WWordfence Security: version, compatibility and updates

Wordfence Security is a WordPress plugin with 5+ million active installs. The current version on WordPress.org is 9.0.2, last updated on 30 September 2026.

Facts from WordPress.org

Does Wordfence Security work with WordPress 7.2?

Wordfence Security says it was tested up to WordPress 7.1.4. It does not yet say it has been tested with WordPress 7.2. See the full WordPress 7.2 compatibility list.

What the plugin says about itself

THE MOST POPULAR WORDPRESS FIREWALL & SECURITY SCANNER WordPress security requires a team of dedicated analysts researching the latest malware variants and WordPress exploits, turning them into firewall rules and malware signatures, and releasing those to customers in real-time. Choose the right protection for you: Wordfence Free, Premium, Care or Response Wordfence is widely acknowledged as the number one WordPress security research team in the World. Our plugin provides a comprehensive suite of security features, and our team’s research is what powers our plugin and provides the level of security that we are known for. At Wordfence, WordPress security isn’t a division of our business – WordPress security is all we do. We employ a global 24-hour dedicated incident response team that provides our priority customers with a 1 hour response time for any security incident. The sun never sets…

Newest changelog entry

9.0.2 – September 30, 2026 Change: Changed IPv6 diagnostics result to be informational only Change: Added help link to increased attack rate emails Improvement: Increased compatibility with WordPress Playground Improvement: Harden REST API user enumeration protection Fix: Upgraded virtualizer dependency to fix Firefox tab crash on screens with a lot of DOM elements (e.g., a running scan) Fix: Better detection and handling of “module” script tagging to avoid conflict with renamed plugin directories Fix: Add missed return value from upgrader_pre_install audit log filter Fix: PHP 8.1 deprecation notice fixes Fix: Fixed translation support on login page Fix: Improve handling of WAF JSON processing to better handle array values Fix: Address early translation calls to avoid _load_textdomain_just_in_time notices Fix: Changed a few translated strings to avoid containing HTML due to a broken CZ translation Fix: Removed obsolete CSS Fix: Fixed typo in “No alerts will be sent for the remain[d]er…”

Recent releases

Days are when each version's tag was created in WordPress.org's code repository.

Questions