Wordfence

Item: Wordfence
Rating: 64
Author: Fast WordPress

by Defiant

Endpoint firewall and malware scanning, with a real performance cost.

64 · Slow4.6FreemiumHeavy impact

Visit official site See alternatives

This link may earn us a commission. It does not affect the score. Last tested 30 August 2026.

Measured result

Wordfence on bench-01

Performance score

Measured on a 2 vCPU reference host

LCP: 2.68 s
CLS: 0.02
TTFB: 412 ms
Page: 690 KB
Requests: 36
Impact: Heavy

Median of 3 cold-cache runs, 30 August 2026.

How we tested

A clean WordPress 6.8 install on a 2 vCPU / 4 GB London host, PHP 8.3, 20 posts and one page builder template. We record a baseline, activate Wordfence with its default settings, and re-run three cold-cache tests. The published figure is the median.

Where Wordfence ranks elsewhere

Publisher	List	Position
WPBeginner	Best WordPress Security Plugins	#2 of 8
Kinsta	Best WordPress Security Plugins	#2 of 22
Themeisle	Best WordPress Plugins	#10 of 22

Positions are read from the published articles themselves, so they reflect that publisher's order rather than ours. Lists get re-ordered over time, so follow the link if you want the current version.

What changed in the latest version

v9.0.1Latest releaseSeptember 8, 2026

Improvement: UX enhancements for passkey authentication and general login security
Improvement: GeoIP database updated
Fix: Improved error handling in WAF request handlers and XML-RPC parser
Fix: Fixed an issue with translations not showing on the Login Security Settings tab
Fix: Addressed several potential PHP 8.5+ deprecation notices
Fix: Reworked MD5 hash use in MySQL to avoid deprecation in 9.7+

v9.0.0August 10, 2026

Improvement: Added support for passkey authentication Available for both free and premium installations
Can be enabled for any user role (multisite support is currently limited)
WooCommerce integration
Support for custom authentication integrations
Improvement: GeoIP database updated
Improvement: Several mobile styling and layout improvements on the login security page
Improvement: Added diagnostics info for authentication hooks to assist with login-related troubleshooting
Change: Hardened 2FA flow when installed next to plugins with non-standard authentication (credit: Austin Ginder of Anchor Hosting)

v8.2.2May 13, 2026

Improvement: Better presentation of Live Traffic data on wide screens
Improvement: Increased legibility of token fields
Improvement: Reworked the pagination of the Blocking page for a better UX
Improvement: Country blocking token field can now expand to show all entries
Improvement: Performance improvements for the activity log and better pause behavior on window blur/focus
Improvement: GeoIP database updated
Change: Removed deprecated Central endpoint
Fix: Addressed issue where the last activity log entry could repeatedly appear

Release notes are the developer's own words, published on WordPress.org. Read the full changelog

Pros & cons

Firewall rules update quickly after disclosed vulnerabilities
Detailed live traffic view
Malware scanner catches modified core files

Firewall runs in PHP on every request
Scans are demanding on shared hosting
Live traffic logging writes heavily to the database

The full review

We include Wordfence because it is widely deployed and because its cost is measurable: 412 ms TTFB against 182 ms for the same site with the plugin deactivated.

That is a defensible trade for many sites. It is not defensible when live traffic logging is left on - turning it off recovered roughly 90 ms on our reference install.

If speed is the priority and you are on a host with an edge firewall, evaluate whether you need a second one inside PHP.