How to set up Wordfence Security Premium plugin

According to Wordfence’s reports, Lucid Gen gets around 200 attacks a day. Wordfence blocks most of them for me, and I use the Premium version (with a license bought from wordfence.com) for its extra advanced security features. If you are looking for a WordPress security plugin, don’t miss this article. I’ll walk you through using Wordfence Security Premium in detail.

What is Wordfence Security?

Wordfence is a product of Defiant, a company that specializes in WordPress security. The plugin provides a firewall and malware scanning for WordPress websites.

Wordfence keeps up to date with the latest firewall rules, malware signatures, and malicious IP addresses needed to keep your website safe.

It also includes 2FA (two-factor authentication) and a set of other extra features. In my opinion, it is one of the most feature-rich WordPress security plugins available today.

Wordfence Security – Firewall, Malware Scan, and Login Security

Features of Wordfence Premium

Free version features

1. Firewall
   • Web Application Firewall: protects your website against outside attacks and hackers. The description is short, but this is the most important feature.
   • Brute Force Protection: protects your website against the classic attack that tries millions of username and password combinations to guess your login.
   • Blocking: you can add any IP to your website’s block list, and you can also add rules to block automatically.
   • Rate Limiting: this feature does two useful things. First, it blocks crawlers (bots that collect content) so your website isn’t scraped and your content stolen. Second, it helps prevent bandwidth and DDoS attacks, where bad actors hit your website over and over in a short time, eating up resources and slowing the site down for real visitors.
2. Scan: scans all the files on your website for malware, backdoors, shells, and other threats known to Wordfence.
3. Tools
   • Live Traffic: shows where the most recent visits come from and whether they are people or bots. You only really need to look at the visits Wordfence has blocked. For example, Lucid Gen blocks about 50 IPs every day.
   • Whois Lookup: checks IP or domain information. Plenty of websites offer this already, so you can skip it.
   • Import/Export Options: if you run Wordfence on several websites, configure it once, then export the settings to the other sites so you don’t have to start over.
4. Login Security
   • Two-factor authentication: a must-have these days, which I covered in the article how to enable two-factor authentication for WordPress.
   • reCAPTCHA: checks whether a visitor is a bot and stops repeated login attempts, which also helps against the brute force attacks mentioned above.

Premium version features

1. Premium firewall features
   • Real-time Firewall Rules: Wordfence’s firewall uses rules to identify and block malicious traffic, protecting you from WordPress attacks and the latest vulnerabilities.
   • Real-time IP Blocklist: automatically blocks IPs on Wordfence’s blocklist that frequently attack WordPress websites. This protects your site and improves performance (fewer resources wasted on bad actors).
   • Country Blocking: in my opinion, this is the best Wordfence Premium feature. You can block countries from accessing your login page or your entire website. I block every country except Vietnam from the login page, and it works great.
2. Premium malware scanning features
   • Real-time Malware Signatures: detects malware on your website in real time, just like antivirus software on a computer, and alerts you right away.
   • Spamvertising Checks: checks whether your website is being “spamvertised” (promoted in spam emails).
   • Spam Check: checks whether your website’s IP is sending spam.
   • Blocklist Check: checks whether your website is on a domain blocklist.

Note: Premium features only work with a license key purchased from wordfence.com. Wordfence Premium currently costs 149 USD per year for one site (10/2026). If you are not ready to pay, the free version still includes the firewall and malware scanner, but its firewall rules and malware signatures arrive 30 days later than in Premium. I recommend staying away from “Premium” copies shared around the internet, because a modified security plugin can easily become a backdoor for attackers.

How to use Wordfence Security Premium

Now I’ll walk you through the most important Wordfence features. I won’t cover the other minor settings here because they matter less; when you have time, you can explore them and adjust them to your liking.

After activating the plugin, you will see this message. Enter your admin email, select NO to skip the Wordfence newsletter, tick the box to agree to the terms, and click Continue.

When you open the Dashboard, Wordfence asks whether you want the plugin to update itself automatically. Click Yes, enable auto-update, because a security plugin should receive fixes and improvements as soon as they are released.

To enable Premium features, sign in to your account on wordfence.com, open Licenses and copy your license key. Then in WordPress, go to Wordfence > Dashboard > Global Options, paste the key into the License Key field in the Wordfence License section and save (10/2026).

Turn on the firewall and configure website protection

Turn on the firewall

Method 1: The first time you use Wordfence, you will see the message “To make your site as secure as possible, take a moment to optimize the Wordfence Web Application Firewall”. Click CLICK HERE TO CONFIGURE, then click DOWNLOAD and CONTINUE to finish.

Method 2: Click Firewall in the left menu, go to All Firewall Options on the right, and click OPTIMIZE THE WORDFENCE FIREWALL. Then click DOWNLOAD and CONTINUE to finish.

The firewall is now on. At first, Wordfence keeps the Web Application Firewall Status in Learning mode. Just let it finish learning, and it will switch to Enabled and Protecting on its own.

Configure Brute Force Protection

• Lock out after how many login failures: Blocks an IP after a number of failed logins. I set this to 1-2 because, as the real admin, there’s no reason to get the login wrong many times.
• Lock out after how many forgot password attempts: Blocks an IP after a number of password reset requests. I also set this to 1-2.
• Count failures over what time period: the window in which failures are counted. I choose 1 day (the longest option) to be stricter.
• Amount of time a user is locked out: How long a blocked IP stays blocked. I choose 2 months (the maximum).
• Immediately lock out invalid usernames: Blocks an IP immediately if someone tries to log in with one of these usernames. Enter the obvious names anyone would guess, but don’t enter your own username!
• The remaining options: these are less important; just turn them all on.

Configure Rate Limiting

• How should we treat Google’s crawlers: How Google’s crawlers (the bots Google uses to read your content) are treated. Choose Verified Google crawlers will not be rate-limited so Google can crawl freely and index your pages quickly. Other bots are handled by the options below.
• If anyone’s requests exceed: the limit for any visitor or bot. I choose 120 per minute then block it (block the IP after 120 requests per minute).
• If a crawler’s page views exceed: the limit for crawler page views. I choose 120 per minute then block it.
• If a crawler’s pages not found (404s) exceed: the limit for crawler requests to pages that don’t exist. I choose 60 per minute then block it.
• If a human’s page views exceed: the limit for human page views. I choose 120 per minute then block it.
• If a human’s pages not found (404s) exceed: the limit for human requests to pages that don’t exist. I choose 60 per minute then block it.
• How long is an IP address blocked when it breaks a rule: I choose 1 month (the maximum).

Secure login page

If you follow this part of the guide, brute force attacks become very hard to pull off. Most attackers get their IP blocked before they even reach the login page. If they do reach it, reCAPTCHA stops them from guessing passwords, and two-factor authentication adds yet another layer. They would have a very hard time getting in this way.

Block countries

The idea is to allow only your own country to access the login page and block all the others. For example, if you are in Vietnam, do it like this.

Click Blocking in the left menu. On the right, choose Country, check Login Form, and click Pick from list. Then click Block all at the top, scroll down to Vietnam and remove it from the list, then click Update block.

Block by URL

Attackers abroad are no longer a problem, but what about those in your own country? This next step takes care of them.

The logic of this section: attackers usually try to reach your login page through obvious default URLs like wp-login.php, login, admin, dang-nhap, dangnhap… So you change your login URL to something nobody else would think of. Then you set Wordfence to automatically block anyone who tries those easy-to-guess URLs. Once blocked, they can’t keep trying; they would have to change their IP every single time, and most will simply give up ^_^.

Step 1: Install the WPS Hide Login plugin to change the login URL.

WPS Hide Login

Pick a quirky URL that nobody would guess. For example, url-nobody-would-guess really is a URL nobody would guess ^_^.

Step 2: Go to All Options in the left menu and find the Advanced Firewall Options section. Paste the easy-to-guess URLs into the Immediately block IPs that access these URLs field.

/wp-login.php
/wp-login
/dang-nhap
/dangnhap
/login
/adminCopy

Turn on two-factor authentication for login

I recommend turning on two-factor authentication for every important online account. This feature used to be Premium-only, but Wordfence later added it to the free version.

Click Login Security in the left menu, then use Google Authenticator to add the verification code to your phone.

Enable reCAPTCHA login

reCAPTCHA makes it hard for attackers to guess your password. If you have already configured Brute Force Protection as strictly as I did, you can skip this, especially since the reCAPTCHA feature currently isn’t compatible with sites that use WooCommerce.

Step 1: To use reCAPTCHA, go to the Google reCAPTCHA page and register your site. Choose reCAPTCHA v3.

You will paste this Site key and Secret key into Wordfence.

Step 2: Go to Login Security in the Wordfence menu, select the Settings tab on the right, and scroll down to Enable reCAPTCHA on the login and user registration pages. Check the box, paste in your keys, and click Save.

Scan for malware

Here you can run a scan manually or schedule automatic scans. When Wordfence finds a problem, it lists it below, and you can follow the suggestions to fix it. You don’t have to fix every issue, though; you can ignore some if you have your reasons.

There’s only a little to configure here. Click Scan Options and Scheduling.

On the settings page, configure the following:

• Scan Scheduling: since we are using Wordfence Premium, you can schedule scans whenever you like. I schedule them late at night so they don’t affect performance during busy hours.
• Basic Scan Type Options: choose the highest level, High Sensitivity.
• Performance Options: tick Use low resource scanning so the scan runs more slowly and your website stays fast.

Use other tools

The features in the Tools section aren’t essential, but they can come in handy.

View and configure Live Traffic

How to use: check in when you’re bored, and if you see someone repeatedly attacking your site, just hit the block button.

Setting:

• Traffic logging mode: the logging mode. Select SECURITY ONLY so Wordfence only logs blocked, dangerous traffic. Logging all traffic can slow your website down considerably, and there’s no need to record normal visits.
• Amount of Live Traffic data to store (number of rows): the fewer rows you keep, the fewer server resources the log uses.
• Maximum days to keep Live Traffic data (minimum: 1): how many days to keep the log. I keep 7 days, but you can keep more if you need to.
• Other options: not important, leave them as they are.

Using Whois Lookup

Paste in an IP address or domain to look up its information, just like any other Whois website.

Export and import Wordfence settings for another website

This feature is handy when you manage several WordPress websites. Configure one website properly, then export its settings token and import it into the others.

Configure email notifications

Make sure your website has SMTP set up so it can send emails. Configure it like I did to receive only important alerts plus a monthly summary report. That way your inbox won’t get flooded.

Note when using Wordfence Premium

Every plugin has its quirks. The two most common problems I’ve run into with Wordfence are errors after migrating to a new host and accidentally locking myself out of my own website.

Fixing errors after migrating to a new host

Open File Manager on your hosting and update the /home/username/public_html/ path to the new one in the following files:

• .htaccess
• .user.ini
• wordfence-waf.php

For example, when I edit wordfence-waf.php, I find the new path and replace the old one like this: just copy the path from above and paste it below.

What to do when you are blocked by Wordfence

• Method 1: Enter the admin email on the block page and send an unlock request. Then check your email and follow the instructions to unblock your IP address.
• Method 2: Switch to mobile data (4G) to get a different IP address and log in again.
• Method 3: Use File Manager on your hosting to rename the Wordfence folder (public_html/wp-content/plugins/wordfence). The plugin will be deactivated automatically. Once you are logged in, rename the folder back and reactivate the plugin.

Conclusion

Setting up Wordfence Security Premium as described above makes your website much safer, but no plugin can stop every kind of attack. Keep WordPress, themes and plugins updated, install plugins only from official sources, and back up your website regularly so you always have a way to recover.

Have you tried Wordfence yet? Leave a comment below to share your experience or ask for help!