What’s new in PowerSEC

Choosing Delete on a malware finding now moves the file to quarantine and then removes it from your site, and the dialog shows the result. Previously the delete could fail without telling you.

You can now ask our team to maintain your WordPress site: updates applied after a fresh backup, security monitoring, off-site backups, uptime checks and a monthly report. There are three monthly plans and a custom quote for larger sites — see powersec.io/wordpress-care-plans. Requests you send from our Get Help page now also get an email confirmation with a reference number.

PHP released an emergency security update on 21 October 2026. If one of your sites reports a PHP version below that fix — or a version the PHP project no longer supports — you now get a single email listing those sites and the release to move to.

PHP is set by your hosting provider, usually in the hosting control panel, and most hosts can change it in a few minutes. If you have already updated, there is nothing to do: the version shown refreshes on your site's next sync.

The PowerSEC command-line tool can start malware scans again: psec scan run <site> starts a scan, and --wait follows it until it finishes. psec scan status now shows the last scan's result, psec alerts list --status filters open and resolved alerts, and --site accepts a domain as well as a site ID. The install-token commands are removed; add new sites from the WordPress plugin or the dashboard. Update with npm install -g @powersec/cli.

Two-factor login now works on sites using Jetpack's WordPress.com login, and from WooCommerce My Account and Theme My Login forms. The firewall's block mode no longer blocks WooCommerce shoppers, two-factor codes are sent on sites using FluentSMTP, and command-line tools are no longer stopped by bot protection.

A malware scan you start is now always recorded. If your server is busy, the scan waits and starts on its own when the load drops, instead of showing "Your server is busy" and doing nothing. The busy check also takes the number of processor cores into account, so scans on larger shared servers are no longer held back.

The malware scanner reported some unmodified files from popular plugins — including WooCommerce — as threats, which could show a site as critical and send repeated alerts. Version 1.4.232 corrects this while keeping every real detection in place. If your site showed a critical malware finding for plugin files you never changed, update the plugin (WordPress will offer 1.4.232 automatically) and run a scan; the finding and its alerts clear on completion.

Plugin 1.4.231 is available on WordPress.org and from your dashboard. The firewall now inspects large request bodies in full, so a suspicious payload hidden deep inside an oversized JSON or XML request is caught the same way a small one is; requests it cannot fully inspect are counted in your site's firewall statistics rather than passing silently. Notification credentials you enter in the plugin (Slack, Discord, webhook, Splunk, Datadog and PagerDuty) now stay on your site and are never included in the settings PowerSEC reads from it. Sites that disable plugin, theme and core file changes in wp-config.php are now respected by remote updates from the dashboard, which report the setting instead of attempting the update. Update the plugin from the WordPress Plugins screen or Central to receive these changes.

When an automated scanner sends many blocked requests to your site in a short period, PowerSEC now sends one firewall notification per site every few hours instead of one for every blocked request. Blocking itself is unchanged: every request is still stopped and still recorded in your site's audit log; only the notification volume is reduced.

PowerSEC no longer changes how WordPress installs its own core updates. On a site's auto-update panel the core tab now simply shows what your site is set to, and points you at WordPress's own controls; the per-plugin and per-theme auto-update switches are unchanged and still work on every plan.

The firewall also now reads your site's own admin, login and REST addresses from WordPress rather than assuming the standard layout, so its built-in exceptions — the ones that stop normal editor, settings and scheduled-task traffic being flagged — apply correctly on sites that keep WordPress in a subdirectory.

Background maintenance now runs reliably across restarts and deploys. Connections from PowerSEC to your site follow stricter rules, and messages a site relays through PowerSEC are limited to plain formatting. Changing your password now signs out every other device. Vulnerability scans and database cleanup can be started from the dashboard on every plan, matching what the plugin already does locally, and the pricing page now reflects which capabilities are included free. Scan results from sites behind a firewall are recorded correctly.

Plugin update 1.4.226. File-integrity data is no longer loaded on every page view, and long scans on very large sites no longer skip files after a pause. The REST API and emergency-lockdown exemptions for PowerSEC’s own connection now match only its real endpoints. Scan results from sites behind a firewall are no longer reported as recorded when they were not. Update from your WordPress plugins screen or from the dashboard download link.

Critical security alerts — including malware and webshell findings — now remain on your dashboard until the underlying condition is genuinely resolved.

Routine notices about events PowerSEC already handled for you, such as a blocked IP address or a locked-out login attempt, now clear on their own instead of accumulating.

Your site page also shows when advanced firewall rules are set to watch rather than block, so you can tell at a glance whether they are enforcing. And when AI review is waiting on your site’s approval, the AI panel now says so and points you to where to give it.

Vulnerability scanning now runs on every plan. Once a day, PowerSEC checks your plugins, themes and WordPress version against current vulnerability data and tells you what needs attention. Paid plans add more frequent automatic re-checks, so newly published vulnerabilities surface sooner.

Results show what was checked and when, and a check that cannot complete says so instead of reporting a clean result.

Full backups now complete reliably on sites with very large databases and use far less server memory while running. Backups are also smaller, and leftover records from old backups are tidied up automatically.

You can now pause scheduled backups for a set time (24 hours to 30 days) or stop them entirely from a site's Backups page. Pausing takes one click and resumes automatically. Stopping is deliberately harder: you confirm in the dashboard, confirm again from a link we email you, and even then backups keep running for 24 hours so one click can cancel the change. Your existing backups are always kept.

Alert emails are calmer too. Repeated notices about the same ongoing condition — a backup that keeps failing for the same reason, or a blocked attack wave — are now grouped into a single alert instead of emailing you every hour, and backup failure notices now say what went wrong and what to do about it. When a backup keeps failing for the same fixable reason, PowerSEC also spaces out further attempts until one succeeds, instead of retrying every hour.

Some notification emails could arrive under the wrong heading. An alert about disk space, connectivity or routine maintenance could be delivered as a malware detection, and a genuine malware finding could be delivered as something else.

Every alert email is now titled and written from the event it actually reports, and alerts that do not fit a specific category are sent as a plain notice describing exactly what was recorded.

If you ever received an email that did not match what your dashboard showed, the dashboard was right. No action is needed, and your existing alerts and their history are unchanged.

PowerSEC could report a site's uploads folder as unprotected when it was simply unable to confirm the protection, on hosting where that check is not available. Sites in that position now show "not verified" rather than a warning they could not clear. A folder with no protection in place is still reported plainly, and the Fix action still applies it.

On sites where the WordPress administrator is not the person who owns the PowerSEC account, the login verification code could fail to arrive — and on hosting that cannot send mail, it did not arrive at all. Codes are now delivered to the site's administrator. Applying the uploads protection from your dashboard is also available on every plan, matching what the plugin has always allowed on the site itself.

WordPress core integrity reported wp-config-sample.php, readme.html and license.txt as missing when they had been deliberately deleted, which is a common hardening step and something some hosts do for you. These files are now listed separately as information rather than counted as an issue, and are still checked for changes when present. Separately, a backup that fails because of folder permissions now explains what to change instead of only naming the symptom.