Works with your stack
Cookie consent next to Wordfence
security cookies, for logged-in users
For visitors who are not logged in, Wordfence sets no cookie by default. Its cookies serve logged-in users, login alerts, two-factor sign-in and a link that gets past country blocking. Its firewall works on your server, before WordPress and before any banner.
By Wordfence · wordfence.com · WordPress.org
Is this your product? Tell us if anything here is out of date. Write to us
Wordfence Security
WordPress plugin
- Tested version
- 9.0.2
- How
- Tested automatically around each Cookie Rocks version
- Last test
- 7 November 2026
- Latest version
- 9.0.2 tested
- Active installs
- 5,000,000+
What Wordfence adds to your visitors’ browser
No trackers In our test of Wordfence Security 9.0.2 on 7 November 2026, the plugin itself added no tracker and no cookie. What you place in your pages with it, such as a video or a map, still counts.
What Wordfence puts on your pages
- A firewall cookie
- Set for a few hours, only for users who can log in, so the firewall knows their rights before WordPress loads.
- Login cookies, if you use them
- A cookie for new-device login alerts, when that option is on, and one that remembers a browser for two-factor sign-in.
- A country-blocking bypass
- A cookie set only when someone opens the secret bypass link of Wordfence’s country blocking.
- Live Traffic, in its All traffic mode
- A small script from your own site on public pages, run at the visitor’s first gesture. No cookie. It is off by default.
- reCAPTCHA, if you turn it on
- Google reCAPTCHA on the login and registration pages, and on WooCommerce login and checkout with that integration.
What matters for consent with Wordfence
Nothing to hold for visitors
An anonymous visitor gets no Wordfence cookie by default, and their browser sends nothing to Wordfence. The firewall talks to Wordfence from your server.
Necessary when they are set
Wordfence’s cookies protect logins and the site. Cookie Rocks suggests its firewall cookie as necessary in your cookie list, and you confirm the category.
reCAPTCHA at login and checkout
With reCAPTCHA on in Wordfence Login Security and its WooCommerce integration, reCAPTCHA also runs on your shop’s login and checkout. A captcha that waits for consent there may stop customers from logging in or paying: test those pages, or keep that integration off.
Live Traffic and your page cache
In its All traffic mode, Live Traffic adds a script with a visit ID to each page. Wordfence advises keeping its wordfence_lh call out of the page cache.
If a rule blocks the banner file
When a security rule blocks the file with the banner texts, the free Audit warns you and offers one button to write the texts into the pages, so the banner still shows.
Cookie Rocks with Wordfence
- Recognises its own cookies, with a suggested category and a plain description.
What our tests found on Wordfence
Good to knowCookie Rocks lists Wordfence, Forminator, WP WhatsApp and WPForms Pro cookies
- Each appears in its cookie list with its purpose.
- Wordfence: wfCBLBypass, wf_loginalerted_*, wfls-remembered-*.
- Forminator: poll-cookie-*, forminator_stripe_payment_owner.
- WP WhatsApp: nta-wa-gdpr. WPForms Pro: _wpfuuid.
Read in its code, 18 October 2026.
Full detail
Cookie Rocks lists the site cookies of Wordfence (wfCBLBypass, wf_loginalerted_*, wfls-remembered-*), Forminator (poll-cookie-*, forminator_stripe_payment_owner), WP WhatsApp (nta-wa-gdpr) and WPForms Pro (_wpfuuid) in the cookie list it writes, with their purpose.
Good to know · Yoast SEO, Rank Math SEO, All in One SEO, Wordfence, Really Simple SSL, WP Armour, AkismetSeven SEO and security plugins set nothing for visitors by default
by default: Default settings
Yoast SEO, Rank Math, All in One SEO, Wordfence, Really Simple SSL, WP Armour and Akismet set no cookie, use no storage and load no known third-party tool.
Seen in our tests, 17 October 2026, Yoast SEO, Rank Math SEO, All in One SEO, Wordfence, Really Simple SSL, WP Armour, Akismet 28.7, 1.0.280, 5.0.3, 9.0.2, 9.8.3, 2.4.02, 5.7.2. Source
Full detail
On a fresh WordPress home page with default settings, Yoast SEO, Rank Math SEO, All in One SEO, Wordfence, Really Simple SSL, WP Armour and Akismet set no cookie for the visitor, keep nothing in the browser's storage and load no known third-party tool, after Accept all.
Depends on a setting · Wordfence SecurityWordfence Live Traffic and CAPTCHA load scripts only when turned on
setting “Traffic logging mode” · by default: Security-related traffic only
With Live Traffic on All traffic, a site script loads at the first visitor action; a cached page would share one visit ID. reCAPTCHA v3 loads only on login and registration pages.
Read in its code, 16 October 2026, Wordfence Security 9.0.2.
Full detail
With Live Traffic set to All traffic (off by default), Wordfence adds an inline script to public pages that, at the visitor's first mouse, key or scroll action, loads a script from the site itself (/?wordfence_lh=1&hid=<encrypted visit id>); it sets no cookie, and a cached page would serve the same visit ID to everyone. Wordfence loads Google reCAPTCHA v3 only on the login and registration pages (and WooCommerce login or checkout with that integration), and only when its CAPTCHA option is on (off by default).
Good to know · Wordfence SecurityWordfence sets no cookie and no storage for anonymous visitors
No third-party tool on visitor pages either, in a test with 9.0.2 and in its code. Its cookies are for users who log in, two-factor and the country-blocking bypass. No WP Consent API.
Seen in our tests, 15 October 2026, Wordfence Security 9.0.2.
Full detail
Wordfence sets no cookie and no browser storage for anonymous visitors with default settings, and adds no third-party tool to visitor pages: a WordPress test with Wordfence 9.0.2 observed none, matching its code. Its only cookies are wfwaf-authcookie-<host hash> (12 hours, users who can log in), wf_loginalerted_<hmac> (1 year, at login, with the new-device alert), wfCBLBypass (1 year, country-blocking bypass link) and wfls-remembered-<id> (30 days, two-factor remember). The older wfvt_ and wordfence_verifiedHuman cookies no longer exist in its code. It does not use WP Consent API.
How we test it
Around each version, with its latest release
Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.
- Wordfence Security 9.0.2, tested on 7 November 2026.
- The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
- Settings of the test: Default settings after activation.
- Last run: Wordfence Security 9.0.2 on 7 November 2026, with WordPress 7.1.3.
Security
Other plugins of the same kind.
Questions
Do Wordfence cookies need consent?
They are set for security and logins, not for tracking. Cookie Rocks suggests the firewall cookie as necessary, and you confirm the category in your cookie list. The others are set only for users who log in.
Does Wordfence still use cookies to tell humans from bots?
No. Wordfence has told humans from bots without cookies for years. The older cookies for that are no longer set.
Is Wordfence tested with Cookie Rocks?
Yes, automatically with its latest version, on a real WordPress install. The compatibility table shows the version.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For Wordfence sites
Security cookies, filed where they belong.
wordfence stays on
Every feature of the complete plugin for 30 days, no card. Wordfence keeps protecting your site as it does today.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.