# compare

WPSniffer vs Wordfence CLI

Updated October 2026

Wordfence CLI was the best-known command-line malware scanner for WordPress. Its README now states that it is no longer available for new Free or Premium licenses, that the Free version reached end-of-life on October 14, 2026, and that Premium licenses will not be renewed. WPSniffer is an open alternative with a deliberately familiar command line.

Details about the other tool come from its public documentation and repository as of October 2026. If something is out of date, open an issue and it will be corrected.

At a glance

	WPSniffer	Wordfence CLI
License	GPLv3	GPLv3 (code); signatures under a separate Wordfence license
Cost	Free, no tiers	No new Free or Premium licenses issued; Free end-of-life October 14, 2026
License key or account	✗ None	✓ Required for malware signatures
Detection source	YARA Forge community rules (about 5,000 in core), plus your own YARA rules	Wordfence proprietary signature feed
Rules readable	✓ Every rule is plain-text YARA	✗ Signatures are not published
Engine	YARA-X	Wordfence's own PCRE-based matcher (needs libpcre 8.38+)
Language, runtime	Python 3.8+	Python 3.8+
Malware scan	✓	✓
Vulnerability scan of plugin versions	✗ Not included	✓ `vuln-scan`
Custom rules	✓ `--rules`	✗
Output formats	CSV, TSV, line- and null-delimited, human-readable, email summary	CSV, TSV, null-delimited
Output columns	filename, signature_id, signature_description, rule_score, rule_author, rule_reference, matched_text	filename, signature_id, signature_name, signature_description, matched_text
Reads paths from stdin	✓	✓
Multi-process	✓ `-j`	✓
Telemetry	✗ None; only downloads rules from GitHub	Contacts Wordfence servers for signatures and licensing

What changed with Wordfence CLI

Wordfence CLI's source has always been GPLv3, but the malware signatures it scans with are a separate, licensed feed. That is why it needed a license key even on the free tier. According to the project README as of October 2026, Wordfence CLI is "no longer available for new Free or Premium licenses", existing Free licenses "will cease to be valid" on October 14, 2026, and Premium licenses "will not be renewed after expiration". In practice, the open-source code remains but the signatures that made it useful are no longer obtainable for new users.

If you built scheduled scans, hosting-panel integrations or incident playbooks around wordfence malware-scan, you need a replacement scanner that can be installed on a server without an account.

The same command shape

WPSniffer's command line was designed so that Wordfence CLI users do not have to relearn anything. The main subcommand is malware-scan, it takes paths on the command line or from stdin, and it uses --output-path, --output-columns and --match-all the way you expect. Most scripts need only the binary name changed:

$ wordfence malware-scan --output-path report.csv --output-columns filename,signature_id,matched_text /var/www
$ wpsniffer malware-scan --output-path report.csv --output-columns filename,signature_id,matched_text /var/www

Differences to be aware of when migrating:

There is no license step. Remove any --license or configuration-file key from scripts.
The signature_name column does not exist; use signature_id (the YARA rule name) and signature_description. WPSniffer adds rule_score, rule_author and rule_reference.
Rule names differ, so any allow-lists of signature IDs must be rebuilt. Use -e RULE_NAME to exclude noisy YARA rules.
There is no vuln-scan. For plugin vulnerability checks use wp plugin list against a vulnerability database, or a dedicated tool.

Detection: proprietary feed vs open rules

Wordfence's signatures came from its own research team and were tuned for WordPress specifically. YARA Forge rules come from many researchers, cover PHP webshells, backdoors, obfuscators and known malware families, and are tested and scored before release. Two consequences matter in practice.

You can read every rule. When WPSniffer flags a file, the report names the rule, its author and a reference, and the rule text itself is on disk. You can judge a hit, tune or exclude the rule, and write your own for malware you see on your servers. Closed signatures give you a name and nothing more.

Noise is yours to manage. A single-vendor feed is curated for one product; a community collection is broader and some rules are generic. WPSniffer's default core package is the low-noise tier, and -e excludes anything that fires on your legitimate code. See handling false positives.

When to choose which

You need a scanner you can install today without an account: WPSniffer.
You still hold an active Wordfence CLI Premium license and need its vulnerability scanning: keep using it until the term ends, and run WPSniffer alongside so the switch is already in place.
You run many servers or a hosting platform: WPSniffer, because per-server licensing and key management are gone, and rules can be pinned or vendored for reproducible fleet-wide scans.
You need a WordPress plugin with a firewall and login protection: neither tool. Both are file scanners; the Wordfence plugin remains a separate product.

Install WPSniffer → All comparisons