Wordfence 9.1.0: Security widget, faster firewall rules, configurable thresholds

Defiant released Wordfence version 9.1.0 on 9 November 2026, the WordPress security plugin with over 3 million active installations. For those managing WordPress hosting or site maintenance, the update touches three operational areas: threat visibility, firewall tuning and PHP compatibility.

What's new

The most visible change is the security news widget, added to both the WordPress dashboard and the Wordfence dashboard, which brings alerts and research from the Wordfence team directly to the dashboard.

On the firewall front, the official changelog published on wordpress.org/plugins/wordfence/ lists, in addition to what was announced, a series of improvements:

• increased frequency of WAF rule update checks;
• new controls for the attack alert threshold and the related counting window, configurable by the administrator;
• improved synchronisation of attack data to reduce overhead and cache issues;
• more accurate parsing and detection of SQL injection on malformed input;
• Live Traffic logging of authentication errors on application passwords and REST API, previously less visible in standard logs.

On the compatibility front, the release includes fixes for PHP 8.6, the version that Defiant is bringing to Release Candidate with GA scheduled for 19 November. For those planning to upgrade their PHP server fleet, it's one more piece to verify before the transition.

Other minor improvements: GeoIP database update, improved validation of 2FA recovery codes, more robust handling of WAF execution in non-standard hosting configurations or with unstable networks, and revalidation of reCAPTCHA keys on save.

What to check

Those managing many WordPress sites with Wordfence active should check the attack alert thresholds after updating: the new controls allow you to redefine when the plugin sends notifications, and the default values may not match what was previously set manually. The update is available from the official WordPress plugin repository.