WordFence is a pretty darn good WordPress plugin, but they recently added two-factor authentication to the free version.
2FA support is super awesome, but not when there’s no option to turn it off.
Sure, you can just not use it, and for some people that’s 100% A-OKAY – but what if you’re already using a 2FA plugin? Now you’re faced with conflicting user interfaces, users are freaking out and clicking the “wrong 2FA button” and ain’t nobody got time for that.
This WordPress plugin removes all visual traces of the WordFence 2FA feature from everywhere bar the actual WordFence settings pages (it does however remove the submenu item for “Login Security” under the WordFence admin menu item).

Remove WordFence 2FA

(Visually) removes all trace of the WordFence 2FA feature

SiMULA

Simula Security Telemetry for Wordfence exports Wordfence security telemetry in two forms:
<ul>
<li>Prometheus metrics for the node_exporter textfile collector that can be scraped by Prometheus</li>
<li>A local incident log containing blocked Wordfence requests that can be shipped with Grafana-Alloy</li>
</ul>
This plugin is intended for WordPress sites that already use Wordfence and Prometheus-based infrastructure. Instead of exposing a public metrics endpoint from WordPress, the plugin writes local files that node_exporter and log-based tooling can consume.
By default, the plugin runs a fast collector every 15 minutes and a slow collector hourly using WP-Cron. It supports:
<ul>
<li>Exporter health and plugin metadata metrics</li>
<li>Configurable cron interval</li>
<li>Separate fast and slow collector intervals</li>
<li>Per-metric-family enable or disable controls</li>
<li>Blocked event counters and recent activity windows</li>
<li>Blocked event counts by HTTP status code over the last 24 hours</li>
<li>Failed login, rate-limited, and brute-force activity windows</li>
<li>Current lockout counts for IPs and users</li>
<li>Wordfence two-factor status and protected user counts</li>
<li>Scan issue counts by severity</li>
<li>Malware, file change, and vulnerable component findings</li>
<li>Top blocked attack sources by country and normalized IP range</li>
<li>Incident log export for newly observed blocked requests</li>
<li>Incident privacy controls for IPs, URLs, referers, user agents, and internal traffic</li>
<li>Manual export and incident cursor reset from the admin UI</li>
<li>Current exporter and incident state visibility in the admin UI</li>
<li>Optional JSON Lines incident output</li>
<li>WP-CLI exports for system cron</li>
<li>Source freshness and WordPress/Wordfence posture metrics</li>
<li>A ready-to-import Grafana dashboard and sample Prometheus alert rules</li>
</ul>
Blocked events are currently identified from the Wordfence hits table where:
<ul>
<li>action matches blocked:*</li>
<li>or the HTTP status code is 403 or 503</li>
</ul>
The plugin includes an admin settings screen under Settings > Security Telemetry, where you can:
<ul>
<li>Enable or disable the exporter master switch</li>
<li>Choose the export cron interval</li>
<li>Choose the slow collector interval</li>
<li>Set the .prom output path</li>
<li>Set a custom metric prefix</li>
<li>Set a custom site label</li>
<li>Enable or disable individual metric families</li>
<li>Enable or disable incident log export</li>
<li>Set the incident log path</li>
<li>Choose text or JSON Lines incident output</li>
<li>Limit the number of incidents appended per run</li>
<li>Configure incident IP privacy and field-dropping filters</li>
<li>Add an optional retention note to emitted incident events</li>
<li>Trigger a manual export</li>
<li>Reset the incident cursor for backfill</li>
<li>Review current exporter and incident state</li>
</ul>

Simula Security Telemetry for Wordfence

Export metrics from Wordfence into a node_exporter textfile collector .prom file and append incidents detected by wordfence to a local log file.

Remove WordFence 2FA vs Simula Security Telemetry for Wordfence