Dante Campbell

The DMN (Security Centre) plugin provides an easy way to keep your Wordfence security whitelist updated with all DMN services without having to check it all the time. This will automatically check and ensure that the whitelist is kept updated once a day. This service requires external communication with DMNs devstage server to aquire the office IP address which will be whitelisted. By using this plugin you agree that the service can be used and communicated with.
The DMN (Security Centre) plugin can be easily activated and deactivated from the WordPress dashboard, and requires no additional configuration or setup.

DMN (Security Centre)

The DMN (Security Centre) plugin keeps your word fences whitelist IP addresses updated with DMN services on your WordPress site.

SiMULA

Simula Security Telemetry for Wordfence exports Wordfence security telemetry in two forms:
<ul>
<li>Prometheus metrics for the node_exporter textfile collector that can be scraped by Prometheus</li>
<li>A local incident log containing blocked Wordfence requests that can be shipped with Grafana-Alloy</li>
</ul>
This plugin is intended for WordPress sites that already use Wordfence and Prometheus-based infrastructure. Instead of exposing a public metrics endpoint from WordPress, the plugin writes local files that node_exporter and log-based tooling can consume.
By default, the plugin runs a fast collector every 15 minutes and a slow collector hourly using WP-Cron. It supports:
<ul>
<li>Exporter health and plugin metadata metrics</li>
<li>Configurable cron interval</li>
<li>Separate fast and slow collector intervals</li>
<li>Per-metric-family enable or disable controls</li>
<li>Blocked event counters and recent activity windows</li>
<li>Blocked event counts by HTTP status code over the last 24 hours</li>
<li>Failed login, rate-limited, and brute-force activity windows</li>
<li>Current lockout counts for IPs and users</li>
<li>Wordfence two-factor status and protected user counts</li>
<li>Scan issue counts by severity</li>
<li>Malware, file change, and vulnerable component findings</li>
<li>Top blocked attack sources by country and normalized IP range</li>
<li>Incident log export for newly observed blocked requests</li>
<li>Incident privacy controls for IPs, URLs, referers, user agents, and internal traffic</li>
<li>Manual export and incident cursor reset from the admin UI</li>
<li>Current exporter and incident state visibility in the admin UI</li>
<li>Optional JSON Lines incident output</li>
<li>WP-CLI exports for system cron</li>
<li>Source freshness and WordPress/Wordfence posture metrics</li>
<li>A ready-to-import Grafana dashboard and sample Prometheus alert rules</li>
</ul>
Blocked events are currently identified from the Wordfence hits table where:
<ul>
<li>action matches blocked:*</li>
<li>or the HTTP status code is 403 or 503</li>
</ul>
The plugin includes an admin settings screen under Settings > Security Telemetry, where you can:
<ul>
<li>Enable or disable the exporter master switch</li>
<li>Choose the export cron interval</li>
<li>Choose the slow collector interval</li>
<li>Set the .prom output path</li>
<li>Set a custom metric prefix</li>
<li>Set a custom site label</li>
<li>Enable or disable individual metric families</li>
<li>Enable or disable incident log export</li>
<li>Set the incident log path</li>
<li>Choose text or JSON Lines incident output</li>
<li>Limit the number of incidents appended per run</li>
<li>Configure incident IP privacy and field-dropping filters</li>
<li>Add an optional retention note to emitted incident events</li>
<li>Trigger a manual export</li>
<li>Reset the incident cursor for backfill</li>
<li>Review current exporter and incident state</li>
</ul>

Simula Security Telemetry for Wordfence

Export metrics from Wordfence into a node_exporter textfile collector .prom file and append incidents detected by wordfence to a local log file.

DMN (Security Centre) vs Simula Security Telemetry for Wordfence