Scans Targeting Wordfence Protected Sites Detected

• •Scans for Wordfence's 'wordfence-waf.php' detected on September 29, 2026.
• •Attackers may be trying to enumerate or bypass Wordfence protection.
• •Wordfence reported 2,073 vulnerabilities added in Q2 2026.

On September 29, 2026, SANS.edu reported a small number of scans targeting the 'wordfence-waf.php' file, which is integral to Wordfence's protection for WordPress sites. These scans lack typical headers, suggesting attackers may be attempting to enumerate Wordfence-protected sites to limit detection. The scans might also aim to bypass Wordfence's protection by using IP addresses instead of hostnames. Wordfence's 'Extended Protection' feature is designed to mitigate such bypass attempts. The Wordfence Threat Intelligence Report for Q2 2026 indicates that 2,073 vulnerabilities were added to their database, with Wordfence responsible for remediating 47.4% of them. The ongoing scans highlight the importance of proactive security measures for WordPress site owners.