wordfence

80k+ WordPress Nuclei templates, updated daily from Wordfence intel—filter by severity/tags/CVE and scan in one line. 🚀🔒

A fast WordPress plugin enumeration tool

The useful exploit finder

EngineScript is a super fast WordPress server built on Ubuntu and optimized for Cloudflare and Digital Ocean

Extension for MainWP Dashboard. Checks the child websites plugins for vulnerability using the WordFence intelligence api.

wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0–6.9.4 / 7.0.0–7.0.1.

Useful plugins for Wordpress

WP-CLI commands and WordPress Abilities API integration for Wordfence Security - manage scans, issues, firewall, and license from CLI and REST API

Adding Iptables capabilites to Wordfence plugin for Wordpress

Checks active plugins against Wordfence Intelligence V3 vulnerability feed

Fetch WordPress vulnerability information from Wordfence vulnerability data feed.

List of the URLs to block on standard WordPress installation to immediately block attack attempts

This WordPress plugin customizes Wordfence CAPTCHA validation for custom login & registration pages to reduce spam registrations and fix the "Registration Attempt Blocked" issue on custom pages.

This powerful plugin offers advanced security features including automatic IP blocking, an advanced rule builder, traffic analysis, and seamless integration with services like Cloudflare, AbuseIPDB, Whatismybrowser.com, and now IPData.

Find the WordPress plugin code an attacker can reach, and check whether anything is guarding it

Wordfence attack log exporting tool.

Download the WordFence license activator for free to unlock premium features. It has been scanned by VirusTotal which ensures that you are downloading only clean, safe and trusted files.

Agent skill for systematic source-code security auditing of WordPress plugins — enumerate every entry point, audit each for common vulnerability classes, prioritize findings for coordinated disclosure. Defensive research on open-source plugins.

Email 2FA for WordPress login - a 6-digit one-time code by email, no app or SMS. Works with Wordfence, custom login pages, and multisite.