Connecting a site gives PowerSEC Central three keys that belong to that site. You create them in Central and paste them into the plugin once.
Connect a site
- In PowerSEC Central, open Sites → Add site and enter the site's URL
- Central shows three keys once: API Key, Telemetry key, and Remote control key. Keep the page open; they are not shown again
- In your WordPress admin, open PowerSEC → Central Connection
- Paste each key into the field with the same name and save
- Use Test Connection to check the API key
You can also skip the copying: in PowerSEC → Central Connection, click Connect automatically, sign in to Central and click Approve and connect. The keys are sent back to the site for you.
What the three keys do
- The API key identifies the site
- The telemetry key signs the data the site sends to Central
- The remote control key lets the site verify requests that come from Central, such as a backup or a scan you start from the dashboard
- Every request is signed with HMAC-SHA256, so the keys themselves are never sent with a request. Central stores them encrypted
After connecting
The site appears in your sites list after its first sync, usually within a few minutes. Sync then runs every hour (more often on Pro).
Lost your keys or need new ones?
If the site's keys were revoked (for example after the plugin was deactivated), open the site in Central and choose Issue new connection keys. A new set is shown once, and your backups, alerts, and history are kept. Paste the new keys into the plugin as above.
What if connection fails?
Common causes:
- Firewall blocking — your server must allow outbound HTTPS to
powersec.io - WAF or CDN rule blocking — some hosts block requests to the plugin's REST endpoint. Allow PowerSEC's requests to the plugin's endpoint (the
/wp-json/powersec/v1/path) — see Allow PowerSEC through Cloudflare or a firewall - A key pasted into the wrong field — each key has its own field; the names match the ones Central shows
If issues persist, see Plugin installation troubleshooting.