These are common kinds of attacks against WordPress sites, and what PowerSEC does about each one.
Brute-force login attacks
Bots try many username and password combinations against /wp-login.php and /xmlrpc.php.
PowerSEC defense: an address that fails to log in 5 times within 60 minutes is blocked for 60 minutes (both numbers are adjustable). XML-RPC is disabled by default. You can also turn on a CAPTCHA on the login form and an email login code (a second sign-in step). See Login security.
Vulnerable plugin and theme exploits
When a vulnerability is published in a popular plugin, attackers scan the web for sites still running the vulnerable version, often within days or even hours of disclosure.
PowerSEC defense: the vulnerability check compares your installed core, plugins and themes against PowerSEC's vulnerability data every day on every plan, and flags actively exploited issues first. Pro plans add rescans scheduled by Central and virtual-patch rules for some actively exploited issues. You can update a plugin from the site page in Central.
SQL injection (SQLi)
Malicious input that tricks your database into running the attacker's SQL. WordPress core is well protected, but plugins (especially custom ones) are not always.
PowerSEC defense: the core firewall checks requests for SQL injection on every plan and blocks matches by default. The optional Behavioral WAF adds a deeper library of PowerSEC's own signatures, covering the common OWASP Top 10 attack classes.
Cross-Site Scripting (XSS)
An attacker injects JavaScript that runs in your visitors' browsers, to steal sessions, redirect users, or skim card data.
PowerSEC defense: the core firewall checks requests for XSS patterns and blocks matches by default. File change monitoring (when the File Scanner is turned on) reports changed files, including JavaScript files.
Malicious file uploads
An attacker uses a vulnerable upload form to upload a PHP web shell, which gives them control of your server.
PowerSEC defense: the malware scanner checks PHP-like files across your whole WordPress installation, including the uploads folder, and flags web shells and backdoors for your review. The scanner never moves or deletes files on its own; you can quarantine a flagged file yourself from PowerSEC → File Scanner on any plan, or from Central on Pro plans.
SEO spam injection
Hidden links to gambling, pharmacy, or counterfeit sites are inserted into your pages. They are often invisible to people but indexed by search engines.
PowerSEC defense: a daily database content check looks at your published posts and selected options for known SEO-spam and injection patterns and reports what it finds under Findings → Database & Content.
Cryptojacking and malicious scripts
A JavaScript miner or redirect script is injected into your site.
PowerSEC defense: the database content check and the malware scanner look for injected scripts in your content and files. Remove what they find and close the entry point, usually an outdated plugin.