Moving from Wordfence to Segurium

What the importer reads

Open the Migration tab and it shows you a preview before it writes anything. Every row below is something the preview will count, so you can see the numbers against your own site rather than trusting this page.

• Scan exclusion patterns. The list you built up over the years so your backup folder and your log directory stop showing up in every report. Merged into the Segurium exclusion field and deduplicated, so anything already there survives.
• Blocked countries. Read straight out of the Wordfence block table and unioned with any you already set here. Country blocking switches itself on when this row applies, in block mode. That is covered again below, because a filter that turns itself on deserves two mentions rather than none.
• Blocked IP addresses. The ones you blocked by hand, and only the ones still in force. An entry whose expiry has passed is skipped. Merged with your existing rules. IPv4 addresses that Wordfence stored in its IPv6 form are unwrapped back to the address you typed.
• Two-factor users, with their secrets. Every user set up with an authenticator app moves across with the secret intact, so nobody re-scans a QR code and nobody gets locked out at the next login. Their Wordfence recovery codes arrive as Segurium backup codes. Anyone who already has Segurium two-factor is left exactly as they are.

Read from the shipped adapter on 19 August 2026. Coverage differs per source plugin, so do not assume the same list applies to a different one.

What it does not read

Two rows, and the Migration tab labels both of them for you rather than quietly leaving them out.

• Brute-force settings. Your lockout thresholds, your lockout duration, your strong-password rules. None of it comes across. You set them again under Segurium's login protection, which takes about a minute once you know the numbers you had. Write them down before you deactivate Wordfence.
• Firewall rules. Not imported, and they would not translate. Wordfence can load before WordPress starts, so its rules describe requests your site never executes. Segurium filters inside WordPress with IP and CIDR rules plus a country filter. The overlap is real and the rule format is not.

Everything else in your Wordfence configuration is either something Segurium has no equivalent for, or something you configure here anyway. The gaps between the two products are set out in full on the Wordfence comparison, and you should read that part before you deactivate anything.

What changes on your site the moment you apply

Importing is not passive. Two of the four rows turn a feature on, and both are worth knowing before you click rather than after.

• If any blocked IP addresses come across and the firewall was off, it switches on in deny-list mode. Your imported addresses are the deny list. Nothing else is blocked.
• If any blocked countries come across and country filtering was off, it switches on in block mode. The countries you had blocked in Wordfence are blocked here.
• Scan exclusions and two-factor users change no setting. They add entries to a list and to user accounts.

If you are unsure about the country filter, check the list before you leave the tab. Blocking the country you are sitting in is the one mistake that costs you an afternoon, and the country screen carries a confirm step for exactly that reason.

Step by step

1. Write down your Wordfence brute-force numbers. Lockout after how many failures, for how long. They are the one thing you cannot recover after the plugin is gone.
2. Install Segurium from WordPress.org. Leave Wordfence active for now.
3. Accept the service disclosure on the plugin page. Nothing contacts our service and nothing scans until you do.
4. Open the Migration tab. Wordfence appears with a count of what it found. Click Preview.
5. Read the preview. It lists every row, the number of items in each, and which rows are not coming. Apply it when the numbers look like your site.
6. Check the country list and the IP list. Both are editable fields and this is the moment to prune anything you no longer want.
7. Set your brute-force thresholds again from the numbers in step one.
8. Run a full scan and an integrity scan. The first scan is the slow one, because nothing is cached yet.
9. Decide about Wordfence. Deactivate it, or keep it for the firewall with its scanner switched off. Running both scanners walks every file twice for no extra coverage.

Four things to check afterwards

• Log out and back in. If you had two-factor on your own account, this is the check that matters. Your authenticator code should be accepted as it always was. Do it while you still have a second admin session open in another browser.
• Look at the exclusion list. Wordfence exclusions and Segurium exclusions use the same shape of pattern, and a rule you wrote for a path that no longer exists is worth deleting rather than carrying forward.
• Read the first scan report properly. A second opinion on a site that was quiet for years does turn things up, and the first report is the one worth reading line by line. The free plan cleans 3 files every 30 days, and restoring a modified core, plugin or theme file to its upstream content does not count against that at all.
• Confirm the country filter is doing what you meant. Load the site through a proxy in a blocked country if you have one to hand, or at minimum read the list back.

Should you keep Wordfence?

For a lot of sites, yes, and it costs nothing. Wordfence Free can load before WordPress does, which is a layer Segurium does not have and is not trying to replace. Keeping it in front for the firewall while Segurium handles detection and cleanup gives you both layers for no money.

The one thing to fix in that arrangement is duplicate scanning. Two malware scanners walking the same tree doubles the disk work and gives you two reports to reconcile. Turn one of them off. Which one depends on whether you would rather have a scanner that repairs a file by overwriting it from WordPress.org, or one that cleans the injection out of a file that never came from there.

If you are only here for the price, deactivating Wordfence is fine too. Detection here is identical on the free and paid plans, so a free install sees every verdict a paid install sees.

If you change your mind

There is no undo button on the import, and pretending otherwise would be the wrong thing to write on a page about touching your own configuration. What is true is narrower and more useful: the import only adds to lists. It writes exclusion patterns, IP entries, country codes and two-factor records, and every one of those is a field you can open and edit back down. It removes nothing, it touches no file, and it changes no post.

Reinstalling Wordfence later finds its own tables where it left them. Nothing in this process deletes them.

Questions

Do my users have to set up two-factor again?

No, if they were using an authenticator app. The importer moves the TOTP secret itself, so the entry already in Google Authenticator or 1Password keeps producing valid codes. Wordfence recovery codes come across as Segurium backup codes. A user who somehow already has Segurium two-factor is skipped rather than overwritten.

I already deleted Wordfence. Is it too late?

Probably not. Detection looks for the data, not for an active plugin, so it finds an orphaned wfConfig table left behind by an uninstall. Deleting a plugin from the Plugins screen does not drop its tables unless the plugin chose to. Open the Migration tab and see what it reports.

Will importing overwrite the rules I already set up?

No. Every list is merged and deduplicated. Your existing scan exclusions keep their lines, your existing IP rules keep their entries, and the imported ones are added alongside. There is no replace mode.

What happens to my Wordfence firewall rules?

Nothing. They are not imported, and they would not mean the same thing here anyway. Wordfence can load before WordPress starts and drop a request outright. Segurium filters inside WordPress, after PHP has already accepted the request. Same intent, one layer later, different rule format.

Can I run both for a while?

Yes, and it is a reasonable way to switch. Keep Wordfence Free in front for its firewall, run Segurium behind it for detection and cleanup, and turn off one of the two malware scanners so the same files are not walked twice.

Can I undo the import?

There is no undo button. What there is instead: the import only ever adds to a list, and every list it writes to is an editable field you can open and prune. Nothing it touches deletes a file or changes a post.