Scanners probe for Wordfence-protected WordPress sites
SANS ISC observed low-volume scans for wordfence-waf.php, likely used to fingerprint or bypass Wordfence-protected WordPress sites via direct IP access.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
SANS Internet Storm Center reported a small number of scans targeting the file "wordfence-waf.php", a component created during installation of the Wordfence WordPress security plugin. The scans are notably bare, using only a minimal HTTP request with a Host header set to the target's IP address rather than its hostname, and lacking a User-Agent or other typical headers. The file itself contains no secrets or configuration data but does include scripts that run before WordPress code loads, integrating with Wordfence's Web Application Firewall (WAF).
The analyst offers two possible motivations for attackers: first, to enumerate which sites are protected by Wordfence, allowing attackers to avoid those sites and preserve the shelf life of exploits (since Wordfence publishes threat intelligence from protected sites that can "burn" techniques used against them); second, to identify sites reachable directly via IP address, potentially bypassing Wordfence's protection if the site's origin server accepts direct IP connections and doesn't enforce hostname-based routing through the WAF.
Defenders running Wordfence should ensure they have implemented Wordfence's "Extended Protection" feature, which is specifically designed to prevent this type of direct-IP bypass, and should follow Wordfence's guidance on preventing WAF bypass via direct origin access. This is a reconnaissance/scanning report rather than a confirmed exploitation campaign, and no indicators of compromise beyond the scan pattern (unusual bare requests for wordfence-waf.php with IP-based Host headers) were provided.
Source reporting: https://isc.sans.edu/diary/rss/33382
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs