What’s new in PowerSEC

Critical security alerts — including malware and webshell findings — now remain on your dashboard until the underlying condition is genuinely resolved.

Routine notices about events PowerSEC already handled for you, such as a blocked IP address or a locked-out login attempt, now clear on their own instead of accumulating.

Your site page also shows when advanced firewall rules are set to watch rather than block, so you can tell at a glance whether they are enforcing. And when AI review is waiting on your site’s approval, the AI panel now says so and points you to where to give it.

Every site now gets vulnerability scanning, whatever plan it is on. PowerSEC checks your plugins, themes and WordPress version against a continuously updated vulnerability database and tells you what needs attention.

Sites are now checked automatically once a day. Paid plans add more frequent automatic re-checks, so newly published vulnerabilities surface sooner.

The vulnerabilities page also shows when each site was last checked, so you can see how current a result is at a glance.

Vulnerability scanning now runs automatically once a day on every plan, and checks your plugins, themes and WordPress version against current vulnerability data. Results now show what was actually checked and when. If a check cannot complete, it says so instead of reporting a clean result.

Full backups now complete reliably on sites with very large databases and use far less server memory while running. Backups are also smaller, and leftover records from old backups are tidied up automatically.

You can now pause scheduled backups for a set time (24 hours to 30 days) or stop them entirely from a site's Backups page. Pausing takes one click and resumes automatically. Stopping is deliberately harder: you confirm in the dashboard, confirm again from a link we email you, and even then backups keep running for 24 hours so one click can cancel the change. Your existing backups are always kept.

Alert emails are calmer too. Repeated notices about the same ongoing condition — a backup that keeps failing for the same reason, or a blocked attack wave — are now grouped into a single alert instead of emailing you every hour, and backup failure notices now say what went wrong and what to do about it. When a backup keeps failing for the same fixable reason, PowerSEC also spaces out further attempts until one succeeds, instead of retrying every hour.

Some notification emails could arrive under the wrong heading. An alert about disk space, connectivity or routine maintenance could be delivered as a malware detection, and a genuine malware finding could be delivered as something else.

Every alert email is now titled and written from the event it actually reports, and alerts that do not fit a specific category are sent as a plain notice describing exactly what was recorded.

If you ever received an email that did not match what your dashboard showed, the dashboard was right. No action is needed, and your existing alerts and their history are unchanged.

PowerSEC could report a site's uploads folder as unprotected when it was simply unable to confirm the protection, on hosting where that check is not available. Sites in that position now show "not verified" rather than a warning they could not clear. A folder with no protection in place is still reported plainly, and the Fix action still applies it.

On sites where the WordPress administrator is not the person who owns the PowerSEC account, the login verification code could fail to arrive — and on hosting that cannot send mail, it did not arrive at all. Codes are now delivered to the site's administrator. Applying the uploads protection from your dashboard is also available on every plan, matching what the plugin has always allowed on the site itself.

WordPress core integrity reported wp-config-sample.php, readme.html and license.txt as missing when they had been deliberately deleted, which is a common hardening step and something some hosts do for you. These files are now listed separately as information rather than counted as an issue, and are still checked for changes when present. Separately, a backup that fails because of folder permissions now explains what to change instead of only naming the symptom.

Linking a WordPress site to PowerSEC Central no longer means copying values by hand. Start it from the plugin, approve the site in your PowerSEC account, and the connection completes itself. Entering keys manually is still available if you prefer.

Restores now verify each file as it is applied, and tell you clearly if any part of a restore could not be completed instead of finishing quietly.

On certain hosting setups the PowerSEC admin screens could fail to load. They now open correctly on those hosts.

A WordPress personal-data export and an erasure request now cover the same set of records, so what a person can be shown matches what can be removed for them.

When PowerSEC is removed with the delete-data option enabled, everything it created is now cleared, across all supported hosting configurations.

Before any file content is reviewed by AI, your site must have explicitly opted in. If it has not, nothing is sent for review.

Blocking mode can be switched on whenever you want it. There is no waiting period before it becomes available.

This release was checked with WordPress.org own plugin-review tool running on a real WordPress install, rather than an approximation of it.

Against the last build before our review work began, the tool now reports 28 fewer categories of finding and nothing new. What remains are long-standing false positives: the malware scanner reads large files in a streaming fashion (loading them whole would exhaust memory), and quarantining a file uses an atomic move — both flagged by a rule that cannot tell them apart from unsafe usage.

Also corrected some code annotations that had been placed on the wrong line, which had inadvertently re-exposed database findings that were previously explained.

A housekeeping pass against the WordPress.org automated review tool, which reported no remaining findings. These were internal code-quality improvements across several admin screens, with no change to how the plugin behaves or what it protects.

This release fixes a security issue affecting sites that had changed their database table prefix. Update to this version or later. If you changed your table prefix on an earlier version, updating also cleans up what the older version left behind, and no action is needed from you.

Some old, disabled code for managing settings was removed rather than left in place. It had been unused since PowerSEC Central moved to its current method, and there was no way to switch it back on. Removing it keeps the plugin smaller and reduces what has to be maintained.