Reference
Wordfence issue glossary
Every issue type a Wordfence scan can raise, what it actually means, and what to do about it — written for someone looking at a queue rather than a marketing page. 30 entries covering 34 of the 34 issue types WPSecureOps maps.
Malware
| Wordfence type | Finding | What it means |
|---|---|---|
file |
A file appears to be malicious | Wordfence's malware signatures matched the contents of a file on the site. |
knownfile |
A known malicious file was found | A file on the site matches a known-bad file by hash, not just by pattern. |
database |
Malicious content was found in the database | Wordfence matched malicious content inside database rows rather than in files. |
checkGSB |
The site is flagged by Google Safe Browsing | Google's Safe Browsing service lists the site as unsafe, so browsers will warn visitors away. |
blacklistedURL |
A blocklisted URL was found in site content | Content on the site links to a domain known for malware or fraud. |
spamvertizeCheck |
The site may be advertised in spam | The domain appears in spam-related reputation data, which usually follows a compromise. |
commentBadURL |
A malicious URL was found in a comment | A comment on the site links to a known-bad domain. |
postBadURL |
A malicious URL was found in a post | Published post content links to a known-bad domain. |
optionBadURL |
A malicious URL was found in a site option | A value in the WordPress options table points at a known-bad domain. |
Vulnerability
| Wordfence type | Finding | What it means |
|---|---|---|
wfPluginVulnerable |
A plugin has a known security vulnerability | Wordfence matched an installed plugin against its vulnerability database and the version running is inside the affected range. |
wfPluginAbandoned |
A plugin appears to be abandoned | The plugin has had no release for a long period and is flagged by WordPress.org as unmaintained. |
wfPluginRemoved |
A plugin was removed from the WordPress.org repository | A plugin installed on the site is no longer available on WordPress.org, often because it was pulled for a security issue. |
wfPluginUpgrade |
A plugin needs an upgrade | An installed plugin is behind the current release. No specific vulnerability is being asserted. |
wfThemeUpgrade |
A theme needs an upgrade | The active or an installed theme is behind its current release. |
wfUpgrade |
WordPress core needs an upgrade | The WordPress version running is behind the current release. |
wfUpgradeError |
WordPress could not check for updates | The site failed to reach WordPress.org to determine whether updates are available. |
Public files
| Wordfence type | Finding | What it means |
|---|---|---|
publiclyAccessible |
A config, backup or log file is publicly accessible | A file that should never be reachable over HTTP returns a 200 to anyone who requests it. |
configReadable |
wp-config.php is readable over the web | The main WordPress configuration file can be fetched over HTTP, exposing database credentials. |
dbBackup |
A database backup is publicly accessible | A database dump is downloadable over HTTP. |
wpscan_fullPathDiscl |
The server's full path is disclosed | An error message reveals the absolute filesystem path of the WordPress installation. |
File change
| Wordfence type | Finding | What it means |
|---|---|---|
coreUnknown |
An unknown file was found in a WordPress core directory | A file exists in wp-admin or wp-includes that is not part of the official WordPress distribution. |
coreFile |
A WordPress core file has been modified | A file that ships with WordPress no longer matches the official copy. |
pluginFile |
A plugin file has been modified | A plugin's file no longer matches the copy published on WordPress.org. |
themeFile |
A theme file has been modified | A theme file differs from the version published on WordPress.org. |
Login
| Wordfence type | Finding | What it means |
|---|---|---|
easyPassword |
A user has an easily guessed password | Wordfence tested account passwords against common and breached password lists and one matched. |
suspiciousAdminUsers, suspiciousAdmins |
An administrator was created outside WordPress | An administrator account exists that was not created through the normal WordPress flow. |
Firewall
| Wordfence type | Finding | What it means |
|---|---|---|
wafStatus |
The Wordfence firewall is not at full protection | The firewall is installed but running in a reduced mode, most often still in learning mode. |
checkHowGetIPs |
Visitor IP detection is misconfigured | Wordfence is reading visitor IP addresses in a way that does not match how the site is actually served. |
geoipSupport |
Country blocking is unavailable on this server | The server lacks what Wordfence needs to determine a visitor's country. |
Other
| Wordfence type | Finding | What it means |
|---|---|---|
diskSpace, timelimit, issue, pending |
Scan status messages that are not findings | Wordfence raises several entries that report on the scan itself rather than on the site's security. |
Related tools
Other things worth having open
- WPSalt Generates wp-config.php salts, WordPress-format passwords and phpass hashes entirely in the browser. Useful every time a finding ends in "rotate the salts".
- Lockora Audit Runs a one-off security audit of a WordPress site. Complements a standing Wordfence queue rather than replacing it.