Skip to content

Release v3.0.0: Comprehensive managed settings coverage

Choose a tag to compare

View all tags
@pimschaaf pimschaaf released this 30 Oct 09:39
· 1 commit to main since this release
v3.0.0
2b5afad

🎉 MAJOR RELEASE

This is a major release that dramatically expands the plugin's capability to manage Wordfence settings. We've increased coverage from 42 to 115 manageable settings - a 173% increase - providing comprehensive control over all free Wordfence features.

🚀 What's New

Expanded Settings Coverage

Before (v2.x): 42 basic settings
Now (v3.0): 115 comprehensive settings

Blueprint exports (--managed-only) now include:

Category Settings What's New
🔐 Brute Force 20 +10 (Password policies, 2FA, breach detection)
🛡️ Firewall & WAF 13 +10 (WAF alerts, whitelist, custom messages)
🔍 Scanner 32 +20 (Advanced scans, exclusions, GeoIP)
📧 Alerts 15 +6 (Severity, throttling, non-admin logins)
⏱️ Rate Limiting 10 NEW (Throttling for crawlers, humans, 404s)
📊 Live Traffic 10 NEW (Monitoring, filtering, ajax watchers)
⚙️ General Security 15 NEW (Misc security options)

✨ New Features by Category

🔐 Brute Force Protection (20 settings)

New in v3.0:

  • loginSec_breachPasswds - Breach password checking policy
  • loginSec_breachPasswds_enabled - Enable breach checking
  • loginSec_disableApplicationPasswords - Block app passwords
  • loginSec_disableOEmbedAuthor - Disable oEmbed author discovery
  • loginSec_enableSeparateTwoFactor - Separate 2FA for users
  • loginSec_requireAdminTwoFactor - Require 2FA for admins
  • loginSec_strongPasswds - Strong password enforcement
  • loginSec_strongPasswds_enabled - Enable password strength
  • alertOn_firstAdminLoginOnly - Alert only on first admin login
  • alertOn_firstNonAdminLoginOnly - Alert only on first user login

🛡️ Firewall & WAF (13 settings)

New in v3.0:

  • bannedURLs - Patterns to ban
  • blockCustomText - Custom block page message
  • blockedTime - Block duration (seconds)
  • whitelisted - Whitelisted IP addresses
  • wafAlertInterval - WAF alert throttling interval
  • wafAlertOnAttacks - Alert on WAF attacks
  • wafAlertThreshold - Attack count threshold
  • wafAlertWhitelist - WAF alert whitelist
  • displayAutomaticBlocks - Show auto-blocks in UI
  • allowed404s - Allowed 404 URL patterns

🔍 Scanner (32 settings)

New in v3.0:

  • scansEnabled_checkGSB - Google Safe Browsing check
  • scansEnabled_checkHowGetIPs - IP resolution check
  • scansEnabled_checkReadableConfig - Readable config check
  • scansEnabled_coreUnknown - Unknown core files
  • scansEnabled_diskSpace - Disk space monitoring
  • scansEnabled_fileContentsGSB - GSB file contents
  • scansEnabled_geoipSupport - GeoIP database check
  • scansEnabled_oldVersions - Old version detection
  • scansEnabled_options - Options table scan
  • scansEnabled_passwds - Password scan
  • scansEnabled_suspectedFiles - Suspected file patterns
  • scansEnabled_suspiciousAdminUsers - Admin username check
  • scansEnabled_suspiciousOptions - Suspicious options
  • scansEnabled_wafStatus - WAF status check
  • scansEnabled_wpscan_directoryListingEnabled - Directory listing
  • scansEnabled_wpscan_fullPathDisclosure - Path disclosure
  • scan_exclude - Exclusion patterns
  • scan_include_extra - Additional scan paths
  • scan_force_ipv4_start - Force IPv4 for scans
  • scan_max_resume_attempts - Max resume attempts
  • lowResourceScansEnabled - Low resource mode

📧 Alerts (15 settings)

New in v3.0:

  • alertOn_nonAdminLogin - Alert on non-admin logins
  • alertOn_lostPasswdForm - Alert on password reset
  • alertOn_wafDeactivated - Alert when WAF deactivated
  • alertOn_throttle - Alert on rate limit hits
  • alertOn_severityLevel - Minimum severity for alerts
  • email_summary_dashboard_widget_enabled - Dashboard widget

⏱️ Rate Limiting (10 settings) - NEW CATEGORY

  • max404Crawlers - Max 404s for crawlers
  • max404Crawlers_action - Action (throttle/block)
  • max404Humans - Max 404s for humans
  • max404Humans_action - Action for humans
  • maxGlobalRequests - Global request limit
  • maxGlobalRequests_action - Global action
  • maxRequestsCrawlers - Crawler request limit
  • maxRequestsCrawlers_action - Crawler action
  • maxRequestsHumans - Human request limit
  • maxRequestsHumans_action - Human action

📊 Live Traffic (10 settings) - NEW CATEGORY

  • liveTrafficEnabled - Enable live traffic
  • liveTraf_displayExpandedRecords - Expanded display
  • liveTraf_ignoreIPs - IPs to ignore
  • liveTraf_ignorePublishers - Ignore publishers
  • liveTraf_ignoreUA - User agents to ignore
  • liveTraf_ignoreUsers - Users to ignore
  • liveTraf_maxAge - Max age (days)
  • liveTraf_maxRows - Max rows to store
  • ajaxWatcherDisabled_admin - Disable admin ajax monitoring
  • ajaxWatcherDisabled_front - Disable frontend ajax monitoring

⚙️ General Security (15 settings) - NEW CATEGORY

  • other_blockBadPOST - Block malformed POST
  • other_hideWPVersion - Hide WordPress version
  • other_WFNet - Wordfence network participation
  • other_scanComments - Scan comments for threats
  • other_pwStrengthOnUpdate - Password strength on update
  • deleteTablesOnDeact - Delete data on deactivation
  • disableCodeExecutionUploads - Prevent code in uploads
  • disableWAFIPBlocking - Disable WAF IP blocking
  • allowLegacy2FA - Allow legacy 2FA
  • checkSpamIP - Check IPs against spam lists
  • ssl_verify - Verify SSL certificates
  • spamvertizeCheck - Spamvertize checking
  • liveActivityPauseEnabled - Pause live activity
  • showAdminBarMenu - Show in admin bar
  • advancedCommentScanning - Enhanced comment scanning

📊 Settings Breakdown

Total Wordfence Settings: 282
├─ Manageable (Free features): 115 ✅
├─ Premium-only: ~20 ❌
└─ Read-only/Internal: ~147 ❌

Blueprint Coverage: 40.8% of all settings (100% of manageable)

🎯 Use Cases

1. Complete Security Baseline

# Export comprehensive security configuration
wp wf-config export /tmp/complete-baseline.json --managed-only

# Now includes 115 settings vs. 42 in v2.x

2. Password Policy Enforcement

# Deploy password policies across all sites
wp wf-config set loginSec_strongPasswds 'all'
wp wf-config set loginSec_strongPasswds_enabled 1
wp wf-config set loginSec_breachPasswds_enabled 1

3. Rate Limiting Configuration

# Configure 404 detection
wp wf-config set max404Humans 10
wp wf-config set max404Humans_action 'throttle'
wp wf-config set max404Crawlers 20
wp wf-config set max404Crawlers_action 'block'

4. Traffic Monitoring Setup

# Enable and configure live traffic
wp wf-config set liveTrafficEnabled 1
wp wf-config set liveTraf_maxRows 5000
wp wf-config set liveTraf_ignorePublishers 1

🔄 Migration Guide

From v2.x to v3.0

Good News: No breaking changes! Your existing workflows continue to work.

Recommended Actions:

  1. Re-export blueprints to capture 73 new settings:

    wp wf-config export /tmp/blueprint-v3.json --managed-only

  2. Compare old vs new blueprints:

    # v2.x blueprint: 42 settings
# v3.0 blueprint: 115 settings

  3. Review new settings and update your baseline as needed

  4. No code changes required - all CLI commands remain the same

⚠️ What's NOT Included

To maintain compliance and avoid premium feature conflicts, the following are excluded from managed settings:

Premium Features:

  • Country blocking (cbl_* settings)
  • Premium-only scan features
  • License/subscription management

Read-Only/Internal:

  • API keys, encryption keys, hashes
  • Timestamps, migration flags, versions
  • Scan results, statistics, counters
  • Cache data, internal state
  • UI preferences, tour states

📦 Installation & Upgrade

Upgrading from v2.x

# Backup current plugin
cp -r wp-content/plugins/wf-settings-cli wp-content/plugins/wf-settings-cli.backup

# Update via WP-CLI
wp plugin update wf-settings-cli-3.0.0.zip

# Or via git
cd wp-content/plugins/wf-settings-cli
git pull origin main

New Installation

# Via WP-CLI
wp plugin install wf-settings-cli-3.0.0.zip --activate

# Via git
cd wp-content/plugins
git clone https://github.com/pimschaaf/wf-settings-cli.git
wp plugin activate wf-settings-cli

🐛 Bug Fixes

None - this is a pure feature expansion release. All v2.0.4 bug fixes are included.

🔗 Resources

💬 Feedback

We'd love to hear how you're using v3.0! Share your feedback:

  • GitHub Issues
  • GitHub Discussions
  • WordPress Support Forums

Full Changelog: v2.0.4...v3.0.0

Assets 3
Loading