email address where the alerts and other information will go. After you agree with the terms and conditions of the plugin, you’ll see pop-ups with basic information to get you acquainted with the dashboard.

The free version is a good choice for many website owners who do not run mission-critical data through their site. You can go with the default settings if you don’t want to mess with the options. However, if you look forward to fine-tuning it, you can head over to the options page to tweak the default settings.

The “All Options” page allows you to set up everything from one place. However, you can also setup and tweak your settings in each relevant section. You can either enable or disable each of the features depending on your needs.

The advanced settings give you the utmost freedom to tweak the plugin for maximum performance. You can handpick the settings about how the plugin behaves and how it affects your website.

You will find a list of alerts that you can enable or disable. It’s up to you to select which activities you count as a threat. If you have a busy website with lots of traffic, the daily list of alert emails will keep growing. Not all the activities flagged by Wordfence are harmful to your website, so go over them carefully and determine if you really need to use a specific feature.

The Wordfence Firewall

As we’ve already mentioned, Wordfence has an endpoint firewall. This means that the firewall is the “endpoint” where any malicious traffic is stopped from entering your website.

Wordfence uses a PHP based firewall which filters out malicious traffic before it reaches your website.

A cool feature of the Wordfence firewall is that it allows the firewall to be loaded first, even before WordPress itself. They call this “extended protection”. You have to set this up in order for it to work, but it is worth the time.

Unlike cloud alternatives, the Wordfence firewall does not break encryption, can’t be bypassed, and can’t leak data.

It is integrated with the malware scanner so it blocks any requests that may include malicious code or content. It also limits login attempts, which gives you protection from brute force attacks.

Wordfence firewall rules and malware signature updates are done in real-time if you upgrade to the Premium version, otherwise they update every 30 days.

The firewall has a learning mode that you can enable which can prevent false positives from causing you issue with the functionality of your site. It allows Wordfence to whitelist certain requests that may appear to be an attack. This ensures that good traffic can always get through. One very important thing to understand – your site is not protected from some types of complex attacks while in learning mode.

Installing and configuring the firewall is as simple as selecting the options as shown below.

Other Wordfence Firewall Features:

Statistical Information
All information is saved concerning recent attacks on your website. It is available in the dashboard and the firewall page.

Firewall Options
You can change the Firewall Mode to any of the available options: enabled, learning mode, or disabled. This is where you will also find and configure any advanced options.

MySQLi Storage Engine
It stores firewall data in the MySQL database instead of a log file in a subdirectory of your site.

Rate Limiting
This controls how the content of your site can be accessed.

Wordfence Malware Scanner

The first thing to do when the Wordfence security plugin is installed and activated is to run a scan.

Simply click the blue “Start New Scan” button near the bottom to scan your system.

As you can see at the bottom of the scan Wordfence shows you the processes it went through and whether they passed.  If you see a “locked” icon it means that process is only available in the premium version.

Here’s the rest of the processes:

• Server state – Your server up, running, and serving files.
• File changes – Check to see if any core files have been modified.
• Malware scan – Checks for malware on your site.
• Content Safety – Verifies that content is safe for your visitors.
• Public Files – Check to see no sensitive files are available to the public.
• Password strength – Verifies that the admin password is sufficiently strong.
• Vulnerability Scan – Looks for any vulnerabilities that need to be addressed.
• User and Option Audit – Verifies that user and options are set correctly.

If you get the yellow warning section as seen in the graphic above, it could be because your site is running on a LiteSpeed server. LiteSpeed servers have been known to kill or stop processes when Wordfence runs a scan. If you experience this and know that you are running on a LiteSpeed server you can fix it using the Wordfence LiteSpeed documentation.

After the scan has completed you will see the results and can move forward from there to fix them or you can opt to contact a security expert from Wordfence.

The Wordfence malware scanner can keep your website free from threats by checking WordPress core files, themes and plugins, code injections, backdoors, malicious redirects, and other methods hackers use.

It gives you two automatic scanning options: full scans and quick scans. The quick scan has a limited number of checks, while the full scan does everything based on the scan you requested (limited, standard, high sensitivity, and custom).

The free version of Wordfence runs a quick scan every day, and a full scan every 4 days. Wordfence Premium users will have a quick scan every day, plus a full scan every 24 hours. Premium users can customize the scanning schedule.

Once the scan is finished, you can see the list of threats that were found and detailed information about what they mean. The information will also include advice on how you can fix the issues and make your website more secure.

The Wordfence Security Scanner compares the files on your system with the ones in the WordPress.org repository. It checks for file integrity and reports back if anything different is found. It automatically deletes any files that don’t belong in the system.

One of the best features of Wordfence is that it can repair damaged or corrupted files by overwriting it with the original version from the server.

Wordfence scans every security aspect of the website, including abandoned plugins, comments, posts, and all files. It scans for malicious activities with real-time malware signature updates that come with the premium version.

Wordfence is extremely accurate in assessing and detecting threats because of the number of sites using the plugin. The developers can learn about new threats and update the plugin regularly.

Cleaning Up a Hacked Website

No matter how strong your security is, there’s always a chance of things going south. What matters, in this case, is how well you can clean it up after the incident. Wordfence offers excellent support for website malware removal.

The major drawback here is that this feature doesn’t come with either of the versions of Wordfence. It’s a separate add-on service that you have to buy. The good news is that it’s performed by the developers at Wordfence and not an automated solution.

The team at Wordfence will go through your website, repair the infection, and investigate how and where the intrusion took place. After that they will clear the blacklist which will help your search engine results recover. You receive a detailed report outlining how the attackers got in, what they did while in your site, what files it affected, what had to be repaired, then provide you with recommendations on how to secure your system against future attacks.

Wordfence Support and Pricing

Wordfence comes in both free and paid versions. However, the customer support structure is unique. For free customers, it operates the support from the support forum page on WordPress.org. It could take a couple of days after submitting a question, before you receive an answer.

For Wordfence Premium customers, the customer service is better and of course faster. It operates using a ticket system based on customer emails. This aids senior support engineers in addressing any tickets within a few hours. It also offers a direct line to the QA and development teams.

As for pricing, they base it on a tier system. The more sites you have, the lower the price.

• For 1 website- $99.00/Year
• For 2-4 websites- $89.10/Year at 10% discount
• For 5-9 websites- $84.15/Year at 15% discount
• For 10-14 websites- $79.20/Year at 20% discount
• For over 15 websites- $74.25/Year at 25% discount

What Do Users Say?

We searched online to see what actual users of the Wordfence Security plugin had to say. To be honest it was hard to find a bad review of this plugin. It appears most people are happy with the job it does.

Here are some of the reviews we found:

Conclusion

Website security is one of the most important elements you can invest in as a business owner. Hackers are always on the prowl looking to grab any information they can and exploit it for their benefit. To eliminate such a possibility, Wordfence might be the right option for your website security needs.

With features like real-time monitoring, file repair, malware scanning and learning, the Wordfence Security plugin can give your website the safety it’s been needing. If you are interested in researching them further, visit their website here.

More information on plugins.