Wordfence operations for agencies
Every client site.
One alert queue.
Wordfence emails one site at a time. Run forty installs and you get forty streams of noise and no way to answer the only question that matters on a Monday morning: which client needs you first. WPSecureOps collects every completed scan into a single queue, sorted worst first.
| Severity | Finding | Detected |
|---|---|---|
| Critical | Unauthenticated file upload in a page-builder plugin
wfPluginVulnerable · Wordfence severity 100 |
today |
| Critical | Backdoor uploader found in the uploads directory
knownfile · Wordfence severity 100 |
today |
| High | Database credentials exposed in a wp-config backup
publiclyAccessible · Wordfence severity 80 |
yesterday |
| High | Administrator created outside WordPress
suspiciousAdminUsers · Wordfence severity 75 |
yesterday |
| Medium | Firewall still in learning mode after install
wafStatus · Wordfence severity 50 |
3 days ago |
- Collected from
- every enrolled install
- Scan check
- every 5 min
- Delivery
- every 1 min, with backoff
- Sheet
- specimen — not live data
What lands in the queue
Wordfence's findings, grouped so they can be worked
Wordfence reports 34 distinct issue types. WPSecureOps maps every one of them onto six categories and four severity bands, so a queue spanning dozens of sites can be filtered, grouped and worked through instead of read one email at a time.
| Category | Types | Examples | What it means |
|---|---|---|---|
| Malware | 9 types | file, knownfile, database, checkGSB | A known signature matched, or the site is flagged by Google Safe Browsing. Treat as active compromise. |
| Vulnerability | 7 types | wfPluginVulnerable, wfPluginAbandoned, wfUpgrade | A component is inside a known-affected version range, abandoned, or simply behind. |
| Public files | 4 types | publiclyAccessible, configReadable, dbBackup | Something that should never be reachable over HTTP is being served with a 200. |
| File change | 4 types | coreUnknown, coreFile, pluginFile, themeFile | A file no longer matches the copy it was distributed as. |
| Login | 3 types | easyPassword, suspiciousAdminUsers | Weak credentials, or an administrator that appeared without going through WordPress. |
| Firewall | 3 types | wafStatus, checkHowGetIPs, geoipSupport | The firewall is running but not at full protection on that install. |
Connecting a site
Three steps, once per site
-
1
Install the connector
Upload the WPSecureOps plugin to the WordPress site and activate it. It carries no credentials, so the same file goes on every site.
-
2
Press Connect
Under
Settings → WPSecureOps, one button. The site registers itself and asks to join. Nothing to copy or paste. -
3
Approve it
The site appears in your pending queue. Approving it proves you control that domain before a single finding is accepted.
The privacy boundary
What actually leaves a client's site
You are asking clients to let a plugin report on their security posture. It is worth being precise about what that plugin sends, so here is the whole list.
It sends
- +Site name and URL
- +WordPress, Wordfence and connector versions
- +Scan completion time and status
- +Issue type, severity and state
- +Title and description, HTML stripped
It never sends
- −WordPress credentials
- −Wordfence license keys
- −File contents
- −The raw Wordfence issue object
- −Absolute server paths — the site root is replaced with
[site-root]/
Reference
What does this Wordfence finding mean?
Every issue type a Wordfence scan can raise, explained: what was actually detected, why it matters, and the steps to clear it. Written for whoever is holding the queue.
- A plugin has a known security vulnerabilitywfPluginVulnerable
- A file appears to be maliciousfile
- A config, backup or log file is publicly accessiblepubliclyAccessible
- An administrator was created outside WordPresssuspiciousAdminUsers
- An unknown file was found in a core directorycoreUnknown
- The firewall is not at full protectionwafStatus