Skip to content
PluginCanary

Wordfence Security - Firewall, Malware Scan, and Login Security

by Mark Maunder · 5,000,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: downloads in the last 4 weeks are down more than half vs the 26-week average.

94/ 100 Canary Score
Sub-scores for Wordfence Security - Firewall, Malware Scan, and Login Security
Ownership100
Maintenance100
Security100
Support84
Reputation75

How the score works

Active signals

Facts we detected, with links to the source.

  • InfoMOM-2Downloads in the last 4 weeks are down more than half vs the 26-week average. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
wfmatt22 Dec 2014 to 27 Jan 2023, 89 commits
wfryan11 Oct 2016 to 30 Sep 2026, 165 commits
wfalexk10 May 2021 to 25 Aug 2025, 52 commits

3 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
34 days ago
Releases, 24 months
17
Tested up to
7.1 current
Requires PHP
7.0 supported 8.2+
Releases per quarter for Wordfence Security - Firewall, Malware Scan, and Login Security
Q1 20244
Q2 20242
Q3 20241
Q4 20242
Q1 20253
Q2 20251
Q3 20251
Q4 20254
Q1 20260
Q2 20263
Q3 20263
Q4 20260

Last release 30 Sep 2026. Tested with WordPress 7.1 (current).

Support

84% of 183 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
6 Sep 2022Wordfence Security – Firewall & Malware Scan <= 7.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 7.6.07.6.11
2 Oct 2018Wordfence Security – Firewall & Malware Scan <= 7.1.13 - Reflected Cross-Site Scripting and Information Disclosure4.7< 7.1.147.1.140
10 May 2016Wordfence Security – Firewall & Malware Scan 6.1.1 - 6.1.6 - Reflected Cross-Site Scripting6.16.1.1 to 6.1.66.1.71
8 Dec 2014Wordfence <= 5.1.4 - Reflected Cross-Site Scripting6.1< 5.1.55.1.50
27 Sep 2014Wordfence Security <= 5.2.3 - Stored Cross-Site Scripting via HTTP_HOST7.2<= 5.2.35.2.40
14 Sep 2014Wordfence <= 5.2.3 - Stored Cross-Site Scripting via REQUEST_URI7.2<= 5.2.35.2.42
14 Sep 2014Wordfence <= 5.2.3 - Multiple Protection Mechanism Bypasses6.5< 5.2.45.2.42
8 Sep 2014Wordfence <= 5.2.2 - Stored Cross-Site Scripting7.2< 5.2.35.2.34
1 Aug 2014Wordfence Security <= 3.8.1 - Stored Cross-Site Scripting7.2<= 3.8.13.8.30
30 Jul 2014Wordfence Security – Firewall & Malware Scan <= 5.1.3 - Cross-Site Scripting7.2<= 5.1.35.1.40
19 Oct 2012Wordfence Security - Firewall & Malware Scan <= 3.3.6 - Stored Cross-Site Scripting6.5<= 3.3.63.3.71
19 Oct 2012Wordfence < 3.3.7 - Reflected Cross-Site Scripting6.1< 3.3.73.3.71

Source: Wordfence Intelligence.

Reputation

Average rating 5.0 in Q4 2026.

Rating distribution
5 star4550
4 star120
3 star70
2 star45
1 star257

Momentum

5,000,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Wordfence Security - Firewall, Malware Scan, and Login Security
4 May 20261,667,061
11 May 20263,098,959
18 May 2026531,617
25 May 2026308,323
1 Jun 2026263,395
8 Jun 2026234,115
15 Jun 2026214,059
22 Jun 2026204,021
29 Jun 2026191,395
6 Jul 2026182,084
13 Jul 2026179,561
20 Jul 2026196,992
27 Jul 2026189,409
3 Aug 2026179,463
10 Aug 20263,144,758
17 Aug 2026387,951
24 Aug 2026325,083
31 Aug 2026278,039
7 Sep 20263,054,928
14 Sep 2026511,762
21 Sep 2026354,525
28 Sep 20262,993,893
5 Oct 2026561,823
12 Oct 2026304,864
19 Oct 2026339,259
26 Oct 2026276,359
2 Nov 202637,113

Weekly downloads over the last 4 weeks are 68% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

No healthier plugin in the same category yet.

Facts

Version9.0.2
AuthorMark Maunder
Added21 Apr 2012
Last updated30 Sep 2026
Active installs5,000,000+
Requires WordPress4.7
Tested up to7.1.4
Requires PHP7.0
CategorySecurity & Privacy > Security Scanning & Malware Protection
Tags2FA, malware, scanner, firewall, security

Questions

Is Wordfence Security - Firewall, Malware Scan, and Login Security still maintained?

Wordfence Security - Firewall, Malware Scan, and Login Security was last updated on 30 Sep 2026. Its Canary status is Healthy.

Is Wordfence Security - Firewall, Malware Scan, and Login Security safe?

Wordfence Security - Firewall, Malware Scan, and Login Security has no open unpatched vulnerabilities on record. 0 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns Wordfence Security - Firewall, Malware Scan, and Login Security?

The wordpress.org author is Mark Maunder. Recent committers: wfryan, wfalexk, wfmatt, mmaunder, plugin-master. We have recorded no ownership change.

What can I use instead of Wordfence Security - Firewall, Malware Scan, and Login Security?

We have no healthier plugin in the same category on record yet.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue