PowerSEC is designed to keep its work small and spread out. Here is what runs on your server, when, and what you can adjust. The actual cost depends on your host, your plugins, and your traffic, so measure on your own site if performance matters to you.
What runs on every request
- Firewall and rate limits — checks each request against PowerSEC's built-in rules and per-address request limits.
- Behavioral WAF — off by default. When you turn it on, it also inspects request bodies for attack patterns, which adds work per request.
What runs in the background
- Malware scan — daily by default. It runs in short slices across scheduled runs instead of all at once, so a large site never has to finish in one request.
- Vulnerability check — about once a day. The plugin sends the list of installed components and their versions to PowerSEC Central, which does the matching.
- Sync with Central — hourly by default (more often on Pro).
- Backups — a backup runs in several short passes. On paid plans, scheduled cloud backups run daily: a full backup about once a week, and a differential on the other days that uploads only the files changed since that full backup, plus the database. A differential still reads your files to find the changes, and still exports the whole database, so it takes less upload time than a full backup but is not instant.
Busy servers
Background scans wait when your server is busy. If the server's load is above PowerSEC's threshold (which takes the number of CPU cores into account), a scheduled scan slice is skipped and tried again on a later run.
Ways to reduce the footprint
- Scan less often — choose a weekly scan under PowerSEC → File Scanner (or Settings). Scheduled scans still check everything; they just run less often.
- Exclude folders that never hold code — under PowerSEC → File Scanner → Detection settings you can list directories and files to ignore. Excluded paths are not scanned, so use this carefully: writable folders such as uploads and cache are where attackers often hide files.
- Leave the Behavioral WAF off, or in Learning mode, if per-request overhead is a concern. The core firewall keeps checking for SQL injection and cross-site scripting either way.
- Enable PHP OPcache on your host. It speeds up every PHP plugin, PowerSEC included. Check with
php -m | grep -i opcache; if nothing is shown, ask your host to enable it.
Ruling PowerSEC in or out
- Note your page load time and memory use
- Temporarily deactivate PowerSEC
- Compare
- Reactivate PowerSEC
A slow site is often caused by the hosting plan, missing page caching, or a heavy page builder rather than a security plugin, but measuring is the only way to know.
Need help tuning?
Open a ticket with your site URL, hosting provider and plan, what is slow, and any recent changes. We aim to reply within 1–2 business days.