Uses Wordfence's wfLogins table for failed-login and username brute-force windows when available, preserving older hit\/live-traffic fallback behavior.<\/p>","3.1.0":"
Adds Wordfence Firewall Summary-compatible aggregate block metrics and explicit blocked_hit_rows aliases. Existing blocked_events metrics remain available but are now documented as deprecated hit\/live-traffic row aliases, not Wordfence Firewall Summary totals.<\/p>","2.3.3":"
Improves scan finding classification so malware counts follow Wordfence issue types more closely, avoids false positives from descriptive text, and makes stale exports easier to diagnose.<\/p>","2.2.2":"
Fixes incident log event timestamps, adds incident log levels and instance_name dashboard filtering, and renames the plugin storage prefix from Adds incident privacy controls for sensitive IP, URL, referer, user-agent, private\/internal IP, and retention-note handling.<\/p>","2.0.0":" Adds ops-ready dashboard, alert, WP-CLI, JSON Lines incident, freshness, and posture capabilities while preserving the node_exporter textfile collection model.<\/p>","1.0.0":" Adds configurable metric export coverage and optional blocked-incident log export for Wordfence operators.<\/p>"},"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["2.2.2","2.3.3","3.0.0","3.1.2"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Settings screen showing Prometheus metric controls, incident log settings, manual actions, and current exporter state."}},"plugin_section":[],"plugin_tags":[211254,3283,5603,600,14385],"plugin_category":[54],"plugin_contributors":[223827],"plugin_business_model":[],"class_list":["post-318093","plugin","type-plugin","status-publish","hentry","plugin_tags-grafana","plugin_tags-metrics","plugin_tags-monitoring","plugin_tags-security","plugin_tags-wordfence","plugin_category-security-and-spam-protection","plugin_contributors-simulalab","plugin_committers-simulalab"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/simula-security-telemetry-for-wordfence.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"\n Simula Security Telemetry for Wordfence exports Wordfence security telemetry in two forms:<\/p>\n\n This plugin is intended for WordPress sites that already use Wordfence and Prometheus-based infrastructure. Instead of exposing a public metrics endpoint from WordPress, the plugin writes local files that node_exporter and log-based tooling can consume.<\/p>\n\n By default, the plugin runs a fast collector every 15 minutes and a slow collector hourly using WP-Cron. It supports:<\/p>\n\n Simula exposes two distinct Wordfence blocking measurements. blocked_hit_rows_* counts retained hit\/live-traffic records matching a blocked-request predicate. firewall_blocks_* reports Wordfence's aggregate Firewall Summary counts by category. The values are not expected to be equal because they have different sources, units, retention behavior, and categorization.<\/p>\n\n The legacy blocked_events_* names are deprecated aliases for the hit\/live-traffic row model. They are still emitted for compatibility, but they must not be treated as the Wordfence Firewall Summary \"Attacks Blocked\" statistic.<\/p>\n\n Blocked hit rows are currently identified from the Wordfence hits table where:<\/p>\n\n The plugin includes an admin settings screen under Settings > Security Telemetry, where you can:<\/p>\n\n No. It writes metrics to a local file for node_exporter to collect, and it can append blocked incidents to a local log file.<\/p><\/dd>\n Yes. The plugin reads Wordfence data from the WordPress database. If required Wordfence tables or columns are unavailable, the exporter writes failure-state metrics instead of silently doing nothing.<\/p><\/dd>\n The plugin schedules fast exports with WP-Cron. The default fast interval is every 15 minutes, and the admin UI also supports every 5 minutes, every 30 minutes, and hourly. Slow posture and scan metrics refresh hourly by default and can be set to hourly, twice daily, or daily. On low-traffic sites, WP-Cron may not run exactly on schedule unless you trigger WordPress cron processing through a system cron job or WP-CLI.<\/p><\/dd>\n With the default metric prefix of wordpress_wordfence, the plugin can export:<\/p>\n\n Each metric family can be enabled or disabled independently from the settings screen. Per-plugin inventory and per-admin inventory are disabled by default because plugin names, versions, active state, and administrator identities can expose sensitive operational details. Admin inventory uses hashed identity labels by default when enabled.<\/p>\n\n blocked_events_total and blocked_events_window are deprecated ambiguous aliases for hit\/live-traffic row counts. blocked_hit_rows_total and blocked_hit_rows_window are the explicit names for that same low-level data model. firewall_blocks_window is the Wordfence Firewall Summary-compatible aggregate metric; it reads wfBlockedIPLog\/wfblockediplog with unixday, blockType, and SUM(blockCount), maps known block types to complex, brute_force, and blocklist, and bounds all other values to other. If the aggregate source is unavailable, the availability metric is 0 and category\/window series are omitted instead of fabricated.<\/p><\/dd>\n It appends newly observed blocked Wordfence hits to a local .log or .jsonl path. The default text format preserves the original plain-text log line. The JSON Lines format emits one structured JSON object per blocked event for Loki, ELK, OpenSearch, and similar tooling. The exported incident timestamp is taken from the Wordfence hit row, falling back across known timestamp columns before using export time. The exporter tracks the last processed hit ID, and you can reset the incident cursor from the admin UI or WP-CLI to backfill retained history up to the configured per-run limit.<\/p>\n\n For Loki, configure your log collector to parse the text prefix or the JSON Lines timestamp field if you want Grafana to display the original Wordfence event time instead of the collector ingestion time.<\/p>\n\n Incident privacy controls can keep full IPs, truncate IPv4 to \/24 and IPv6 to \/64, hash IPs with the site salt, drop IP fields, drop query strings from URL and referer fields, drop referers, drop user agents, skip private\/internal source IP ranges, and append an optional retention note to emitted events.<\/p><\/dd>\n If WP-CLI is available, the plugin registers:<\/p>\n\n Yes. The source repository provides repository-only examples under examples\/grafana\/ and examples\/prometheus\/. They are intentionally not included in the WordPress.org plugin zip. The dashboard includes exporter health, activity, scan posture, WordPress version, plugin posture, opt-in plugin inventory, opt-in admin inventory, administrator 2FA coverage, and incident logs. Inventory-based alert examples require the matching opt-in inventory metric to be enabled.<\/p><\/dd>\n The directory that will contain the .prom file must already exist and be writable by the PHP process running WordPress. If incident export is enabled, the incident log directory must also already exist and be writable by PHP. node_exporter must be able to read the resulting .prom file.<\/p><\/dd>\n\n<\/dl>\n\n\nwfne<\/code> to sstfw<\/code>. The WP-CLI command is now wp simula-security-telemetry<\/code>.<\/p>","2.1.0":"\n
\n
\n
\n
\n
\n
Does this plugin expose a public metrics endpoint?<\/h3><\/dt>\n
Does this plugin require Wordfence?<\/h3><\/dt>\n
How often are metrics exported?<\/h3><\/dt>\n
What metrics does the plugin export?<\/h3><\/dt>\n
\n
What does the incident log export do?<\/h3><\/dt>\n
What WP-CLI commands are available?<\/h3><\/dt>\n
\n
Does the project provide Grafana and Prometheus examples?<\/h3><\/dt>\n
What permissions are required?<\/h3><\/dt>\n
3.1.2<\/h4>\n\n
\n
3.0.0<\/h4>\n\n
\n
2.3.3<\/h4>\n\n
\n
2.2.2<\/h4>\n\n
\n
2.1.0<\/h4>\n\n
\n
2.0.0<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n