Every recorded version, newest first, with what changed in each one.
Latest 9.0.215 versions
Undated · 15 versions
9.0.2
Latest
4 improvements10 fixes
Improved
Changed IPv6 diagnostics result to be informational only
Added help link to increased attack rate emails
Increased compatibility with WordPress Playground
Harden REST API user enumeration protection
Fixed
Upgraded virtualizer dependency to fix Firefox tab crash on screens with a lot of DOM elements (e.g., a running scan)
Better detection and handling of "module" script tagging to avoid conflict with renamed plugin directories
Add missed return value from `upgrader_pre_install` audit log filter
PHP 8.1 deprecation notice fixes
Fixed translation support on login page
Improve handling of WAF JSON processing to better handle array values
Address early translation calls to avoid `_load_textdomain_just_in_time` notices
Changed a few translated strings to avoid containing HTML due to a broken CZ translation
Removed obsolete CSS
Fixed typo in "No alerts will be sent for the remain[d]er..."
9.0.1
2 improvements4 fixes
Improved
UX enhancements for passkey authentication and general login security
GeoIP database updated
Fixed
Improved error handling in WAF request handlers and XML-RPC parser
Fixed an issue with translations not showing on the Login Security Settings tab
Addressed several potential PHP 8.5+ deprecation notices
Reworked MD5 hash use in MySQL to avoid deprecation in 9.7+
9.0.0
9 improvements4 changes
Improved
Added support for passkey authentication
GeoIP database updated
Several mobile styling and layout improvements on the login security page
Added diagnostics info for authentication hooks to assist with login-related troubleshooting
Hardened 2FA flow when installed next to plugins with non-standard authentication (credit: Austin Ginder of Anchor Hosting)
Hardened 2FA remember cookie handling
The scanner will now display an issue when the standalone Wordfence Login Security plugin is installed because all functionality is already provided by Wordfence itself
Updated internal libraries used by the Vue UI
Login error masking setting now also applies to the Login Security functionality
Changes
Available for both free and premium installations
Can be enabled for any user role (multisite support is currently limited)
WooCommerce integration
Support for custom authentication integrations
8.2.2
7 improvements4 fixes
Improved
Better presentation of Live Traffic data on wide screens
Increased legibility of token fields
Reworked the pagination of the Blocking page for a better UX
Country blocking token field can now expand to show all entries
Performance improvements for the activity log and better pause behavior on window blur/focus
GeoIP database updated
Removed deprecated Central endpoint
Fixed
Addressed issue where the last activity log entry could repeatedly appear
Using the embedded shortcode for the 2FA form now correctly enqueues core JavaScript dependencies
Modals with content that overflows on smaller viewports can now be scrolled
The changelog link in plugin upgrade scan issues now links correctly
8.2.1
5 fixes
Fixed
Fixed issue with some i18n plugins/themes when a user has no 2FA recovery codes
Toggled options with additional help links now correctly open the link rather than toggling the option
Country Blocking editing fixed when there are multiple pages of block rules
Added better error handling to the initial Vue data load
Handled error when logging in using legacy 2FA with separate prompts enabled
8.2.0
4 improvements1 fix1 change
Improved
Migrated all deprecated JavaScript libraries in use to a Vue-based infrastructure
GeoIP database update
Better coverage of `aria-` accessibility attributes
Added `translators` comments to translatable strings where previously missing
Fixed
WordPress 7.0 compatibility fixes
Changes
Note: Legacy two factor authentication using SMS-based codes will be discontinued around July 1, 2026. Sites using this functionality should migrate users to the TOTP-based two factor authentication on the Login Security page of the plugin
8.1.4
1 fix
Fixed
Fixed an issue with `inet_pton` introduced by a recent patch to PHP 8.1+ that could cause a fatal error if a malformed IP address was passed to the call
8.1.3
1 improvement1 change
Improved
Updated the bundled geoip database
Changes
Note: Verified compatibility with WordPress 6.9
8.1.2
1 improvement
Improved
Updated the bundled geoip database
8.1.1
5 improvements3 fixes
Improved
Improved localization support for the various block screens and messages
Updated the bundled geoip database
Prioritized Wordfence tables in the diagnostics tool when large numbers of tables exist
Allow non-US Google crawler IP addresses to pass country blocking
Enforcement of password strength requirements is now applied on the corresponding REST API endpoints
Fixed
Fixed detection for first-time logins and overall sending for login alerts when the corresponding settings are enabled
When the WAF is using the mysql storage engine, fixed an issue with exclusion rules for the WAF not running correctly
Optimized data sync with the WAF to better detect when the known server IP address list has changed
8.1.0
8 improvements5 fixes
Improved
Added password scanning support for WordPress 6.8 and later
Limited email alerts to 5 per hour by default and added notification when limit has been reached
Improved URL scanning performance
Updated GeoIP database
Reduced scan result severity for vulnerabilities with high attack complexity or required privileges
Added messaging around WAF support when NGINX Unit is detected
Added notice and scan result about Wordfence Assistant
Adjusted IPv6 connection issue message and appearance
Fixed
Prevented deprecation notice about calling base64_encode with null parameter
Prevented deprecation message about calling preg_match with null parameter
Prevented disabled getmyuid function from causing fatal error
Prevented disabled get_current_user function from causing fatal error
Prevented notice about _load_textdomain_just_in_time being called incorrectly
8.0.5
1 fix
Fixed
Compatibility fixes for WordPress 6.8
8.0.4
2 improvements
Improved
Improved error handling and messaging for some responses from our servers
Updated the readme content and formatting
8.0.3
7 improvements3 fixes
Improved
Added support for hosts relocating the WAF's auto-prepend file via the constant/envvar WORDFENCE_WAF_PREPEND_DIRECTORY
Added detection for non-repo plugins and themes to avoid the scanner reporting changes when the same slug + version exists within the wordpress.org repo
Messaging for Central disconnections now better reflects the user making the change
Scan errors due to unreachable Wordfence servers will now provide a link to our status page to check for outages
Reduced the number of network calls created to sync scan issues when updates are performed in bulk
Reworked setting caching to avoid issues with some object caches
Reworked cURL check to avoid using WP_Http_Curl, which has been deprecated
Fixed
Normalized all wordfence.com links to be https
Fixed a rare error that could occur on the diagnostics page when displaying a list of error logs
Removed the "back to top" button and related script block from emailed diagnostics
8.0.2
3 improvements1 fix
Improved
General compatibility improvements and better error handling for PHP 8+
Added audit log status to the plugin dashboard
Increased width of diagnostics text export for better legibility
Fixed
Addressed an error with mail hooks and the audit log when third party plugins send unexpected value types
Changelog published by the developer, in their original language.
