v3.2.3

Changelog

• Added Wordfence 9.0.0 passkey metrics while keeping existing two-factor metrics strict to TOTP/2FA secrets.
• Added combined login-protection metrics for administrators and users protected by 2FA, passkeys, either method, or both methods.
• Added authentication_failures_window with bounded password, passkey, passkey_required, two_factor, and other labels.
• Kept the aggregate failed-login metric compatible while preventing passkey-required failures from being counted as password brute force.
• Added Wordfence-version pinning support to Docker smoke scripts for current-version and 8.x compatibility checks.

Upgrade Notice

• Wordfence 9.0.0 passkeys are reported separately from strict 2FA metrics; use wordpress_wordfence_admin_users_without_login_protection_total for combined admin login-protection alerts.

v3.1.3

Changelog

• Changed wordpress_wordfence_scan_age_seconds to report the age in seconds since Wordfence's latest successful completed scan.
• Added wordpress_wordfence_scan_issue_update_age_seconds for the previous scan issue update age behavior.
• Updated scan freshness documentation and tests to distinguish successful scan completion age from scan issue update age.

Upgrade Notice

• wordpress_wordfence_scan_age_seconds now means age since the latest successful completed Wordfence scan. Use wordpress_wordfence_scan_issue_update_age_seconds for the previous scan issue update age behavior.

v3.1.2

Release Notes

• Added aggregate firewall block metrics derived from locally stored Wordfence block-log data by category and 24h, 7d, and 30d reporting window.
• Added explicit blocked_hit_rows aliases for the existing hit/live-traffic row metrics while keeping blocked_events metrics for compatibility.
• Added aggregate firewall block-source availability, collection-success, source-info, and latest-bucket diagnostics.
• Updated admin and WP-CLI status output to distinguish hit-row metrics from aggregate Firewall summary metrics.
• Updated Prometheus rules, Grafana dashboard examples, Docker fixtures, and documentation for source-model comparison and migration.
• Marked ambiguous blocked_events metric names as deprecated aliases in documentation.
• Count failed-login windows from Wordfence's wfLogins table when available, with the previous hit/live-traffic text heuristic retained as a fallback.
• Count brute_force_events_window{vector="username"} from failed wfLogins rows when available. The xmlrpc vector remains hit/live-traffic based.
• Document rate-limited windows as retained hit/live-traffic heuristics.

v3.0.0

Release Notes

• Split the plugin implementation into explicit include classes for configuration, settings, admin UI, WP-CLI, metrics rendering, Wordfence schema detection, collection, output, incidents, and utilities.
• Added disposable Docker test harnesses for local fixture, publisher integration, and release zip install validation.
• Added dependency-free PHP unit tests, bootstrap smoke checks, Prometheus output validators, and coverage tooling for environments with Xdebug or PCOV.
• Added WordPress core version metadata through wordpress_wordfence_wordpress_version_info.
• Added installed plugin aggregate metrics for installed, active, inactive, and network-active plugin totals.
• Added opt-in per-plugin inventory metrics with plugin file, name, version, active state, and update availability labels.
• Added opt-in administrator inventory metrics with hashed identity labels by default and per-admin Wordfence two-factor status.
• Added WordPress settings, role/user, plugin/theme drift, account event, cron/option persistence, content injection, and uploads/file IoC metric families.
• Added administrator identity label modes for hashed, ID-only, and counts-only operation.
• Updated WP-CLI and admin status output to show plugin inventory, admin inventory, and admin identity mode settings.
• Updated Grafana dashboard and Prometheus alert examples for WordPress version, plugin posture, plugin inventory, admin inventory, core updates, plugin updates, inactive Wordfence inventory, and administrator 2FA coverage.
• Added release asset validation for README/readme metric coverage, Grafana JSON, and Prometheus alert examples.
• Updated the Docker smoke test to install and activate the current official Wordfence plugin before activating this plugin.
• Updated documentation for the new WordPress version, plugin inventory, and administrator inventory metric families.

v2.3.3

Features:

• Added clearer stale-export diagnostics through next scheduled fast and slow export timestamps plus richer admin and WP-CLI freshness status output.

Bug fixes

• Fixed scan finding classification so malware counts prefer structured Wordfence issue types instead of broad message text matches.
• Reduced false malware positives for non-malware scan issues such as skipped scan paths and unknown files.