Wordfence Security Premium changelog

9.0.2 Latest 30 Sep 2026 4 improved10 fixed

Improved

Changed IPv6 diagnostics result to be informational only
Added help link to increased attack rate emails
Increased compatibility with WordPress Playground
Harden REST API user enumeration protection

Fixed

Upgraded virtualizer dependency to fix Firefox tab crash on screens with a lot of DOM elements (e.g., a running scan)
Better detection and handling of "module" script tagging to avoid conflict with renamed plugin directories
Add missed return value from upgrader_pre_install audit log filter
PHP 8.1 deprecation notice fixes
Fixed translation support on login page
Improve handling of WAF JSON processing to better handle array values
Address early translation calls to avoid _load_textdomain_just_in_time notices
Changed a few translated strings to avoid containing HTML due to a broken CZ translation
Removed obsolete CSS
Fixed typo in "No alerts will be sent for the remain[d]er..."

9.0.1 8 Sep 2026 2 improved4 fixed

Improved

UX enhancements for passkey authentication and general login security
GeoIP database updated

Fixed

Improved error handling in WAF request handlers and XML-RPC parser
Fixed an issue with translations not showing on the Login Security Settings tab
Addressed several potential PHP 8.5+ deprecation notices
Reworked MD5 hash use in MySQL to avoid deprecation in 9.7+

9.0.0 10 Aug 2026 10 improved3 changed

Improved

Added support for passkey authentication
Support for custom authentication integrations
GeoIP database updated
Several mobile styling and layout improvements on the login security page
Added diagnostics info for authentication hooks to assist with login-related troubleshooting
Hardened 2FA flow when installed next to plugins with non-standard authentication (credit: Austin Ginder of Anchor Hosting)
Hardened 2FA remember cookie handling
The scanner will now display an issue when the standalone Wordfence Login Security plugin is installed because all functionality is already provided by Wordfence itself
Updated internal libraries used by the Vue UI
Login error masking setting now also applies to the Login Security functionality

Changed

Available for both free and premium installations
Can be enabled for any user role (multisite support is currently limited)
WooCommerce integration

8.2.2 13 May 2026 7 improved4 fixed

Improved

Better presentation of Live Traffic data on wide screens
Increased legibility of token fields
Reworked the pagination of the Blocking page for a better UX
Country blocking token field can now expand to show all entries
Performance improvements for the activity log and better pause behavior on window blur/focus
GeoIP database updated
Removed deprecated Central endpoint

Fixed

Addressed issue where the last activity log entry could repeatedly appear
Using the embedded shortcode for the 2FA form now correctly enqueues core JavaScript dependencies
Modals with content that overflows on smaller viewports can now be scrolled
The changelog link in plugin upgrade scan issues now links correctly

8.2.1 6 May 2026 5 fixed

Fixed

Fixed issue with some i18n plugins/themes when a user has no 2FA recovery codes
Toggled options with additional help links now correctly open the link rather than toggling the option
Country Blocking editing fixed when there are multiple pages of block rules
Added better error handling to the initial Vue data load
Handled error when logging in using legacy 2FA with separate prompts enabled

8.2.0 29 Apr 2026 4 improved1 fixed1 security

Improved

Migrated all deprecated JavaScript libraries in use to a Vue-based infrastructure
GeoIP database update
Better coverage of aria- accessibility attributes
Added translators comments to translatable strings where previously missing

Fixed

WordPress 7.0 compatibility fixes

Security

Note: Legacy two factor authentication using SMS-based codes will be discontinued around July 1, 2026. Sites using this functionality should migrate users to the TOTP-based two factor authentication on the Login Security page of the plugin

8.1.4 20 Dec 2025 1 fixed

Fixed

Fixed an issue with inet_pton introduced by a recent patch to PHP 8.1+ that could cause a fatal error if a malformed IP address was passed to the call

8.1.3 3 Dec 2025 1 improved1 changed

Improved

Updated the bundled geoip database

Changed

Note: Verified compatibility with WordPress 6.9

8.1.2 12 Nov 2025 1 improved

Improved

Updated the bundled geoip database

8.1.1 5 Nov 2025 5 improved4 fixed

Improved

Improved localization support for the various block screens and messages
Updated the bundled geoip database
Prioritized Wordfence tables in the diagnostics tool when large numbers of tables exist
Allow non-US Google crawler IP addresses to pass country blocking
Enforcement of password strength requirements is now applied on the corresponding REST API endpoints

Fixed

Fixed detection for first-time logins and overall sending for login alerts when the corresponding settings are enabled
When the WAF is using the mysql storage engine, fixed an issue with exclusion rules for the WAF not running correctly
Reduced per-hit database query load around checking license status for free installations
Optimized data sync with the WAF to better detect when the known server IP address list has changed

8.1.0 25 Aug 2025 8 improved6 fixed

Improved

Added password scanning support for WordPress 6.8 and later
Limited email alerts to 5 per hour by default and added notification when limit has been reached
Improved URL scanning performance
Updated GeoIP database
Reduced scan result severity for vulnerabilities with high attack complexity or required privileges
Added messaging around WAF support when NGINX Unit is detected
Added notice and scan result about Wordfence Assistant
Adjusted IPv6 connection issue message and appearance

Fixed

Prevented deprecation notice about calling base64_encode with null parameter
Prevented deprecation message about calling preg_match with null parameter
Corrected license type shown on dashboard when expiring
Prevented disabled getmyuid function from causing fatal error
Prevented disabled get_current_user function from causing fatal error
Prevented notice about _load_textdomain_just_in_time being called incorrectly

8.0.5 8 Apr 2025 1 fixed

Fixed

Compatibility fixes for WordPress 6.8

8.0.4 19 Mar 2025 3 improved

Improved

Improved error handling and messaging for some responses from our servers
Added messaging when a site may be using the same free license shared among multiple sites because it can cause the sites to use the same scan schedule rather than spreading out the load
Updated the readme content and formatting

8.0.3 15 Jan 2025 7 improved4 fixed

Improved

Added support for hosts relocating the WAF's auto-prepend file via the constant/envvar WORDFENCE_WAF_PREPEND_DIRECTORY
Added detection for non-repo plugins and themes to avoid the scanner reporting changes when the same slug + version exists within the wordpress.org repo
Messaging for Central disconnections now better reflects the user making the change
Scan errors due to unreachable Wordfence servers will now provide a link to our status page to check for outages
Reduced the number of network calls created to sync scan issues when updates are performed in bulk
Reworked setting caching to avoid issues with some object caches
Reworked cURL check to avoid using WP_Http_Curl, which has been deprecated

Fixed

Normalized all wordfence.com links to be https
Fixed a rare error that could occur on the diagnostics page when displaying a list of error logs
Removed the "back to top" button and related script block from emailed diagnostics
Fixed some UI coloring that did not correctly reflect the license type in use

8.0.2 2 Jan 2025 3 improved1 fixed

Improved

General compatibility improvements and better error handling for PHP 8+
Added audit log status to the plugin dashboard
Increased width of diagnostics text export for better legibility

Fixed

Addressed an error with mail hooks and the audit log when third party plugins send unexpected value types

8.0.1 14 Nov 2024 2 improved2 fixed

Improved

Updated GeoIP database
Revised some help text related to the audit log to be more clear

Fixed

Improved audit log compatibility with some plugins that would cause excessive noise due to their behaviors around setting up user roles and capabilities
Fixed a log notice that could occur when deactivating Wordfence with audit log events still pending and a broken Wordfence Central link

8.0.0 4 Nov 2024 3 improved

Improved

Introduced the Wordfence Audit Log, a new premium feature to monitor all changes and actions in security-sensitive areas of the site with remote tamper-proof data storage via Wordfence Central
Increased the minimum supported WordPress version to 4.7
Increased the minimum supported PHP version to 7.0

7.11.7 29 Jul 2024 1 improved1 fixed

Improved

Optimized scan performance by reducing database queries by approximately 38% along with CPU usage

Fixed

Added translation support for "Page not found" string when viewing recent traffic

7.11.6 6 Jun 2024 7 improved3 fixed

Improved

Revised the strong password requirements notice to be more readable
Removed unnecessary calls for the plugin and theme vulnerability checks
Reduced the frequency of calls to Wordfence Central during some operations where the values do not need to be synced
Refactored some queries to avoid the automatic SHOW FULL COLUMNS queries that WordPress performs to verify database encodings
Infrequently-used config values are no longer automatically loaded into memory and instead loaded only on demand
Updated the bundled GeoIP database
Revised the formatting of TOTP app URLs to prioritize the site's own URL for better sorting and display

Fixed

Fixed an issue where multisite installations using the WAF mysqli storage engine could repeatedly attempt to update WAF rules when not in optimized mode
Fixed the last captcha column in the users page so it no longer displays "(not required)" on 2FA users since that no longer applies
Added a check in wflogs/rules.php to only run when within the WAF's bootstrap stage when hosted behind nginx

7.11.5 3 Apr 2024 3 fixed

Fixed

Revised the behavior of the reCAPTCHA verification to use the documented expiration period of the token and response to avoid sending verification requests too frequently, which could artificially lower scores in some circumstances
Addressed PHP 8 deprecation notices in the file differ used by file changed scan results
Reduced the frequency of Wordfence Central status update callbacks in sections of the scan that occur quickly in sequence

7.11.4 11 Mar 2024 1 improved4 fixed

Improved

CAPTCHA verification when enabled now additionally applies to 2FA logins (may send an email verification on low scores) and no longer reveals whether a user exists for the submitted account credentials (credit: Raxis)

Fixed

Addressed a potential PHP 8 notice in the human/bot detection AJAX call
Addressed a potential PHP 8 notice when requesting a lockout unlock verification email
Fixed the emailed diagnostics view not showing the missing table information when applicable
Improved quick scan logic to base timing on regular scans so they're more evenly distributed

7.11.3 15 Feb 2024 1 fixed

Fixed

Fixed an issue with sites containing invalid Wordfence Central site data where they could throw an error when viewing Wordfence pages

7.11.2 14 Feb 2024 4 improved3 fixed

Improved

Enhanced the vulnerability scan to check and alert for WordPress core vulnerabilities and to adjust the severity of the scan result based on findings or available updates
Updated the bundled GeoIP database
Increased compatibility of brute force protection with plugins that override the normal login flow and omit traditional hooks
Adjusted the behavior of automatic quick scans to schedule themselves further away from full scans

Fixed

Added detection for a site being linked to a non-matching Wordfence Central record (e.g., when cloning the database to a staging site)
Streamlined the license and terms of use installation flow to avoid unnecessary prompting
Fixed an issue where user profiles with a selected locale different from the site itself could end up loading the site's locale instead

7.11.1 2 Jan 2024 3 improved4 fixed

Improved

Added ".env" to the files checked for "Scan for publicly accessible configuration, backup, or log files"
Provided better descriptive text for the option "Block IPs who send POST requests with blank User-Agent and Referer"
The diagnostics page now displays the contents of any auto_prepend_file .htaccess/.user.ini block for troubleshooting

Fixed

Fixed an issue where a login lockout on a WooCommerce login form could fail silently
The scan result for abandoned plugins no longer states it has been removed from wordpress.org if it is still listed
Addressed an exception parsing date information in non-repo plugins that have a bad last_updated value
The URL scanner no longer generates a log warning when matching a potential URL fragment that ends up not being a valid URL

7.11.0 28 Nov 2023 4 improved4 fixed

Improved

Added new functionality for trusted proxy presets to support proxies such as Amazon CloudFront, Ezoic, and Quic.cloud
WAF rule and malware signature updates are now signed with SHA-256 as well for hosts that no longer build SHA1 support
Updated the bundled trusted CA certificates
The WAF will no longer attempt to fetch rule or blocklist updates when run via WP-CLI

Fixed

Removed uses of SQL_CALC_FOUND_ROWS, which is deprecated as of MySQL 8.0.17
Fixed an issue where final scan summary counts in some instances were not sent to Central
Fixed a deprecation notice for get_class in PHP 8.3.0
Corrected an output error in the connectivity section of Diagnostics in text mode

7.10.7 6 Nov 2023 1 fixed

Fixed

Compatibility fix for WordPress 6.4 on the login page styling

7.10.6 30 Oct 2023 1 fixed

Fixed

Addressed an issue with multisite installations when the wp_options tables had different encodings/collations

7.10.5 23 Oct 2023 3 improved10 fixed

Improved

Updated the bundled GeoIP database
Added detection for Cloudflare reverse proxies blocking callbacks to the site
Files are no longer excluded from future scans if a previous scan stopped during their processing

Fixed

Added handling for the pending WordPress 6.4 change that removes $wpdb->use_mysqli
The WAF MySQLi storage engine will now work correctly when either DB_COLLATE or DB_CHARSET are not defined
Added additional error handling to Central calls to better handle request failures or conflicts
Addressed a warning that would occur if a non-repo plugin update hook did not provide a last updated date
Fixed an error in PHP 8 that could occur if the time correction offset was not numeric
2FA AJAX calls now use an absolute path rather than a full URL to avoid CORS issues on sites that do not canonicalize www and non-www requests
Addressed a race condition where multiple concurrent hits on multisite could trigger overlapping role sync tasks
Improved performance when viewing the user list on large multisites
Fixed a UI bug where an invalid code on 2FA activation would leave the activate button disabled
Reverted a change on error modals to bring back the additional close button for better accessibility

7.10.4 25 Sep 2023 5 improved2 fixed

Improved

"Admin created outside of WordPress" scan results may now be reviewed and approved
The WAF storage engine may now be specified by setting the environmental variable "WFWAF_STORAGE_ENGINE"
Detect when a plugin or theme with a custom update handler is broken and blocking update version checks
Deprecated support for WordPress versions lower than 4.7.0
Exclude parse errors of a damaged compiled rules file from reporting

Fixed

Suppress PHP notices related to rule loading when running WP-CLI
Fixed an issue with the scan monitor cron that could leave it running unnecessarily

7.10.3 31 Jul 2023 2 improved2 fixed

Improved

Updated GeoIP database
Made MySQLi storage engine the default for Flywheel hosted sites

Fixed

Added missing text domain to translation function call
Corrected inconsistent styling of switch controls

7.10.2 17 Jul 2023 1 fixed

Fixed

Prevented bundled sodium_compat library from conflicting with versions included with older WordPress versions

7.10.1 12 Jul 2023 4 improved2 fixed

Improved

Added support for processing arrays of files in the WAF
Refactored security event processing to send events in bulk
Updated bundled sodium_compat and random_compat libraries
Adjusted Wordfence registration UI

Fixed

Prevented deprecation warning caused by dynamic property creation
Added translation support for additional strings

7.10.0 21 Jun 2023 12 improved6 fixed

Improved

Added translation support for strings from login security plugin
Added translator notes regarding word order and hidden text
Added translation support for additional strings
Prevented scans from failing if unreadable directories are encountered
Added help link to IPv4 scan option
Updated scan result text to clarify meaning of plugins removed from wordpress.org
Made "Increased Attack Rate" emails actionable
Updated GeoIP database
Updated JavaScript libraries
Moved detection for old TimThumb files to malware signature
Moved translation file from .po to .pot
Renamed "Macedonia" to "North Macedonia, Republic of"

Fixed

Corrected IPv6 address expansion
Ensured long request payloads for malicious requests are recorded in live traffic
Prevented "commands out of sync" database error messages when the database connection has failed
Prevented rare JSON encoding issues from breaking free license registration
Prevented PHP notice from being logged when request parameter is missing
Prevented deprecation warning in PHP 8.1

7.9.3 31 May 2023 3 improved1 fixed

Improved

Added exception handling to prevent WAF errors from being fatal
Deprecated support for PHP 5.5 and 5.6, ended support for PHP 5.3 and 5.4
Specified WAF version parameter when requesting firewall rules

Fixed

Corrected error caused by method call on null in WAF

7.9.2 27 Mar 2023 3 improved3 fixed

Improved

The vulnerability severity score (CVSS) is now shown with any vulnerability findings from the scanner
Changed several links during initial setup to open in a new window/tab so it doesn't interrupt installation
Removed the non-https callback test to the Wordfence servers

Fixed

Fixed an error on PHP 8 that could occur when checking for plugin updates and another plugin has a broken hook
Added a check for disabled functions when generating support diagnostics to avoid an error on PHP 8
Prevent double-clicking when activating 2FA to avoid an "already set up" error

7.9.1 1 Mar 2023 1 improved3 fixed

Improved

Further improved performance when viewing 2FA settings and hid user counts by default on sites with many users

Fixed

Adjusted style inclusion and usage to prevent missing icons
Avoided using the ctype extension as it may not be enabled
Prevented fatal errors caused by malformed Central keys

7.9.0 14 Feb 2023 3 improved3 fixed

Improved

Added 2FA management shortcode and WooCommerce account integration
Improved performance when viewing 2FA settings on sites with many users
Updated GeoIP database

Fixed

Ensured Captcha and 2FA scripts load on WooCommerce when activated on a sub-site in multisite
Prevented reCAPTCHA logo from being obscured by some themes
Enabled wfls_registration_blocked_message filter support for WooCommerce integration

7.8.2 13 Dec 2022 1 fixed

Fixed

Releasing same changes as 7.8.1, due to wordpress.org error

7.8.1 13 Dec 2022 2 improved1 fixed

Improved

Added more granualar data deletion options to deactivation prompt
Allowed accessing diagnostics prior to completing registration

Fixed

Prevented installation prompt from displaying when a license key is already installed but the alert email address has been removed

Wordfence Security Premium changelog

2026 6 versions

2025 9 versions

2024 9 versions

2023 13 versions

2022 3 versions

Uptime status page