When PowerSEC raises an incident, you can go from alert to resolved without leaving the platform. The Incidents page and runbooks are part of Pro Protection, Pro + Backup Plus and Agency.
1. Receive the alert
You get an email or a dashboard notification. Click the link or open Dashboard → Incidents.
2. Open the incident
The incident shows:
- Type — for example malware, brute force, downtime, or a WAF attack
- Severity — critical, high, medium, or info
- Affected site and what triggered it
- Runbook steps for that incident type
3. Follow the runbook
Each runbook step has a Run button (for actions PowerSEC can do on the site) or an Open link (for steps you do yourself).
Malware detected, for example:
- Run a full malware scan
- Review the flagged files under the site's Findings → Malware. A finding is a candidate for review; check it before removing anything, and take a backup first
- Remove or quarantine the files you have confirmed are malicious
- Find and update the plugin or theme that let the attacker in
- Scan again to check that nothing else is flagged
Brute force, for example:
- Block the attacking address
- Reset any administrator passwords that may be affected
- Turn on the email login code (a second sign-in step, off by default) under PowerSEC → Login Security in WordPress
4. Mark it resolved
Set the incident to Investigating while you work and Resolve when you are done.
5. Review
After a serious incident, take a few minutes to note what allowed it and what you changed, so it does not happen again.