Name: Simula Security Telemetry for Wordfence
Availability: InStock
Author: SiMULA

Export Wordfence-generated telemetry into a node_exporter textfile collector .prom file and append incidents detected by Wordfence to a local log file &hellip;

Simula Security Telemetry for Wordfence

Simula Security Telemetry for Wordfence exports Wordfence security telemetry in two forms:
<ul>
<li>Prometheus metrics for the node_exporter textfile collector that can be scraped by Prometheus</li>
<li>A local incident log containing blocked Wordfence requests that can be shipped with Grafana Alloy</li>
</ul>
This plugin is intended for WordPress sites that already use Wordfence and Prometheus-based infrastructure. Instead of exposing a public metrics endpoint from WordPress, the plugin writes local files that node_exporter and log-based tooling can consume.
By default, the plugin runs a fast collector every 15 minutes and a slow collector hourly using WP-Cron. It supports:
<ul>
<li>Exporter health and plugin metadata metrics</li>
<li>Configurable cron interval</li>
<li>Separate fast and slow collector intervals</li>
<li>Per-metric-family enable or disable controls</li>
<li>Aggregate firewall block counts derived from locally stored Wordfence block-log data</li>
<li>Blocked hit-row counters and recent activity windows</li>
<li>Blocked event counts by HTTP status code over the last 24 hours</li>
<li>Failed login, rate-limited, and brute-force activity windows</li>
<li>Current lockout counts for IPs and users</li>
<li>Wordfence two-factor status and protected user counts</li>
<li>Scan issue counts by severity</li>
<li>Malware, file change, and vulnerable component findings</li>
<li>Top blocked attack sources by country and normalized IP range</li>
<li>Incident log export for newly observed blocked requests</li>
<li>Incident privacy controls for IPs, URLs, referers, user agents, and internal traffic</li>
<li>Manual export and incident cursor reset from the admin UI</li>
<li>Current exporter and incident state visibility in the admin UI</li>
<li>Optional JSON Lines incident output</li>
<li>WP-CLI exports for system cron</li>
<li>Source freshness and WordPress/Wordfence posture metrics</li>
<li>A ready-to-import Grafana dashboard and sample Prometheus alert rules</li>
</ul>
The plugin exposes two distinct Wordfence blocking measurements. blocked_hit_rows_* counts retained hit/live-traffic records matching a blocked-request predicate. firewall_blocks_* derives aggregate block counts from locally stored Wordfence block-log data and groups them into bounded categories and reporting windows. The values are not expected to be equal because the two metric families use different sources, units, retention behavior, and categorization.
The legacy blocked_events_* names are deprecated aliases for the hit/live-traffic row model. They are still emitted for compatibility, but they represent retained blocked hit rows rather than the aggregate block-log data exposed through firewall_blocks_*.
Blocked hit rows are currently identified from the Wordfence hits table where:
<ul>
<li>action matches blocked:*</li>
<li>or the HTTP status code is 403 or 503</li>
</ul>
The plugin includes an admin settings screen under Settings &gt; Security Telemetry, where you can:
<ul>
<li>Enable or disable the exporter master switch</li>
<li>Choose the export cron interval</li>
<li>Choose the slow collector interval</li>
<li>Set the .prom output path</li>
<li>Set a custom metric prefix</li>
<li>Set a custom site label</li>
<li>Enable or disable individual metric families</li>
<li>Enable or disable incident log export</li>
<li>Set the incident log path</li>
<li>Choose text or JSON Lines incident output</li>
<li>Limit the number of incidents appended per run</li>
<li>Configure incident IP privacy and field-dropping filters</li>
<li>Add an optional retention note to emitted incident events</li>
<li>Trigger a manual export</li>
<li>Reset the incident cursor for backfill</li>
<li>Review current exporter and incident state</li>
</ul>
Simula Security Telemetry for Wordfence is an independent open-source project and is not affiliated with, endorsed by, sponsored by, or otherwise associated with Defiant, Inc. or Wordfence.
Wordfence and related names and marks are the property of their respective owners.

Alternative Plugins for

Discover the Lists with Simula Security Telemetry for Wordfence