Previously the WordPress site was unmanaged for a very long time there were a number of spammy posts which probably got hacked into like these : (When I looked in the dashboard there were some spammy posts to be published soon)
Those dashboard numbers are the firewall doing its job. The vast majority of “blocked attacks” are bots probing every WordPress install on the internet with the same handful of exploits — the count will keep climbing whether you run Free or Pro. So don’t read the graph as a reason to upgrade.
Where the upgrade does actually matter for your specific situation:
Real-time threat feed. Free gets new firewall rules and malware signatures on a delay (new rules can lag by ~30 days); Pro gets them immediately. For a site that was already hit, that’s the difference between catching a freshly-seeded backdoor on day one versus a month later.
Country blocking. A lot of the gambling/spam traffic you’re seeing comes from a few regions. Blocking those countries outright can cut the noise dramatically.
Premium support. Pro gets you Wordfence’s paid support queue, which is genuinely useful when you’re staring at a compromised site and want a human to walk you through cleanup.
The honest caveat: upgrading alone won’t remove those junk posts. No plugin deletes content automatically in Free or Pro. The remediation is manual, and it’s what matters most right now:
Trash, then permanently delete, those spam posts (including any still in drafts/pending).
These spam injection schemes usually reschedule themselves, so check Settings → WP-Cron / scheduled events or a plugin like WP Crontrol for tasks that recreate posts, and purge them.
Reset every admin password, remove any users you don’t recognise, and enable two-factor auth (Wordfence’s 2FA is free).
Update WP core, every plugin, and the theme. Delete plugins/themes you don’t actually use.
Run a full Wordfence scan. Backdoors for this kind of spam often hide in wp-content/uploads as PHP files or in a lookalike mu-plugins entry.
Realistically, the $149 is worth it if the site has ongoing value (traffic, revenue) and you want real-time rules plus hand-holding through the cleanup. But the fix for those spammy posts is effort on your end, not money.
If you’re getting into WordPress security properly, a couple of useful reads in the SitePoint Premium library:
Those high block counts are normal on any public WordPress site. Free already stops most of that junk.
Pro is mainly for faster rule updates and country blocking. It will not clean the spam posts for you. Delete those posts for good, check scheduled tasks, reset passwords, and run a full scan. If the site is just a personal blog, Free is enough after you clean it. If it makes money, Pro can be worth it for the faster updates.
