---
title: "Wordfence and WP Masquerade: firewall, scanning and a smaller attack surface"
description: "Wordfence filters and scans, WP Masquerade hides WordPress and closes entry points: what each one covers, and the features to enable only once."
language: "en"
locale: "en-US"
type: "article"
canonical: "https://www.wp-masquerade.com/wordfence-and-wp-masquerade/"
published: "2026-10-22T07:00:00+00:00"
modified: "2026-10-28T23:00:35+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/wordfence-and-wp-masquerade/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/wordfence-et-wp-masquerade/index.md"
  es-ES: "https://www.wp-masquerade.com/es/wordfence-y-wp-masquerade/index.md"
  de-DE: "https://www.wp-masquerade.com/de/wordfence-und-wp-masquerade/index.md"
  it-IT: "https://www.wp-masquerade.com/it/wordfence-con-wp-masquerade/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/wordfence-com-wp-masquerade/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/wordfence-en-wp-masquerade/index.md"
---

# Wordfence and WP Masquerade: firewall, scanning and a smaller attack surface

Wordfence in detail (firewall, scanning, login, plans), what WP Masquerade adds, the overlapping features to enable in only one plugin and the recommended setup.

Wordfence is the most installed security plugin for WordPress: a [web application firewall](https://www.wp-masquerade.com/glossary/waf/) and a malware scanner that run on your server. WP Masquerade does neither: it reduces what bots see of your site and closes well-known entry points. This article explains what Wordfence does, what the pair really covers and which features to enable in only one of the two plugins to avoid conflicts.

*Disclosure: this article is published by the WP Masquerade team. Wordfence does not pay us and we use no affiliate links. The information about Wordfence comes from its wordpress.org page, its website and the code of version 9.0.2.*

## Wordfence in detail

Wordfence’s wordpress.org page lists more than 5 million active installations; version 9.0.2 was released on September 30, 2026. The plugin groups four families of features, almost all available in the free version.

### A web application firewall on your server

The Wordfence firewall reads every HTTP request and compares it with rules written for WordPress. In basic mode, it loads with WordPress. In “Extended Protection” mode, it is declared through the PHP `auto_prepend_file` directive and runs before WordPress and before all plugins: an attack aimed at a vulnerable plugin can be stopped before that plugin is even loaded. The firewall starts in learning mode, so as not to block your own usage; check that it has then switched to enabled mode.

The point to know: the free version receives new firewall rules and signatures with a **30-day delay**, paid plans in real time. The real-time blocklist of malicious IP addresses and country blocking are reserved for Premium.

### A file scanner

- Comparison of core, theme and plugin files with the originals on wordpress.org, and one-click repair of a modified file.
- Search for malware, backdoors, redirects, SEO spam and code injections, with signatures that are also delayed by 30 days in the free version.
- Scanning of post and comment content for dangerous URLs.
- Alerts about known vulnerabilities and about closed or abandoned plugins.

### Login security

[Brute force](https://www.wp-masquerade.com/glossary/brute-force-attack/) protection is on out of the box. In the default configuration of version 9.0.2, an address is locked out after 20 failures, for 240 minutes; the thresholds can be adjusted. Wordfence also offers [two-factor authentication](https://www.wp-masquerade.com/glossary/two-factor-authentication/) with an app (TOTP), passkeys (since version 9.0.0 of August 2026, free), a CAPTCHA on the login page, blocking of compromised passwords for administrators, and two options for XML-RPC: refuse authentication or require the two-factor code. By default, it also prevents username discovery through `/?author=N`, the REST API, oEmbed and sitemaps, and disables application passwords.

### The plans

| Plan | Listed price | What it adds |
| --- | --- | --- |
| Free | Free | Firewall, scanner, login security; rules and signatures with a 30-day delay |
| Premium | $149 per year | Real-time rules and signatures, IP blocklist, country blocking, 30-day audit log, support |
| Care | $590 per year | Premium, plus a dedicated analyst, a yearly audit and cleanup if you are hacked |
| Response | $1,250 per year | Care, plus 24/7 incident response with a one-hour response time |

*Prices listed by Wordfence, plus any applicable taxes.*

## What Wordfence does not do, and what WP Masquerade adds

Wordfence defends the site once it is targeted. It does not try to make the site less visible or to move its entry points. That is exactly where WP Masquerade fits:

- **Login address**: Wordfence does not change it. The free version of WP Masquerade gives you a custom address and makes `wp-login.php` return 404 to visitors; Pro also hides `wp-admin`.
- **WordPress fingerprint**: Wordfence can remove the version number. WP Masquerade goes further: it makes the site look like Joomla!, Drupal, PrestaShop, TYPO3 or MediaWiki (41 profiles with Pro), removes the technical links and, with Pro, renames file URLs (`/wp-content/`, `/wp-includes/`).
- **XML-RPC**: Wordfence acts on authentication; the free version of WP Masquerade blocks `xmlrpc.php` entirely (404) and turns off pingbacks.
- **Bot traps**: requests for vulnerabilities of the imitated software or for sensitive files (`/.env`, backups) are counted; Pro bans the bot after three traps.
- **Security headers** (Pro): X-Frame-Options, Referrer-Policy, Permissions-Policy, and optionally CSP and HSTS. Wordfence does not add any.
- **Administrator activity log** (Pro): at Wordfence, the audit log is reserved for paid plans.

![Color-coded table: for each stage of an automated attack, what Wordfence covers and what WP Masquerade covers. Reconnaissance and enumeration: WP Masquerade. Firewall and file scanning: Wordfence. Login, two-factor authentication and author enumeration: present in both, to enable in only one. Monitoring: vulnerability alerts in both, activity log paid at Wordfence and included in WP Masquerade Pro.](https://www.wp-masquerade.com/media/2026/10/couches-wordfence-wp-masquerade-en.webp)

*The two plugins act at different stages; the blue cells are the overlaps to split between them.*

## Why the pair makes sense

An automated attack almost always follows the same path: a bot spots a WordPress site, lists its plugins (`readme.txt` files, `/wp-content/plugins/` URLs), then tries known vulnerabilities or passwords. WP Masquerade acts on the first two stages: fewer clues, so fewer bots that classify your site as a WordPress target, and closed addresses that expose the curious. Wordfence acts on the following ones: it blocks the dangerous request and detects what may have slipped through.

The pair also offsets a weakness of the free version of Wordfence. During the 30 days when a new rule has not been distributed yet, a site that does not appear to be WordPress and does not let its plugins be listed drops out of some of the automated campaigns. This reduces exposure without eliminating it: an attacker who targets your site specifically, or a bot that tries every vulnerability on every address, is not fooled. Only updating fixes the vulnerability, as our firewall comparison points out.

## Overlapping features: one plugin per feature

Two login limiters counting the same failures, or two two-factor systems each asking for a code, get in each other’s way and make unlocking harder. Here is the split we recommend.

| Feature | Enable in Wordfence | Enable in WP Masquerade | Turn off |
| --- | --- | --- | --- |
| Web application firewall, file scanning | Yes (Extended Protection if your hosting allows it) | Not applicable | Nothing |
| Login attempt limiting | Yes (on by default) | No: stay at level 3 of the Login page and Hardening modules | Level 4 “Limit login attempts” of WP Masquerade Pro |
| Two-factor authentication and passkeys | Yes (free, with passkeys) | No | Do not enroll users or set a per-role requirement in WP Masquerade Pro |
| Custom login address | Not applicable | Yes (free) | Nothing |
| XML-RPC and pingbacks | XML-RPC authentication options not applicable | Yes: “Block XML-RPC” (free) | Nothing to turn off, the Wordfence options no longer apply |
| Author enumeration | Yes (on by default) | Optional (level 3, Pro): an overlap without conflict | Nothing |
| WordPress version and generator tag | No | Yes: other CMS imitation | Wordfence’s “Hide WordPress version” (off by default) |
| Bot banning | Rate limiting left off (default setting) | Yes: traps and banning after 3 traps (Pro) | Avoid two banning rules on 404 errors |
| Security headers | Not applicable | Yes (Pro) | Nothing |
| Activity log | Only if you pay for Premium | Yes (Pro) | Only one of the two logs for alerts |
| Real IP behind Cloudflare | Yes: set “How does Wordfence get IPs” to CF-Connecting-IP | Yes: Cloudflare support (Pro) | Nothing: both must be configured |

*Recommended split. The Wordfence labels are those of its English interface.*

Two remarks about this table. Vulnerability alerts exist in both plugins: they do not interfere, but you will get two emails for the same vulnerability; keep the Wordfence ones if you do not have Pro. And behind Cloudflare, both must be configured: in Extended Protection mode, the Wordfence firewall runs before WordPress and reads the visitor’s address itself, before WP Masquerade Pro restores it for the rest of the site.

![Diagram of the recommended setup, in the order in which a request meets each protection: Wordfence firewall before WordPress, WP Masquerade making wp-login.php and xmlrpc.php return 404 and banning trapped bots, login protected by Wordfence (limiting and two-factor authentication), pages served by WP Masquerade without a WordPress signature, then scheduled file scanning by Wordfence and monitoring by WP Masquerade Pro.](https://www.wp-masquerade.com/media/2026/10/configuration-wordfence-wp-masquerade-en.webp)

*The recommended setup, in the order in which a request meets each protection.*

## Step-by-step setup

1. Make a full backup and, ideally, work on a staging site first.
2. Install Wordfence, follow its wizard, then switch the firewall to Extended Protection if your hosting supports it. Run a first scan and deal with its results before going further.
3. Install WP Masquerade and follow the Getting started tab in Recommended mode. Choose a login address specific to your site, exclude it from the page cache, then click “Test and enable the new login”.
4. Apply the table above: level 3 at most for the login in WP Masquerade, two-factor authentication in Wordfence, XML-RPC blocking in WP Masquerade.
5. Test: login at the new address, two-factor code, lost password, logout, `wp-login.php` and `xmlrpc.php` returning 404 in a private window. If you use the WordPress mobile app or Jetpack, be aware that blocking XML-RPC cuts them off.
6. Write down the two emergency switches: `define('CMS_MASQUERADE_DISABLE', true);` in `wp-config.php` reopens `wp-login.php`, and, with Pro, the “Unblock me” button in the Troubleshooting tab frees your address.

Both plugins write to the `.htaccess` file on Apache and LiteSpeed (Wordfence for Extended Protection, WP Masquerade to hide plugin files), each in its own block. Keep a copy of this file before every change.

*Getting started with Wordfence in 15 minutes, by the developer (in English).*

## What the pair does not cover

- **Updates**: neither the firewall nor hiding fixes a vulnerability. Turn on automatic updates for the plugins that allow it.
- **Flood attacks**: Wordfence runs on your server; a massive wave of requests is handled upstream (host, Cloudflare, cloud firewall).
- **Comment spam**: neither of them is an anti-spam filter; see [what WP Masquerade blocks and what it leaves to an anti-spam plugin](https://www.wp-masquerade.com/wordpress-anti-spam/).
- **Cleanup**: the free version of Wordfence reports and repairs files, but cleanup by its analysts belongs to the Care and Response plans. Our guide to [cleaning up a hacked WordPress site](https://www.wp-masquerade.com/clean-hacked-wordpress-site/) details the procedure.
- **Backups**: keep some off the server, and test them.

To compare Wordfence with the other suites, see our [comparison of the best WordPress security plugins](https://www.wp-masquerade.com/best-wordpress-security-plugins/). On the WP Masquerade side, the [login page](https://www.wp-masquerade.com/features/custom-login-page/), [bot traps](https://www.wp-masquerade.com/features/bot-traps/), [security headers](https://www.wp-masquerade.com/features/security-headers/) and [other CMS imitation](https://www.wp-masquerade.com/features/cms-imitation/) pages detail each setting.

*WordPress security training with Wordfence (in French).*

### Key takeaways

- Wordfence filters requests and scans files; WP Masquerade reduces what bots see and closes `wp-login.php` and `xmlrpc.php`.
- In the free version, Wordfence rules and signatures arrive 30 days late: hiding reduces exposure during that delay, updating remains essential.
- Login limiting and two-factor authentication: in Wordfence; login address, XML-RPC, imitation and headers: in WP Masquerade.
- Behind Cloudflare, configure the real IP in both plugins.

## Sources

- WordPress.org: Wordfence, changelog (9.0.0 to 9.0.2) (https://wordpress.org/plugins/wordfence/#developers)
- Wordfence Help: Optimizing the Firewall (https://www.wordfence.com/help/firewall/optimizing-the-firewall/)
- Wordfence 9.0.2 source code (default settings, lib/wfConfig.php) (https://downloads.wordpress.org/plugin/wordfence.9.0.2.zip)

Other sources consulted: official vendor pages and security research publications.

## WordPress security, without the noise

One e-mail when something matters: new attacks seen in the wild, plugin updates and practical guides. No spam, unsubscribe in one click.