If you have been through your WordPress database looking for whatever is eating your disk quota, there is a good chance you landed on a table called wp_wffilemods. It is usually one of the largest tables on a Wordfence site, and unlike most large tables it is not storing anything your visitors will ever see.
What Is the wp_wffilemods Table?
wp_wffilemods is created by the Wordfence Security plugin. It stores the record of file changes Wordfence detects when it scans your site.
Wordfence scans your WordPress files looking for changes, anomalies, and potentially malicious code. Every file it checks produces a record here, which gives you a log an administrator can review for unauthorised or unexpected modifications. That log is genuinely useful during an incident. It is also why the table grows.
You will see the name written a few different ways. Wordfence creates it in camel case as wp_wfFileMods, phpMyAdmin and most hosting panels display it as wp_wffilemods, and the table prefix is whatever your install uses rather than always being wp_. On Linux servers MySQL table names are case sensitive, so use the camel case form in any query you run directly.
Why Your wp_wffilemods Table Is So Large
The size of this table tracks one thing above all others: how many files Wordfence is scanning. It is not a bug, a leak, or a sign of infection. A site with a lot of files simply produces a lot of file records.
A few scan settings widen that file count considerably:
- Scan files outside your WordPress installation broadens the scan to every subdirectory, including things that are not WordPress at all. Wordfence notes this can make scans take significantly longer.
- Scan images, binary, and other files as if they were executable pulls your entire uploads directory into scope.
- Large backup archives, cache directories and staging copies sitting inside the web root get scanned like anything else.
How to Reduce the Size of wp_wffilemods
Truncating the table gets the space back today. Narrowing the scan is what stops it coming back. Do the second one first, or you will be repeating this in a month. All of these live under Wordfence, then Scan, then Scan Options.
- Open Exclude files from scan that match these wildcard patterns and add the directories that have no business being scanned. Wordfence supports wildcards, so a pattern like
wp-content/uploads/*excludes everything in uploads. Backup folders and cache directories are the usual wins. - Turn off Scan files outside your WordPress installation unless you specifically need it. If you have a phpMyAdmin or old Drupal folder alongside WordPress, this option is scanning all of it.
- Turn off Scan images, binary, and other files as if they were executable unless you are actively cleaning an infection. On a media heavy site this alone can be most of the table.
- If scans are also straining the server, enable Use low-resource scanning. It is off by default and spreads the work out, at the cost of scans taking two to four times longer.
- Back up the database, then truncate the table to reclaim the space. Wordfence rebuilds what it needs on the next scan.
One caveat on exclusions. Wordfence points out that if your host modifies core WordPress files, you cannot exclude those with this option. In that case disable Scan core files against repository versions for changes or use the Ignore action on individual scan results instead. Full detail is in the Wordfence scan options documentation.
| Scan option | Effect on wp_wffilemods |
|---|---|
| Exclude files from scan that match these wildcard patterns | Removes whole directories from scanning. The most direct lever. Use patterns like wp-content/uploads/*. |
| Scan files outside your WordPress installation | Adds every subdirectory, WordPress or not. Usually the single biggest expander of this table. |
| Scan images, binary, and other files as if they were executable | Pulls your entire uploads directory into scope. On a media heavy site this can be most of the table. |
| Scan core files against repository versions for changes | Turn off when your host manages core files and exclusions cannot cover them. |
| Use low-resource scanning | No effect on table size. Reduces server load, at the cost of scans taking two to four times longer. |
Can You Empty the wffilemods Table?
Yes, with two things worth understanding first.
- You lose the history. The table is a record of file modifications over time. Clearing it removes data that would be useful during an audit or a security investigation.
- You do not lose protection. This is a log, not a configuration store. Wordfence keeps its settings elsewhere, and the firewall and scanner keep working exactly as before.
So the honest answer is that emptying it is safe for the site and costly for your audit trail. If you are not mid-incident and you need the disk space, take a backup and clear it. If you are investigating something, leave it alone.
If the table is locked or unresponsive rather than merely large, that is a hosting level problem rather than a Wordfence setting, and your host will need to look at it.
Database maintenance like this is the kind of thing that quietly slips until a site slows down. It is part of what we handle under a maintenance plan, and it is part of what we cover under managed WordPress hosting.
Not sure which table is your problem? Start with how to find the one table slowing your WordPress database, which covers all of them and the question to ask before deleting anything.
WP wffilemods FAQs
Below, we delve into the most frequently asked questions about wffilemods, its role, and its significance in ensuring a secure WordPress experience. This comprehensive FAQ aims to provide clear, detailed information to answer your queries and concerns.
What is wffilemods?
The “wffilemods” table is a part of the Wordfence Security plugin used in WordPress installations. This database table is designed to log file changes within your WordPress setup, functioning as an essential component in the suite of security measures provided by Wordfence.
Why is wffilemods Important for Security?
The primary function of the “wffilemods” table is to monitor and record modifications to files in your WordPress environment. This serves as a critical layer of security, helping administrators identify unauthorized or suspicious activities that may compromise the integrity of the website. This data is invaluable for auditing, investigations, and ensuring overall cybersecurity.
Can I Empty the wffilemods Table?
It is technically possible to empty the “wffilemods” table. However, doing so comes with various implications, such as the loss of historical data that might be crucial for audits and potentially hindering the plugin’s ability to scan efficiently during its next operation.
What Happens If I Empty the wffilemods Table?
Emptying this table could result in several outcomes: 1) Loss of historical file modification data, which may be required for audits or security investigations, 2) an increase in the time taken for subsequent scans, as Wordfence would need to rebuild the table from scratch, and 3) Potential impact on the functionality of the Wordfence plugin.
How Does wffilemods Impact Database Performance?
Unless the “wffilemods” table has grown exceptionally large, it generally does not significantly impact database performance. However, if you notice performance issues, consult the official Wordfence documentation or support channels for guidance on managing the table’s size.
Is It Safe to Delete Data from wffilemods?
While it’s possible to delete data from the “wffilemods” table, doing so is not generally recommended due to the potential consequences on security monitoring and functionality. If you decide to proceed, ensure you have taken all necessary precautions, including comprehensive backups.
Do I Need to Backup Before Making Changes to wffilemods?
ABSOLUTELY! Before making any changes to your database, taking a comprehensive backup is strongly advised to ensure you can restore the database in the event of any adverse effects.
How Can I Consult Wordfence Support About wffilemods?
If you have concerns or questions about the “wffilemods” table, it would be prudent to consult Wordfence’s official documentation or support channels. These resources are designed to provide expert guidance and can offer insights into managing the table effectively.
By understanding the role and significance of the “wffilemods” table in your WordPress database, you can make more informed decisions related to your website’s security and overall website performance. Always remember to consult experts or trusted documentation when in doubt AND BACKUP YOUR DATABASE.
Auditing the rest of your Wordfence tables? The Live Traffic log is usually the larger offender. See what the wp_wfHits table is and how to shrink it safely, and if you run Yoast, what the wp_yoast_indexable table is and why not to truncate it. Running WooCommerce? the wp_actionscheduler_actions table is usually larger than any of them.
