---
name: wordpress-security-triage
description: Use when asked to triage the security of a WordPress site connected via Cowboy MCP that runs Wordfence — starts a scan, reviews findings and login activity, and proposes IP blocks for a human to approve rather than applying anything automatically.
---

# WordPress security triage

Investigate a site's security posture through Wordfence and hand the owner a clear, evidence-backed action list. This skill only reads and proposes. It never resolves a scan issue, changes a firewall setting, or blocks an IP without the owner's explicit approval.

## Before you start

1. Confirm Wordfence is active and reachable: call `wp_wordfence_firewall_status` and note the firewall mode, WAF status, and brute-force protection.
2. If the firewall tools return nothing, Wordfence is not installed or active — stop and tell the owner; the rest of this skill needs it.

## Steps

1. **Run a scan.** Call `wp_wordfence_start_scan`, then poll `wp_wordfence_get_scan_status` (read-only) until the scan reports complete.
2. **Review findings.** Call `wp_wordfence_list_scan_issues` (read-only), filtered to new issues. Summarize them by severity. Do **not** call `wp_wordfence_resolve_scan_issue` — resolving or ignoring a finding is the owner's decision.
3. **Login activity.** Call `wp_wordfence_get_login_attempts` (read-only). Look for repeated failed logins and invalid-username attempts concentrated on single IPs.
4. **Live traffic.** Call `wp_wordfence_get_live_traffic` (read-only) and note suspicious recent hits — unusual paths, high request rates, blocked requests.
5. **Activity summary.** Call `wp_wordfence_get_activity_report` (read-only) for the top blocked IPs, countries, failed logins, and attack counts.
6. **Propose, do not apply.** Assemble a list of candidate IPs to block, each with the evidence behind it. The tool to block an IP is `wp_wordfence_block_ip`, but do not call it until the owner approves the specific IP. Present the list and wait.

## Notes

- Every tool in this skill needs Wordfence installed and active; without it the scan and firewall calls return nothing.
- A scan is safe to run at any time — it reads the filesystem and database and changes nothing.
- Country blocking (`wp_wordfence_block_country`) requires Wordfence Premium. Mention it as an option if the login data points to one region, but do not attempt it on a free install.

## Report format

Summarize back to the site owner:
- Scan result: counts by severity, and the most serious findings named individually.
- Login and traffic patterns: notable IPs, usernames targeted, and attack volume, each with the evidence.
- A proposed action list — "block these IPs", "investigate these findings" — clearly marked **awaiting your approval**.
- An explicit statement that nothing was changed: no issue was resolved, no IP was blocked, no setting was altered. Blocking, when approved, runs through `wp_wordfence_block_ip` (which has self-lockout prevention built in).