Wordfence Abilities

Get a Wordfence security overview: whether the firewall (WAF) is enabled and its mode, whether live traffic/login security features are on, when the last scan ran, and whether a scan is currently running. Read-only.

{
  "type": "object",
  "properties": {}
}

Get the results of the most recent Wordfence scan: counts of new issues, plus issues the admin has previously ignored (per-issue and per-category), and when the scan last ran. Returns finding titles and severities, never raw file contents or attacker payloads.

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "description": "Maximum number of new issues to detail (default 25, max 100). Counts are always returned regardless of this limit."
    }
  }
}

List IP addresses currently blocked by Wordfence, with the block reason, type (manual, brute-force, rate-limit, etc.), and when the block expires. Read-only.

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "description": "Maximum number of blocked IPs to return (default 50, max 200)."
    }
  }
}

Get Wordfence's recent failed-login summary: the top usernames by failed-attempt count over the plugin's reporting window, and whether each username maps to a real account (a repeated failure against a valid admin username is a stronger signal than one against a random string). Read-only.

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "description": "Maximum number of usernames to return (default 10, max 50)."
    }
  }
}

Start a Wordfence scan now. A scan is CPU- and IO-intensive, so this is a two-part confirmation: call without confirm to receive a preview and start nothing; call with confirm=true AND confirm_scan=true to actually begin. Uses the scan type configured in Wordfence. Refuses if a scan is already running.

{
  "type": "object",
  "properties": {
    "confirm": {
      "type": "boolean",
      "description": "Must be true to start the scan. Omit or false to receive a preview instead. That preview is the intended first call."
    },
    "confirm_scan": {
      "type": "boolean",
      "description": "Must also be true, alongside confirm=true, to start the scan. A deliberate second flag so a scan cannot begin on a single unconsidered call."
    }
  }
}