Wordfence CLI Free has ended: how to keep scanning your WordPress servers

Updated 2026-10-20 · 6 min read · by the IsHacked team

Wordfence announced in its Wordfence CLI repository that the command-line scanner is no longer available for new Free or Premium licenses. Free reached end of life on 14 October 2026, and Free license keys stopped working that day. Premium licenses keep working until their term ends, and can't be renewed.

If you ran wordfence malware-scan from cron on a server full of WordPress sites, those jobs now fail. Here's what you can do.

Your options

1. Ride out a Premium license

If you have one, it works until the term ends. That buys time, not a solution: the same move is waiting at the end of the term.

2. WP-CLI's checksum commands

wp core verify-checksums and wp plugin verify-checksums --all list every modified or extra file in WordPress core and wordpress.org plugins. Free and precise, but one site at a time, and blind to uploads, themes, premium plugins and the database.

3. General-purpose malware scanners

ClamAV and Linux Malware Detect scan any files against their own signatures. Neither knows WordPress: no checksum comparison, no vulnerable plugin versions, no database.

4. A drop-in replacement

ishacked is one PHP file that runs Wordfence CLI's command lines as they are: the same subcommands, options, wordfence-cli.ini settings, file lists on stdin, output formats and columns, email reports and exit codes. It's included with every IsHacked plan and needs no license key.

Move your scans over

1. Download it from ishacked.com/cli (or with the personal link on the Servers page) and check its SHA-256.
2. Change the start of each command. Everything after wordfence stays:

   # before
   0 3 * * * wordfence malware-scan -q -E [email protected] /var/www
   # after
   0 3 * * * php /opt/ishacked.phar malware-scan -q -E [email protected] /var/www

3. Keep your settings. ~/.config/wordfence/wordfence-cli.ini is read as it is: workers, output format, email and SMTP settings. The license line is ignored.
4. Check scripts that read the results. Column names are Wordfence's; signature_id holds ishacked's check names (such as code:eval-decode) instead of numbers, so filters on Wordfence's numeric IDs no longer match anything.

What's different

• Detection: fewer malware patterns than Wordfence's signature set, plus a comparison of every core and wordpress.org plugin file with its official checksum, which catches modified files no signature knows.
• Vulnerabilities come from wpvulnerability.net, which links Wordfence's advisories where it has them.
• Database rules are ishacked's own, in Wordfence's rule format, and your own rule files still work.
• remediate only restores a file when the release zip on wordpress.org matches the official checksums, and backs up every file it replaces.
• More checks: exposed backups, crontab, temporary folders and processes on the server, and reports to a dashboard if you connect it.

While you're at it

A server scan sees files; it doesn't see what Google and phone visitors are served. Spam shown only to Googlebot and redirects for mobile visitors are checked from outside. Check a site from outside for free

Wordfence is a trademark of Defiant, Inc. IsHacked isn't affiliated with Defiant or Wordfence.

FAQ

When did Wordfence CLI Free end?

On 14 October 2026. Existing Free licenses stopped being valid that day, and no new Free or Premium licenses are issued. Premium licenses keep working until their current term ends, with no renewals.

Can I keep using Wordfence CLI without a license?

No. Every scanning command (malware-scan, vuln-scan, db-scan, remediate, count-sites) needs a valid license key, so with a Free key they stop working.

What is the closest replacement?

ishacked runs Wordfence CLI's command lines unchanged: the same subcommands, options, wordfence-cli.ini settings, output formats and exit codes, with "wordfence" replaced by "ishacked" as the only change. Its malware patterns are fewer than Wordfence's signatures; it adds a check of every core and wordpress.org plugin file against its official checksum.

Is wp core verify-checksums enough?

It's the best free test for modified core files, and wp plugin verify-checksums --all does the same for wordpress.org plugins. It doesn't look at uploads, themes, premium plugins or the database, and runs one site at a time, so it complements a scanner rather than replacing one.