AI WordPress security triage with Wordfence

By Andrew Ivanov · Last updated 2026-07-22

What does this skill do?

The security triage skill is a SKILL.md file that has an AI agent investigate a Cowboy MCP site through Wordfence — run a scan, review the findings, and study login and traffic activity — then hand you an evidence-backed action list, proposing IP blocks for you to approve rather than applying them itself. It is a read-and-recommend routine, not an auto-remediation one.

That framing is the whole point. AI WordPress security triage is valuable precisely because the model can sift a scan report and a wall of login attempts faster than a person can — but blocking the wrong IP or ignoring a real finding has consequences, so the decision stays with a human. The skill draws that line explicitly: it may scan, list, and summarize, but it must present its proposed blocks and wait for you to say yes before it calls the tool that enforces them.

The result is a triage report you can act on in minutes: what the scan found ranked by severity, which IPs are hammering your login form and with what evidence, and a short list of recommended actions clearly marked as awaiting your approval. Nothing on the site changes during a run — no finding is resolved, no setting is touched, no address is blocked — until you decide it should.

Which Cowboy MCP tools does it use?

The skill runs almost entirely on Wordfence's read-only tools, with the one enforcement tool held back until you approve. Every name below is a real Cowboy MCP tool, available whenever Wordfence is active on the site; Cowboy MCP exposes 17 Wordfence tools in total, and this skill uses the triage-focused subset.

Tool	What it does
`wp_wordfence_firewall_status`	Confirms Wordfence is active and reads firewall mode, WAF, and brute-force status
`wp_wordfence_start_scan`	Triggers an asynchronous Wordfence security scan
`wp_wordfence_get_scan_status`	Polls scan progress and the last scan's results
`wp_wordfence_list_scan_issues`	Lists scan findings, filterable by status, type, or severity
`wp_wordfence_get_login_attempts`	Reviews login history and repeated failed-login patterns
`wp_wordfence_get_live_traffic`	Inspects recent traffic hits for suspicious requests
`wp_wordfence_get_activity_report`	Summarizes top blocked IPs, countries, failed logins, and attack counts
`wp_wordfence_block_ip`	Blocks an IP — the agent proposes it, and calls this only after you approve

The wp_wordfence_block_ip tool has self-lockout prevention built in, but the skill still treats every block as a decision for you to make, and every call it does make lands in the audit log.

How do I run it?

Ask for a triage and let the agent do the reading. It scans, reviews the findings and the login and traffic history, and comes back with a summary plus a proposed action list — without changing anything. You then decide which proposals to accept. Three prompts that work:

"Run a security triage on my site with Wordfence and give me an action list — don't block anything or resolve any findings yet."
"Start a Wordfence scan, review the findings and failed logins, and propose which IPs I should block, with the evidence for each."
"Show me this week's attack activity and suspicious login attempts, then tell me what you'd recommend I do about it."

Because the skill is read-and-propose, you can run it as often as you like with no risk of an unwanted change. When you approve a block, the agent calls wp_wordfence_block_ip for the specific address; until then it only reports. Note that country-level blocking requires Wordfence Premium, so on a free install the recommendations will centre on individual IPs and findings.

How do I install the skill?

A skill is a folder holding one SKILL.md file, so installing it means downloading that file and saving it into your agent's skills directory — no build step, no dependencies, and no configuration to edit. Where the folder lives decides the skill's reach, so choose project-level to scope it to one repository or global to load it everywhere:

Download SKILL.md — the exact file embedded below.
Project-level: save it as .claude/skills/wordpress-security-triage/SKILL.md in the project you work in.
Global: save it under ~/.claude/skills/wordpress-security-triage/SKILL.md to make it available in every session on your machine.

Keep the folder name (wordpress-security-triage) matching the name field in the file's frontmatter. The skill needs Wordfence installed and active on the target site to do anything. Start a new session, ask for a security triage, and the agent will match the skill by its description. The full file is below; the download link above serves this exact text.

---
name: wordpress-security-triage
description: Use when asked to triage the security of a WordPress site connected via Cowboy MCP that runs Wordfence — starts a scan, reviews findings and login activity, and proposes IP blocks for a human to approve rather than applying anything automatically.
---

# WordPress security triage

Investigate a site's security posture through Wordfence and hand the owner a clear, evidence-backed action list. This skill only reads and proposes. It never resolves a scan issue, changes a firewall setting, or blocks an IP without the owner's explicit approval.

## Before you start

1. Confirm Wordfence is active and reachable: call `wp_wordfence_firewall_status` and note the firewall mode, WAF status, and brute-force protection.
2. If the firewall tools return nothing, Wordfence is not installed or active — stop and tell the owner; the rest of this skill needs it.

## Steps

1. **Run a scan.** Call `wp_wordfence_start_scan`, then poll `wp_wordfence_get_scan_status` (read-only) until the scan reports complete.
2. **Review findings.** Call `wp_wordfence_list_scan_issues` (read-only), filtered to new issues. Summarize them by severity. Do **not** call `wp_wordfence_resolve_scan_issue` — resolving or ignoring a finding is the owner's decision.
3. **Login activity.** Call `wp_wordfence_get_login_attempts` (read-only). Look for repeated failed logins and invalid-username attempts concentrated on single IPs.
4. **Live traffic.** Call `wp_wordfence_get_live_traffic` (read-only) and note suspicious recent hits — unusual paths, high request rates, blocked requests.
5. **Activity summary.** Call `wp_wordfence_get_activity_report` (read-only) for the top blocked IPs, countries, failed logins, and attack counts.
6. **Propose, do not apply.** Assemble a list of candidate IPs to block, each with the evidence behind it. The tool to block an IP is `wp_wordfence_block_ip`, but do not call it until the owner approves the specific IP. Present the list and wait.

## Notes

- Every tool in this skill needs Wordfence installed and active; without it the scan and firewall calls return nothing.
- A scan is safe to run at any time — it reads the filesystem and database and changes nothing.
- Country blocking (`wp_wordfence_block_country`) requires Wordfence Premium. Mention it as an option if the login data points to one region, but do not attempt it on a free install.

## Report format

Summarize back to the site owner:
- Scan result: counts by severity, and the most serious findings named individually.
- Login and traffic patterns: notable IPs, usernames targeted, and attack volume, each with the evidence.
- A proposed action list — "block these IPs", "investigate these findings" — clearly marked **awaiting your approval**.
- An explicit statement that nothing was changed: no issue was resolved, no IP was blocked, no setting was altered. Blocking, when approved, runs through `wp_wordfence_block_ip` (which has self-lockout prevention built in).