Wordfence

New in 3.21.1 (free), and in EMCP Lite 1.0.5 on WordPress.org. One read-only dispatcher tool works with Wordfence 9.0.2:

Tool	Default	Purpose
wordfence-read	On	Status, firewall, scan health, findings and blocks (6 operations)

There is no write tool.

Requirements

• Wordfence 9.0.2 exactly, on a single site. Another version answers unsupported_version; multisite answers unsupported_environment.
• An administrator (manage_options) whom Wordfence also treats as an administrator.
• Wordfence disables application passwords by default. Connect with EMCP’s OAuth sign-in instead of turning that protection off.

Operations

Operation	What it does
status	Version, whether a licence key is set, premium, whether application passwords are disabled, and finding counts
firewall	Loaded and stored firewall mode, protection mode and whether the firewall is operational for this request
scan-status	Whether a scan is running, whether scheduled scans are on, the last completed scan, the last status update and any failure
list-findings	Findings with status new (default), ignoreC or ignoreP, by severity; limit up to 100 and offset
get-finding	One finding by id
list-blocks	Active blocks, newest first; limit up to 100 and offset

Findings return ID, type, severity, status and dates, plus a link to Wordfence’s scan screen. Blocks return ID, type, block time, last attempt, hit count and expiry.

What it leaves out

• IP addresses, file paths, raw finding data and request details.
• Starting scans (scan_start_supported is false), firewall changes, allowlists, blocklists and every setting.

Reading the answers

• Findings are what earlier scans stored. No findings does not mean the site is clean; check scan-status for the last scan and any failure.
• Firewall state belongs to the current request. Reconnect a long-running WP-CLI client after changing the firewall in Wordfence.

For EMCP’s own malware, integrity and hardening checks, see Security tools.