Beschrijving
DE POPULAIRSTE WORDPRESS FIREWALL & BEVEILIGINGS SCANNER
WordPress beveiliging vereist een team van toegewijde analisten dat onderzoek doet naar de nieuwste malware varianten en WordPress exploitaties, deze omzet in firewall regels en malware handtekeningen en deze zonder vertraging aan klanten vrijgeeft. Wordfence wordt algemeen erkend als het grootste WordPress beveiliging onderzoeksteam ter wereld. Onze plugin biedt een uitgebreide reeks beveiliging functies, en het onderzoek van ons team is de drijvende kracht achter onze plugin en biedt het beveiligingsniveau waar we bekend om staan.
Bij Wordfence is WordPress beveiliging geen onderdeel van ons bedrijf; WordPress beveiliging is het enige wat we doen. We hebben een wereldwijd, 24 uur per dag toegewijd incident responsteam in dienst dat onze prioriteit klanten een responstijd van 1 uur biedt voor elk beveiliging incident. De zon gaat nooit onder voor ons wereldwijde beveiligingsteam en we beschikken over een geavanceerd platform voor bedreiging informatie om baanbrekend beveiliging onderzoek naar de nieuwste veiligheid bedreigingen te verzamelen, analyseren en produceren.
Wordfence Security bevat een endpoint firewall, malware scanner, robuuste login beveiligingsfuncties, live verkeersweergaven en meer. Onze Threat Defense Feed voorziet Wordfence van de nieuwste firewallregels, malwarehandtekeningen en kwaadaardige IP-adressen die het nodig heeft om je site veilig te houden. Aangevuld met 2FA en een reeks extra functies is Wordfence de meest uitgebreide WordPress beveiligingsoplossing die beschikbaar is.
WORDPRESS FIREWALL
- Web Application Firewall identificeert en blokkeert kwaadaardig verkeer. Gebouwd en onderhouden door een groot team dat 100% gericht is op WordPress beveiliging.
- [Premium] Real-time updates van firewall regels en malware handtekeningen via de Threat Defense Feed (gratis versie is 30 dagen vertraagd).
- [Premium] Realtime IP blokkeerlijst blokkeert alle verzoeken van de meest kwaadaardige IP’s, beschermt je site en vermindert de belasting.
- Beschermt de site op het endpoint en maakt diepe integratie met WordPress mogelijk. In tegenstelling tot cloud alternatieven wordt de codering niet verbroken, kan deze niet worden omzeild en kunnen er geen gegevens lekken.
- Integrated malware scanner blocks requests that include malicious code or content.
- Bescherming tegen brute force aanvallen door login pogingen te beperken.
WORDPRESS BEVEILIGING SCANNER
- Malware scanner controleert core bestanden, thema’s en plugins op malware, slechte URL’s, achterdeuren, SEO spam, kwaadaardige omleidingen en code injecties.
- [Premium] Realtime updates van malware handtekeningen via de Threat Defense Feed (de gratis versie heeft een vertraging van 30 dagen).
- Vergelijkt je core bestanden, thema’s en plugins met wat er in de WordPress.org repository staat, controleert hun integriteit en rapporteert eventuele wijzigingen aan je.
- Herstel bestanden die zijn gewijzigd door ze te overschrijven met een ongerepte, originele versie. Verwijder alle bestanden die niet gemakkelijk in de Wordfence interface thuishoren.
- Controleert je site op bekende beveiligingsproblemen en waarschuwt bij eventuele problemen. Waarschuwt ook voor mogelijke beveiligingsproblemen wanneer een plug-in is gesloten of verlaten.
- Controleert de veiligheid van je content door de inhoud van bestanden, berichten en opmerkingen te scannen op gevaarlijke URL’s en verdachte inhoud.
- [Premium] Checks to see if your site or IP have been blocklisted for malicious activity, generating spam or other security issue.
LOGIN BEVEILIGING
- Twee-factor authenticatie (2FA), een van de veiligste vormen van systeem authenticatie op afstand die beschikbaar is via elke TOTP gebaseerde authenticator app of dienst.
- Login pagina CAPTCHA blokkeert bots die proberen om in te loggen.
- 2FA uitschakelen of toevoegen aan XML-RPC.
- Blokkeer logins voor beheerders die gecompromitteerde wachtwoorden gebruiken.
SECURITY AUDIT LOG [Premium]
- Monitors all changes and actions in security-sensitive areas of the site.
- Remote tamper-proof data storage via Wordfence Central.
- Monitored actions range from user creation and editing to plugin/theme installation and updates to post and page changes.
- Configurable to log all events or significant events only, which includes all authentication, site configuration, and site functionality events.
WORDFENCE CENTRAL
- Wordfence Central is een krachtige en efficiënte manier om de beveiliging voor meerdere sites op één plaats te beheren.
- Beoordeel efficiënt de beveiligingsstatus van al je sites in één overzicht. Bekijk gedetailleerde beveiligingsbevindingen zonder Wordfence Central te verlaten.
- Krachtige templates maken het configureren van Wordfence een fluitje van een cent.
- In hoge mate configureerbare waarschuwingen kunnen worden afgeleverd via e-mail, SMS of Slack. Verbeter de signaal-ruisverhouding door gebruik te maken van opties voor het ernstniveau en een dagelijkse verwerkingsoptie.
- Traceer en waarschuw voor belangrijke beveiligingsgebeurtenissen, zoals aanmeldingen van beheerders, het gebruik van overtreden wachtwoorden en pieken in aanvalsactiviteiten.
- Gratis om te gebruiken op een onbeperkt aantal sites.
VEILIGHEIDSGEREEDSCHAP
- Met Live Traffic kun je bezoeken en hack pogingen monitoren die niet in andere analyse pakketten worden weergegeven; inclusief herkomst, hun IP-adres, het tijdstip en de tijd die op je site is doorgebracht.
- Blokkeer aanvallers op basis van IP of maak geavanceerde regels gebaseerd op IP bereik, hostnaam, user agent en verwijzer.
- Landblokkering beschikbaar met Wordfence Premium.
Schermafdrukken
The dashboard gives you an overview of your site’s security including notifications, attack statistics and Wordfence feature status. The firewall protects your site from common types of attacks and known security vulnerabilities. The Wordfence Security Scanner lets you know if your site has been compromised and alerts you to other security issues that need to be addressed. Wordfence is highly configurable, with a deep set of options available for each feature. High level scan options are shown above. Brute Force bescherming functies beschermen je tegen wachtwoord radende aanvallen. Blokkeer aanvallers op IP, Land, IP bereik, Hostnaam, Browser of verwijzer. The Wordfence Live Traffic view shows you real-time activity on your site including bot traffic and exploit attempts. Breng login beveiliging naar een hoger niveau met twee-factor authenticatie. Inloggen is eenvoudig met Wordfence 2FA.
Installatie
Beveilig je site door de volgende stappen te gebruiken om Wordfence te installeren:
- Installeer Wordfence automatisch of door het ZIP bestand te uploaden
- Activeer Wordfence via het ‘Plugins’ menu in WordPress. Wordfence is nu geactiveerd.
- Go to the scan menu and start your first scan. Scheduled scanning will also be enabled.
- Nadat je eerste scan is afgerond, verschijnt er een lijst met bedreigingen. Ga ze stuk voor stuk na om je site te beveiligen.
- Bezoek de Wordfence opties pagina om je e-mailadres in te voeren, zodat je e-mail beveiligingswaarschuwingen kunt ontvangen.
- Optioneel kun je je beveiligingsniveau wijzigen of de geavanceerde opties aanpassen om individuele scan- en beschermingsopties voor je site in te stellen.
- Klik op de menu-optie “Live Traffic” om de activiteit op je site in realtime te bekijken. Situatiebewustzijn is een belangrijk onderdeel van sitebeveiliging.
Om Wordfence op WordPress multi-site installaties te installeren:
- Installeer Wordfence via de plugin folder of door het ZIP bestand te uploaden.
- Activeer Wordfence netwerkbreed. Deze stap is belangrijk, want totdat je het netwerkbreed activeert, zullen je sites de plugin optie in hun plugin menu zien. Eenmaal geactiveerd verdwijnt die optie.
- Nu dat Wordfence is geactiveerd zal het verschijnen in je netwerk beheer menu. Wordfence zal niet verschijnen in het menu van een individuele site.
- Ga naar het “Scan” menu en start je eerste scan.
- Wordfence zal een scan uitvoeren van alle bestanden in je WordPress installatie, inclusief die in de blogs.dir folder van je individuele sites.
- Live Traffic wordt weergegeven voor ALLE sites in je netwerk. Als je een systeem met veel verkeer heeft, wil je mogelijk Live Traffic uitschakelen, wat het loggen naar de DB zal stoppen
- Firewallregels en login regels zijn van toepassing op het HELE systeem. Dus als je een inlogpoging mislukt op site1.example.com en site2.example.com, telt dat als 2 mislukkingen. Crawler verkeer wordt geteld tussen blogs, dus als je drie sites in het netwerk bezoekt, worden alle hits opgeteld en dat telt als de snelheid waarmee je het systeem benadert.
FAQ
-
How does Wordfence Security protect sites from attackers?
-
The WordPress security plugin provides the best protection available for your website. Powered by the constantly updated Threat Defense Feed, Wordfence Firewall stops you from getting hacked. Wordfence Scan leverages the same proprietary feed, alerting you quickly about security issues or if your site is compromised. The Live Traffic view gives you real-time visibility into traffic and hack attempts on your website. A deep set of additional tools round out the most comprehensive WordPress security solution available.
-
We offer a Premium API key that gives you real-time updates to the Threat Defense Feed which includes a real-time IP blocklist, firewall rules, and malware signatures. Premium support, country blocking, more frequent scans, and spam and spamvertising checks are also included. Click here to sign-up for Wordfence Premium now or simply install Wordfence free and start protecting your website.
-
How does the Wordfence WordPress Firewall protect websites?
-
- Web Application Firewall voorkomt dat je gehackt wordt door kwaadaardig verkeer te identificeren en aanvallers te blokkeren voordat ze toegang krijgen tot je site.
- Threat Defense Feed automatically updates firewall rules that protect you from the latest threats. Premium members receive the real-time version.
- Blokkeer veel voorkomende WordPress beveiligingsproblemen zoals valse Googlebots, en gevaarlijke scans van hackers en botnets.
-
What checks does the Wordfence Security Scanner perform?
-
- Scant corebestanden, thema’s en plugins tegen de versies in de WordPress.org repository om hun integriteit te controleren. Verifieer de veiligheid van je bron.
- Bekijk hoe bestanden zijn gewijzigd. Optioneel herstel van gewijzigde bestanden die een beveiligingsrisico vormen.
- Scant op handtekeningen van meer dan 44.000 bekende malwarevarianten die bekend staan als WordPress beveiligingsdreigingen.
- Scant op veel bekende backdoors die beveiligingslekken veroorzaken, waaronder C99, R57, RootShell, Crystal Shell, Matamu, Cybershell, W4cking, Sniper, Predator, Jackal, Phantasma, GFS, Dive, Dx en vele anderen.
- Scant continu op malware en phishing URL’s, inclusief alle URL’s op de Google Safe Browsing-lijst in al je reacties, berichten en bestanden die veiligheidsrisico’s vormen.
- Scant op heuristieken van achterdeuren, trojans, verdachte code en andere beveiligingsproblemen.
-
What security monitoring features does Wordfence include?
-
- Bekijk al je verkeer in real-time, inclusief robots, mensen, 404 fouten, in- en uitloggen en wie het meeste van je inhoud verbruikt. Verhoogt je situatiebewustzijn van welke beveiligingsdreigingen je site het hoofd moet bieden.
- Een realtime overzicht van al het verkeer, inclusief geautomatiseerde bots die vaak veiligheidsrisico’s vormen die JavaScript analysepakketten je nooit tonen.
- Real-time verkeer omvat reverse DNS en geolocatie op stadsniveau. Weet uit welk geografisch gebied beveiligingsdreigingen afkomstig zijn.
- Monitort schijfruimte wat gerelateerd is aan beveiliging omdat veel DDoS-aanvallen proberen alle schijfruimte te verbruiken om een dienstweigering te veroorzaken.
-
What login security features are included
-
- Bekijk al je verkeer in real-time, inclusief robots, mensen, 404 fouten, in- en uitloggen en wie het meeste van je inhoud verbruikt. Verhoogt je situatiebewustzijn van welke beveiligingsdreigingen je site het hoofd moet bieden.
- Een realtime overzicht van al het verkeer, inclusief geautomatiseerde bots die vaak veiligheidsrisico’s vormen die JavaScript analysepakketten je nooit tonen.
- Real-time verkeer omvat reverse DNS en geolocatie op stadsniveau. Weet uit welk geografisch gebied beveiligingsdreigingen afkomstig zijn.
- Monitort schijfruimte wat gerelateerd is aan beveiliging omdat veel DDoS-aanvallen proberen alle schijfruimte te verbruiken om een dienstweigering te veroorzaken.
-
Hoe word ik gewaarschuwd als mijn site een beveiligingsprobleem heeft?
-
Wordfence verzendt beveiligingswaarschuwingen via e-mail. Nadat je Wordfence heeft geïnstalleerd, stelt je een lijst met e-mailadressen samen waar beveiligingswaarschuwingen naartoe worden gestuurd. Wanneer je een beveiligingswaarschuwing ontvangt, zorg er dan voor dat je deze snel afhandelt om de veiligheid van je site te waarborgen.
-
Do I need a security plugin like Wordfence if I’m using a cloud based firewall (WAF)?
-
Wordfence provides true endpoint security for your WordPress website. Unlike cloud based firewalls, Wordfence executes within the WordPress environment, giving it knowledge like whether the user is signed in, their identity and what access level they have. Wordfence uses the user’s access level in more than 80% of the firewall rules it uses to protect WordPress websites. Learn more about the Cloud WAF identity problem here. Additionally, cloud based firewalls can be bypassed, leaving your site exposed to attackers. Because Wordfence is an integral part of the endpoint (your WordPress website), it can’t be bypassed. Learn more about the Cloud WAF bypass problem here. To fully protect the investment you’ve made in your website you need to employ a defense in depth approach to security. Wordfence takes this approach.
-
What blocking features does Wordfence include?
-
- Real-time blokkering van bekende aanvallers. Als een andere site die Wordfence gebruikt wordt aangevallen en de aanvaller wordt geblokkeerd, wordt je site automatisch beschermd.
- Blokkeer volledige kwaadaardige netwerken. Inclusief geavanceerde IP en domein WHOIS om kwaadaardige IP’s of netwerken te rapporteren en volledige netwerken te blokkeren met de firewall. Rapporteer WordPress beveiligingsdreigingen aan de netwerkeigenaar.
- Beperk of blokkeer WordPress beveiligingsdreigingen zoals agressieve crawlers, scrapers en bots die beveiligingsscans uitvoeren op zoek naar kwetsbaarheden in je site.
- Kies of je gebruikers en robots die je WordPress beveiligingsregels overtreden wil blokkeren of beperken.
- Premiumgebruikers kunnen ook landen blokkeren en scans abonnementen voor specifieke tijden en met een hogere frequentie.
-
What differentiates Wordfence from other WordPress Security plugins?
-
- Wordfence Security provides a WordPress Firewall developed specifically for WordPress and blocks attackers looking for vulnerabilities on your site. The Firewall is powered by our Threat Defense Feed which is continually updated as new threats emerge. Premium customers receive updates in real-time.
- Wordfence verifies your website source code integrity against the official WordPress repository and shows you the changes.
- Wordfence scans controleren al je bestanden, reacties en berichten op URL’s in de Safe Browsing lijst van Google. Wij zijn de enige plugin die deze zeer belangrijke beveiligingsverbetering biedt.
- Wordfence-scans verbruiken niet veel van je bandbreedte omdat alle beveiligingsscans plaatsvinden op je webserver, wat ze erg snel maakt.
- Wordfence ondersteunt volledig WordPress Multi-Site, wat betekent dat je met één klik elke blog in je Multi-Site installatie kunt scannen op beveiliging.
- Wordfence bevat twee-factor authenticatie, de meest veilige manier om brute force aanvallers te stoppen.
- Wordfence ondersteunt volledig IPv6, inclusief de mogelijkheid om de locatie van IPv6 adressen op te zoeken, IPv6 bereiken te blokkeren, het land van IPv6 te detecteren en een whois opzoeking te doen op IPv6 adressen en meer.
-
Zal WordFence mijn site vertragen?
-
No. Wordfence Security is extremely fast and uses techniques like caching its own configuration data to avoid database lookups and blocking malicious attacks that would slow down your site.
-
Wat als mijn site al gehackt is?
-
Wordfence Security kan core bestanden, thema’s en plugins repareren op sites waar de beveiliging al in gevaar is. Je kunt deze handleiding volgen ophow to clean a hacked website using Wordfence. Als je je eigen site opschoont na een hack, houd er dan rekening mee dat de veiligheid van de site niet kan worden gegarandeerd, tenzij je een volledige herinstallatie uitvoert als je site is gehackt. We raden je aan alleen Wordfence Security te gebruiken om je site actief te krijgen, zodat je de gegevens kunt herstellen die je nodig hebt voor een volledige herinstallatie. Als je hulp nodig hebt bij een beveiligingsprobleem, ga dan naar Wordfence Care, die praktische ondersteuning biedt van ons team, inclusief het omgaan met een gehackte site. Voor sites die essentieel zijn voor een bedrijf om te blijven opereren, kijk op Wordfence Response.
-
Ondersteunt Wordfence Security IPv6?
-
Ja. We ondersteunen volledig IPv6 met alle beveiligingsfuncties, inclusief land blokkering, reeks blokkering, stadsopzoeking, whois opzoeking en alle andere beveiligingsfuncties. Als je geen IPv6 gebruikt, zal Wordfence ook uitstekend werken op je site. We zijn volledig compatibel met zowel IPv4 als IPv6, of je nu beide of slechts één adresseringsschema gebruikt.
-
Ondersteunt Wordfence Security Multi-Site installaties?
-
Yes. WordPress Multi-Site is fully supported. Using Wordfence you can scan every blog in your network for malware with one click. If one of your customers posts a page or post with a known malware URL that threatens your whole domain with being blocklisted by Google, we will alert you in the next scan.
-
Welke ondersteuningsopties zijn beschikbaar voor Wordfence gebruikers?
-
Uitstekende klantenservice aanbieden is belangrijk voor ons. Onze niet betalende gebruikers krijgen ondersteuning van onze vrijwilligers in support forums. Wordfence Premium klanten krijgen betaalde, op tickets gebaseerde ondersteuning Wordfence Care klanten krijgen praktische ondersteuning, waaronder hulp bij beveiligingsincidenten en een jaarlijkse beveiliging audit.
Wordfence Response klanten krijgen 24/7/365 ondersteuning van ons incident responsteam, met een responstijd van 1 uur en maximaal 24 uur om een beveiligingsprobleem op te lossen. -
Waar kan ik meer informatie vinden over WordPress beveiliging?
-
Designed for every skill level, The WordPress Security Learning Center is dedicated to deepening users’ understanding of security best practices by providing free access to entry-level articles, in-depth articles, videos, industry survey results, graphics and more.
-
Waar kan ik de dienstvoorwaarden en het privacybeleid van Wordfence vinden?
-
Deze zijn beschikbaar op onze site: gebruiksvoorwaarden en privacybeleid
Beoordelingen
Bijdragers & ontwikkelaars
“Wordfence Security – Firewall, Malware Scan, and Login Security” is open source software. De volgende personen hebben bijgedragen aan deze plugin.
Bijdragers“Wordfence Security – Firewall, Malware Scan, and Login Security” is vertaald in 21 talen. Dank voor de vertalers voor hun bijdragen.
Vertaal “Wordfence Security – Firewall, Malware Scan, and Login Security” naar jouw taal.
Interesse in ontwikkeling?
Bekijk de code, haal de SVN repository op, of abonneer je op het ontwikkellog via RSS.
Changelog
8.0.3 – January 15, 2025
- Improvement: Added support for hosts relocating the WAF’s auto-prepend file via the constant/envvar WORDFENCE_WAF_PREPEND_DIRECTORY
- Improvement: Added detection for non-repo plugins and themes to avoid the scanner reporting changes when the same slug + version exists within the wordpress.org repo
- Improvement: Messaging for Central disconnections now better reflects the user making the change
- Improvement: Scan errors due to unreachable Wordfence servers will now provide a link to our status page to check for outages
- Improvement: Reduced the number of network calls created to sync scan issues when updates are performed in bulk
- Change: Reworked setting caching to avoid issues with some object caches
- Change: Reworked cURL check to avoid using WP_Http_Curl, which has been deprecated
- Fix: Normalized all wordfence.com links to be https
- Fix: Fixed a rare error that could occur on the diagnostics page when displaying a list of error logs
- Fix: Removed the “back to top” button and related script block from emailed diagnostics
- Fix: Fixed some UI coloring that did not correctly reflect the license type in use
8.0.2 – January 2, 2025
- Improvement: General compatibility improvements and better error handling for PHP 8+
- Improvement: Added audit log status to the plugin dashboard
- Change: Increased width of diagnostics text export for better legibility
- Fix: Addressed an error with mail hooks and the audit log when third party plugins send unexpected value types
8.0.1 – November 14, 2024
- Improvement: Updated GeoIP database
- Change: Revised some help text related to the audit log to be more clear
- Fix: Improved audit log compatibility with some plugins that would cause excessive noise due to their behaviors around setting up user roles and capabilities
- Fix: Fixed a log notice that could occur when deactivating Wordfence with audit log events still pending and a broken Wordfence Central link
8.0.0 – November 4, 2024
- Improvement: Introduced the Wordfence Audit Log, a new premium feature to monitor all changes and actions in security-sensitive areas of the site with remote tamper-proof data storage via Wordfence Central
- Change: Increased the minimum supported WordPress version to 4.7
- Change: Increased the minimum supported PHP version to 7.0
7.11.7 – July 29, 2024
- Improvement: Optimized scan performance by reducing database queries by approximately 38% along with CPU usage
- Fix: Added translation support for “Page not found” string when viewing recent traffic
7.11.6 – June 6, 2024
- Improvement: Revised the strong password requirements notice to be more readable
- Improvement: Removed unnecessary calls for the plugin and theme vulnerability checks
- Improvement: Reduced the frequency of calls to Wordfence Central during some operations where the values do not need to be synced
- Improvement: Refactored some queries to avoid the automatic SHOW FULL COLUMNS queries that WordPress performs to verify database encodings
- Improvement: Infrequently-used config values are no longer automatically loaded into memory and instead loaded only on demand
- Fix: Fixed an issue where multisite installations using the WAF mysqli storage engine could repeatedly attempt to update WAF rules when not in optimized mode
- Improvement: Updated the bundled GeoIP database
- Change: Revised the formatting of TOTP app URLs to prioritize the site’s own URL for better sorting and display
- Fix: Fixed the last captcha column in the users page so it no longer displays “(not required)” on 2FA users since that no longer applies
- Fix: Added a check in wflogs/rules.php to only run when within the WAF’s bootstrap stage when hosted behind nginx
7.11.5 – April 3, 2024
- Fix: Revised the behavior of the reCAPTCHA verification to use the documented expiration period of the token and response to avoid sending verification requests too frequently, which could artificially lower scores in some circumstances
- Fix: Addressed PHP 8 deprecation notices in the file differ used by file changed scan results
- Fix: Reduced the frequency of Wordfence Central status update callbacks in sections of the scan that occur quickly in sequence
7.11.4 – March 11, 2024
- Change: CAPTCHA verification when enabled now additionally applies to 2FA logins (may send an email verification on low scores) and no longer reveals whether a user exists for the submitted account credentials (credit: Raxis)
- Fix: Addressed a potential PHP 8 notice in the human/bot detection AJAX call
- Fix: Addressed a potential PHP 8 notice when requesting a lockout unlock verification email
- Fix: Fixed the emailed diagnostics view not showing the missing table information when applicable
- Fix: Improved quick scan logic to base timing on regular scans so they’re more evenly distributed
7.11.3 – February 15, 2024
- Fix: Fixed an issue with sites containing invalid Wordfence Central site data where they could throw an error when viewing Wordfence pages
7.11.2 – February 14, 2024
- Improvement: Enhanced the vulnerability scan to check and alert for WordPress core vulnerabilities and to adjust the severity of the scan result based on findings or available updates
- Improvement: Updated the bundled GeoIP database
- Improvement: Increased compatibility of brute force protection with plugins that override the normal login flow and omit traditional hooks
- Change: Adjusted the behavior of automatic quick scans to schedule themselves further away from full scans
- Fix: Added detection for a site being linked to a non-matching Wordfence Central record (e.g., when cloning the database to a staging site)
- Fix: Streamlined the license and terms of use installation flow to avoid unnecessary prompting
- Fix: Fixed an issue where user profiles with a selected locale different from the site itself could end up loading the site’s locale instead
7.11.1 – January 2, 2024
- Improvement: Added “.env” to the files checked for “Scan for publicly accessible configuration, backup, or log files”
- Improvement: Provided better descriptive text for the option “Block IPs who send POST requests with blank User-Agent and Referer”
- Improvement: The diagnostics page now displays the contents of any
auto_prepend_file
.htaccess/.user.ini block for troubleshooting - Fix: Fixed an issue where a login lockout on a WooCommerce login form could fail silently
- Fix: The scan result for abandoned plugins no longer states it has been removed from wordpress.org if it is still listed
- Fix: Addressed an exception parsing date information in non-repo plugins that have a bad
last_updated
value - Fix: The URL scanner no longer generates a log warning when matching a potential URL fragment that ends up not being a valid URL
7.11.0 – November 28, 2023
- Improvement: Added new functionality for trusted proxy presets to support proxies such as Amazon CloudFront, Ezoic, and Quic.cloud
- Improvement: WAF rule and malware signature updates are now signed with SHA-256 as well for hosts that no longer build SHA1 support
- Improvement: Updated the bundled trusted CA certificates
- Change: The WAF will no longer attempt to fetch rule or blocklist updates when run via WP-CLI
- Fix: Removed uses of SQL_CALC_FOUND_ROWS, which is deprecated as of MySQL 8.0.17
- Fix: Fixed an issue where final scan summary counts in some instances were not sent to Central
- Fix: Fixed a deprecation notice for get_class in PHP 8.3.0
- Fix: Corrected an output error in the connectivity section of Diagnostics in text mode
7.10.7 – November 6, 2023
- Fix: Compatibility fix for WordPress 6.4 on the login page styling
7.10.6 – October 30, 2023
- Fix: Addressed an issue with multisite installations when the wp_options tables had different encodings/collations
7.10.5 – October 23, 2023
- Improvement: Updated the bundled GeoIP database
- Improvement: Added detection for Cloudflare reverse proxies blocking callbacks to the site
- Change: Files are no longer excluded from future scans if a previous scan stopped during their processing
- Fix: Added handling for the pending WordPress 6.4 change that removes $wpdb->use_mysqli
- Fix: The WAF MySQLi storage engine will now work correctly when either DB_COLLATE or DB_CHARSET are not defined
- Fix: Added additional error handling to Central calls to better handle request failures or conflicts
- Fix: Addressed a warning that would occur if a non-repo plugin update hook did not provide a last updated date
- Fix: Fixed an error in PHP 8 that could occur if the time correction offset was not numeric
- Fix: 2FA AJAX calls now use an absolute path rather than a full URL to avoid CORS issues on sites that do not canonicalize www and non-www requests
- Fix: Addressed a race condition where multiple concurrent hits on multisite could trigger overlapping role sync tasks
- Fix: Improved performance when viewing the user list on large multisites
- Fix: Fixed a UI bug where an invalid code on 2FA activation would leave the activate button disabled
- Fix: Reverted a change on error modals to bring back the additional close button for better accessibility
7.10.4 – September 25, 2023
- Improvement: “Admin created outside of WordPress” scan results may now be reviewed and approved
- Improvement: The WAF storage engine may now be specified by setting the environmental variable “WFWAF_STORAGE_ENGINE”
- Improvement: Detect when a plugin or theme with a custom update handler is broken and blocking update version checks
- Change: Deprecated support for WordPress versions lower than 4.7.0
- Change: Exclude parse errors of a damaged compiled rules file from reporting
- Fix: Suppress PHP notices related to rule loading when running WP-CLI
- Fix: Fixed an issue with the scan monitor cron that could leave it running unnecessarily
7.10.3 – July 31, 2023
- Improvement: Updated GeoIP database
- Fix: Added missing text domain to translation function call
- Fix: Corrected inconsistent styling of switch controls
- Change: Made MySQLi storage engine the default for Flywheel hosted sites
7.10.2 – July 17, 2023
- Fix: Prevented bundled sodium_compat library from conflicting with versions included with older WordPress versions
7.10.1 – July 12, 2023
- Improvement: Added support for processing arrays of files in the WAF
- Improvement: Refactored security event processing to send events in bulk
- Improvement: Updated bundled sodium_compat and random_compat libraries
- Fix: Prevented deprecation warning caused by dynamic property creation
- Fix: Added translation support for additional strings
- Change: Adjusted Wordfence registration UI
7.10.0 – June 21, 2023
- Improvement: Added translation support for strings from login security plugin
- Improvement: Added translator notes regarding word order and hidden text
- Improvement: Added translation support for additional strings
- Improvement: Prevented scans from failing if unreadable directories are encountered
- Improvement: Added help link to IPv4 scan option
- Improvement: Updated scan result text to clarify meaning of plugins removed from wordpress.org
- Improvement: Made “Increased Attack Rate” emails actionable
- Improvement: Updated GeoIP database
- Verbetering: JavaScript bibliotheken geüpdatet
- Fix: Corrected IPv6 address expansion
- Fix: Ensured long request payloads for malicious requests are recorded in live traffic
- Fix: Prevented “commands out of sync” database error messages when the database connection has failed
- Fix: Prevented rare JSON encoding issues from breaking free license registration
- Fix: Prevented PHP notice from being logged when request parameter is missing
- Fix: Prevented deprecation warning in PHP 8.1
- Change: Moved detection for old TimThumb files to malware signature
- Change: Moved translation file from .po to .pot
- Change: Renamed “Macedonia” to “North Macedonia, Republic of”
7.9.3 – May 31, 2023
- Improvement: Added exception handling to prevent WAF errors from being fatal
- Fix: Corrected error caused by method call on null in WAF
- Change: Deprecated support for PHP 5.5 and 5.6, ended support for PHP 5.3 and 5.4
- Change: Specified WAF version parameter when requesting firewall rules
7.9.2 – March 27, 2023
- Improvement: The vulnerability severity score (CVSS) is now shown with any vulnerability findings from the scanner
- Improvement: Changed several links during initial setup to open in a new window/tab so it doesn’t interrupt installation
- Change: Removed the non-https callback test to the Wordfence servers
- Fix: Fixed an error on PHP 8 that could occur when checking for plugin updates and another plugin has a broken hook
- Fix: Added a check for disabled functions when generating support diagnostics to avoid an error on PHP 8
- Fix: Prevent double-clicking when activating 2FA to avoid an “already set up” error
7.9.1 – March 1, 2023
- Improvement: Further improved performance when viewing 2FA settings and hid user counts by default on sites with many users
- Fix: Adjusted style inclusion and usage to prevent missing icons
- Fix: Avoided using the ctype extension as it may not be enabled
- Fix: Prevented fatal errors caused by malformed Central keys
7.9.0 – February 14, 2023
- Improvement: Added 2FA management shortcode and WooCommerce account integration
- Improvement: Improved performance when viewing 2FA settings on sites with many users
- Improvement: Updated GeoIP database
- Fix: Ensured Captcha and 2FA scripts load on WooCommerce when activated on a sub-site in multisite
- Fix: Prevented reCAPTCHA logo from being obscured by some themes
- Fix: Enabled wfls_registration_blocked_message filter support for WooCommerce integration
7.8.2 – December 13, 2022
- Fix: Releasing same changes as 7.8.1, due to wordpress.org error
7.8.1 – December 13, 2022
- Improvement: Added more granualar data deletion options to deactivation prompt
- Improvement: Allowed accessing diagnostics prior to completing registration
- Fix: Prevented installation prompt from displaying when a license key is already installed but the alert email address has been removed
7.8.0 – November 28, 2022
- Improvement: Added feedback when login form is submitted with 2FA
- Fix: Restored click support on login button when using 2FA with WooCommerce
- Fix: Corrected display issue with reCAPTCHA score history graph
- Fix: Prevented errors on PHP caused by corrupted login timestamps
- Fix: Prevented deprecation notices on PHP 8.2 related to dynamic properties
- Change: Updated Wordfence registration workflow
7.7.1 – October 4, 2022
- Fix: Prevented scan resume attempts from repeating indefinitely when the initial scan stage fails
7.7.0 – October 3, 2022
- Improvement: Added configurable scan resume functionality to prevent scan failures on sites with intermittent connectivity issues
- Improvement: Added new scan result for vulnerabilities found in plugins that do not have patched versions available via WordPress.org
- Improvement: Implemented stand-alone MMDB reader for IP address lookups to prevent plugin conflicts and support additional PHP versions
- Improvement: Added option to disable looking up IP address locations via the Wordfence API
- Improvement: Prevented successful logins from resetting brute force counters
- Improvement: Clarified IPv6 diagnostic
- Improvement: Included maximum number of days in live traffic option text
- Fix: Made timezones consistent on firewall page
- Fix: Added “Use only IPv4 to start scans” option to search
- Fix: Prevented deprecation notices on PHP 8.1 when emailing the activity log
- Fix: Prevented warning on PHP 8 related to process owner diagnostic
- Fix: Prevented PHP Code Sniffer false positive related to T_BAD_CHARACTER
- Fix: Removed unsupported beta feed option
7.6.2 – September 19, 2022
- Improvement: Hardened 2FA login flow to reduce exposure in cases where an attacker is able to obtain privileged information from the database
7.6.1 – September 6, 2022
- Fix: Prevented XSS that would have required admin privileges to exploit (CVE-2022-3144)
7.6.0 – July 28, 2022
- Improvement: Added option to start scans using only IPv4
- Improvement: Added diagnostic for internal IPv6 connectivity to site
- Improvement: Added AUTOMATIC_UPDATER_DISABLED diagnostic
- Improvement: Updated password strength check
- Improvement: Added support for scanning plugin/theme files in when using the WP_CONTENT_DIR/WP_PLUGIN_DIR constants
- Improvement: Updated GeoIP database
- Improvement: Made DISABLE_WP_CRON diagnostic more clear
- Improvement: Added “Hostname” to Live Traffic message displayed for hostname blocking
- Improvement: Improved compatibility with Flywheel hosting
- Improvement: Adopted semantic versioning
- Improvement: Added support for dynamic cookie redaction patterns when logging requests
- Fix: Prevented scanned paths from being displayed as skipped in rare cases
- Fix: Corrected indexed files count in scan messages
- Fix: Prevented overlapping AJAX requests when viewing Live Traffic on slower servers
- Fix: Corrected WP_DEBUG_DISPLAY diagnostic
- Fix: Prevented extraneous warnings caused by DNS resolution failures
- Fix: Corrected display issue with Save/Cancel buttons on All Options page
- Fix: Prevented errors caused by WHOIS searches for invalid values
7.5.11 – June 14, 2022
- Improvement: Added option to toggle display of last login column on WP Users page
- Improvement: Improved autocomplete support for 2FA code on Apple devices
- Improvement: Prevented Batcache from caching block pages
- Improvement: Updated GeoIP database
- Fix: Prevented extraneous scan results when non-existent paths are configured using UPLOADS and related constants
- Fix: Corrected issue that prevented reCAPTCHA scores from being recorded
- Fix: Prevented invalid JSON setting values from triggering fatal errors
- Fix: Made text domains consistent for translation support
- Fix: Clarified that allowlisted IP addresses also bypass reCAPTCHA
7.5.10 – May 17, 2022
- Improvement: Improved scan support for sites with non-standard directory structures
- Improvement: Increased accuracy of executable PHP upload detection
- Improvement: Addressed various deprecation notices with PHP 8.1
- Improvement: Improved handling of invalidated license keys
- Fix: Corrected lost password redirect URL when used with WooCommerce
- Fix: Prevented errors when live traffic data exceeds database column length
- Fix: Prevented bulk password resets from locking out admins
- Fix: Corrected issue that prevented saving country blocking settings in certain cases
- Wijziging: informatie over copyright geüpdatet
7.5.9 – March 22, 2022
- Improvement: Updated GeoIP database
- Improvement: Removed blocking data update logic in order to reduce timeouts
- Improvement: Increased timeout value for API calls in order to reduce timeouts
- Improvement: Clarified notification count on Wordfence menu
- Improvement: Improved scan compatibility with WooCommerce
- Improvement: Added messaging when application passwords are disabled
- Fix: Prevented warnings and errors when constants are defined based on the value of other constants in wp-config.php
- Fix: Corrected redundant escaping that prevented viewing or repairing files in scan results
7.5.8 – February 1, 2022
- Launch of Wordfence Care and Wordfence Response
7.5.7 – November 22, 2021
- Improvement: Made preliminary changes for compatibility with PHP 8.1
- Change: Added GPLv3 license and updated EULA
7.5.6 – October 18, 2021
- Fix: Prevented login errors with WooCommerce integration when manual username entry is enabled on the WooCommerce registration form
- Fix: Corrected theme incompatibilities with WooCommerce integration
7.5.5 – August 16, 2021
- Improvement: Enhanced accessibility
- Improvement: Replaced regex in scan log with signature ID
- Improvement: Updated Knockout JS dependency to version 3.5.1
- Improvement: Removed PHP 8 compatibility notice
- Improvement: Added NTP status for Login Security to Diagnostics
- Improvement: Updated plugin headers for compatibility with WordPress 5.8
- Improvement: Updated Nginx documentation links to HTTPS
- Improvement: Updated IP address geolocation database
- Improvement: Expanded WAF SQL syntax support
- Improvement: Added optional constants to configure WAF database connection
- Improvement: Added support for matching punycode domain names
- Improvement: Updated Wordfence install count
- Improvement: Deprecated support for WordPress versions older than 4.4.0
- Improvement: Added warning messages when blocking U.S.
- Improvement: Added MYSQLI_CLIENT_SSL support to WAF database connection
- Improvement: Added 2FA and reCAPTCHA support for WooCommerce login and registration forms
- Improvement: Added option to require 2FA for any role
- Improvement: Added logic to automatically disable NTP after repeated failures and option to manually disable NTP
- Improvement: Updated reCAPTCHA setup note
- Fix: Prevented issue where country blocking changes are not saved
- Fix: Corrected string placeholder
- Fix: Added missing text domain to translation calls
- Fix: Corrected warning about sprintf arguments on Central setup page
- Fix: Prevented lost password functionality from revealing valid logins
7.5.4 – June 7, 2021
- Fix: Resolve conflict with woocommerce-gateway-amazon-payments-advanced plugin
7.5.3 – May 10, 2021
- Improvement: Expanded WAF capabilities including better JSON and user permission handling
- Improvement: Switched to relative paths in WAF auto_prepend file to increase portability
- Improvement: Eliminated unnecessary calls to Wordfence servers
- Fix: Prevented errors on PHP 8.0 when disk_free_space and/or disk_total_space are included in disabled_functions
- Fix: Fixed PHP notices caused by unexpected plugin version data
- Fix: Gracefully handle unexpected responses from Wordfence servers
- Fix: Time field now displays correctly on “See Recent Traffic” overlay
- Fix: Corrected typo on Diagnostics page
- Fix: Corrected IP counts on activity report
- Fix: Added missing line break in scan result emails
- Fix: Sending test activity report now provides success/failure response
- Fix: Reduced SQLi false positives caused by comma-separated strings
- Fix: Fixed JS error when resolving last scan result
7.5.2 – March 24, 2021
- Fix: Fixed fatal error on single-sites running WordPress <4.9.
7.5.1 – 24 maart 2021
- Fix: Fixed fatal error when viewing the Login Security settings page from an allowlisted IP.
7.5.0 – March 24, 2021
- Verbetering: vertaal-klaar: alle gebruiker-gerichte strings worden nu door WordPress’s i18n functies geleid.
- Verbetering: verwijderen van oude beheer functies die niet langer gebruikt worden in de UI.
- Verbetering: lokale GeoIP database update.
- Improvement: Remove Lynwood IP range from allowlist, and add new AWS IP range.
- Fix: Fixed bug with unlocking a locked out IP without correctly resetting its failure counters.
- Fix: Sites using deleted premium licenses correctly revert to free license behavior.
- Fix: When enabled, cookies are now set for the correct roles on previously used devices.
- Fix: WAF cron jobs are now skipped when running on the CLI.
- Fix: PHP 8.0 compatibility – prevent syntax error when linting files.
- Fix: Fixed issue where PHP 8 notice sometimes cannot be dismissed.
7.4.14 – December 3, 2020
- Improvement: Added option to disable application passwords.
- Improvement: Updated site cleaning callout with 1-year guarantee.
- Improvement: Upgraded sodium_compat library to 1.13.0.
- Improvement: Replaced the terms whitelist and blacklist with allowlist and blocklist.
- Verbetering: een aantal WordPress 5.6 en jQuery 3.x compatibiliteitsverbeteringen doorgevoerd.
- Verbetering: een aantal PHP8 compatibiliteitsverbeteringen gemaakt.
- Improvement: Added dismissable notice informing users of possible PHP8 compatibility issues.
7.4.12 – October 21, 2020
- Improvement: Initial integration of i18n in Wordfence.
- Improvement: Prevent Wordfence from loading under <PHP 5.3.
- Improvement: Updated GeoIP database.
- Improvement: Prevented wildcard from running/saving for scan’s excluded files pattern.
- Improvement: Included Wordfence Login Security tables in diagnostics missing table list.
- Fix: Removed new scan issues when WordPress update occurs mid-scan.
- Fix: Specified category when saving
whitelistedServiceIPs
to WAF storage engine. - Fix: Removed localhost IP for auto-update email alerts.
- Fix: Fixed broken message in Live Traffic with MySQLi storage engine for blocklisted hits.
- Fix: Removed optional parameter values for PHP 8 compatibility.
You can find a complete changelog on our documentation site.