← All guides

WordPress: Classify Wordfence and IP-based security functions

Requirements

WordPress administration access and an overview of the activated Wordfence firewall, login and reputation functions.

Wordfence works with IP-based blocking and reputation functions and communicates with its own cloud infrastructure. For “We don’t save!” It is crucial to document this processing as a security function and to check storage and actually activated functions.

Check

After the change, check browser memory, network connections and web server, proxy and application logs separately. A product setting does not automatically prove that no visitor IP is stored at all levels.

Classification

To differentiate between technically necessary processing, security logging and permanent storage, additionally use IP processing and IP storage: the crucial difference . Security data should be dedicated, access-restricted and only retained for as long as necessary.

Dismantling

If a reduced security function is required, only reactivate the specific Wordfence function and check storage, cloud usage and IP reference again.

Related guides

• STRATO homepage builder: Check statistics, cookies and external content
• WordPress: Classify independent analytics in a data protection-conscious manner
• HAProxy: Logs without persistent client IP
• WordPress: Minimize Solid Security Logs and IP Detection

Sources and verification

This guide is based on multiple current sources. Vendor documentation is not treated as proof that every concrete installation automatically follows the same privacy characteristics.

• Documentation 1
• Documentation 2

Important: IP processing is not IP storage

An IP address has to be processed to establish and deliver a network connection. Hosting providers, firewalls or DDoS protection may also process or retain it for a limited time for security purposes. No Logging distinguishes this security layer from unnecessary persistent visitor logging by the website, application and ordinary access logs.