The Wordfence firewall is not at full protection

What Wordfence found

Wordfence reports the firewall's operating state. This finding covers a firewall left in learning mode after installation, one not optimised to run before WordPress loads, or one otherwise not at full protection.

Why it matters

In learning mode the firewall watches traffic and blocks almost nothing — it is meant to run for a week, not permanently. A firewall that has been learning for a year gives the reassurance of protection without the protection, which is worse than knowing you have none.

How to fix it

1. 1Check how long it has been in learning mode. Anything beyond a couple of weeks was forgotten, not chosen.
2. 2Take it out of learning mode and into enabled and protecting.
3. 3Run the firewall optimisation so it loads before WordPress rather than as a plugin.
4. 4Watch for false positives for a day afterwards, particularly on sites with unusual admin workflows.

How WPSecureOps treats it

The connector reports this as wafStatus. WPSecureOps files it under Firewall and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.