What it Protects Against

The Wordfence Web Application Firewall (WAF) protects against a number of common web-based attacks as well as a large amount of attacks specifically targeted at WordPress and WordPress themes and plugins. It is set up to run at the beginning of WordPress’ initialization to filter any attacks before plugins or themes can run any potentially vulnerable code. Some of the more general types of attacks we protect against are:

Firewall rules

The Wordfence firewall also has a number of rules that match known attacks commonly seen and exploited in the wild. The patterns for these attacks are specific and require minimal processing in determining if the request matches. The firewall also uses a number of generic rules that use pattern matching to determine if a request appears to be malicious. These are designed to prevent hackers from exploiting “0-day” vulnerabilities for known types of attacks.

Wordfence will automatically update the firewall rules from our servers in our network operations center without you having to update Wordfence. As new threats emerge, the firewall uses rules to protect you that are updated in real-time for premium members. Premium users receive an additional layer of protection. When we add new rules, our servers will then “ping” your site to prompt Wordfence to download the latest rules, so that you are automatically protected from attackers as new threats emerge. Users of the free version of Wordfence receive the community version of the rules 30 days later.

Firewall Status

Status Circles

The firewall status circles indicate to what degree you are currently protected. If the circles are gray, it means that the firewall is in “Learning Mode” or “Disabled”. Hovering your mouse pointer over a status circle will generate a tooltip informing you what needs to be done to reach a 100% rating. To reach a 100% rating on all firewall status circles then the following conditions must be met:

• Enable Rate Limiting and Advanced Blocking. This option is enabled by default. You can find it in the “Rate Limiting” section on the “Firewall Options” page.
• Enable all Firewall rules. All firewall rules are enabled by default. If you have previously disabled some firewall rules, visit the “Rules” section on the “Firewall Options” page to re-enable them.
• Optimize the Wordfence Firewall. This improves the security and performance of your firewall. Learn how
• Enable Brute Force Protection. This feature protects your WordPress login form from unauthorized login attempts. It is enabled by default.
• Enable Premium Firewall Rules. Upgrade to a premium license key to get instant protection against threats the moment they are discovered.
• Enable Real-Time IP Blocklist. With the Wordfence premium “Real-Time IP Blocklist”, IP addresses that are currently attacking other WordPress sites will be automatically blocked from your sending any requests to your site.
• Repair the Wordfence Firewall configuration. If this message appears, you may need to fix permissions on the firewall’s files. You can also try using the link to rebuild the firewall files that appears at the top of WordPress admin pages. Learn more

Users of the free version can reach a maximum rating of 64% (as displayed on the “Dashboard” page) and 55% (as displayed on the “Firewall” page).

Firewall Mode

The Firewall can be “Enabled”, “Disabled” or in “Learning mode”. If your status circles are grayed out, it means the firewall is disabled or in “Learning mode”. Learn more.

Firewall Optimization

As soon as you have installed Wordfence on your site, the firewall is activated. At this point, the firewall exists inside of your WordPress installation and will protect you against exploits. To make the firewall even more efficient and effective, we encourage you to optimize the firewall. You will be prompted to do this via the Wordfence plugin user interface. In most cases, optimizing the firewall involves clicking through a short configuration procedure.

The “Protection Level” shows whether the default “Basic WordPress Protection” is enabled, which can protect against many attacks, or if “Extended Protection” is enabled. To enable Extended Protection you have to go through the firewall optimization procedure described above. Extended Protection allows the firewall to run before WordPress even starts, protecting against additional attacks. Both protection levels are available in the free and premium versions. [More about Firewall Optimization]

Allowlisted URLs and False Positives

The firewall uses pattern-matching to identify malicious requests. Sometimes, non-malicious content in the request may accidentally match one of the rules and trigger the firewall to block the request. This is considered a false positive. Wordfence provides a way to exclude this particular URL and parameter from the firewall rules, so they can be allowlisted. You can create allowlisted rules automatically while the firewall is in “Learning Mode”. You can also create allowlisted rules manually via the firewall options, via a button on the “Live Traffic” page, or via the firewall block page if you are viewing the block page as an administrator.

Visits blocked by the firewall will display “403 Forbidden” and “A potentially unsafe operation has been detected in your request to this site”. If you get this message when you are logged in as an administrator, you can directly choose to allowlist any action where you are blocked. If you get the message when you are not logged in you should login to your site. You can then either:

• Locate the request that was blocked in “Live Traffic” and add it to the allowlist from there.
• Enable Learning Mode temporarily, repeat the action that was previously blocked, and then re-enable the firewall.

Background requests sent from your browser may show a message that says “Background Request Blocked” if they are blocked by the firewall. These messages are only displayed for the site’s administrator. They can be added to the allowlist by clicking the button in the message if you know that they are safe.

Disabling the Firewall

Open the “Firewall” > “Firewall Options” page, set the “Web Application Firewall Status” to “Disabled” and click the “Save Changes” button.

If you are having technical problems and you cannot set the “Web Application Firewall Status” to “Disabled”, you can instead set a constant. If you have the “Protection Level” set to “Basic WordPress Protection”, you can add this code to your WordPress “wp-config.php” file, just below the line about “WP_DEBUG”. If you have the “Protection Level” set to “Extended Protection”, the code should be added to the “wordfence-waf.php” file, before the line that begins with “if”:

define('WFWAF_ENABLED', false);

Files Used by the Firewall

The files in “wp-content/wflogs” directory contain firewall configuration data and information on blocked attacks. The firewall needs these files because it can run before WordPress has loaded. Files included in the “wflogs” directory are:

.htaccess
attack-data.php
config.php
config-livewaf.php
config-synced.php
config-transient.php
GeoLite2-Country.mmdb
ips.php
rules.php
template.php

Some hosts may have additional temporary files in this directory with similar names, and some may also have temporary files with long names containing the letters “nfs”.

Some of these files begin with a line that says:

<?php exit('Access denied'); __halt_compiler(); ?>.

This prevents anyone from viewing the file contents in a web browser even if the web server does not support “.htaccess” files, while allowing the rest of the contents to be read as data. Much of the data is encoded or in a binary format for various reasons, including performance.