PowerSEC inspects requests to your WordPress site inside WordPress, before your theme and plugins handle them. It has two layers.
Layer 1: the core firewall (on by default)
The core firewall is on as soon as the plugin is active, on every plan. It:
- checks requests for SQL injection and cross-site scripting (XSS) and blocks matches (each check can be switched off under PowerSEC → Firewall → Firewall Rules)
- applies per-address rate limits (see IP blocking and rate limiting)
- enforces your IP blocks, and optionally geo-blocking, Tor exit-node blocking and your own known-bad IP list (all off by default)
Layer 2: the Behavioral WAF (off by default)
The Behavioral WAF uses PowerSEC's own signature library, which covers the common OWASP Top 10 attack classes: SQL injection, cross-site scripting, remote code execution, local and remote file inclusion, path traversal, SSRF, XXE, template injection, unsafe deserialization and more. The signatures are updated with each plugin release.
It has three modes: Learning (the default when you turn it on), Monitor, and Block. Learning and Monitor only log matches; Block enforces high-confidence rules. See Behavioral WAF: learning, monitor, and block modes.
On Pro plans, PowerSEC Central can also send virtual-patch rules for selected actively exploited vulnerabilities. New virtual-patch rules start in monitor (log-only) mode and are switched to blocking only after review.
Reading the logs
In WordPress, PowerSEC → Firewall shows the WAF Block & Match Log: the rule, the request path, the parameter and the address for each match. The Audit Log records blocks and lockouts.
False positives
If a legitimate request is blocked:
- Find it in the WAF Block & Match Log
- Click Mark FP on the row — this adds an exception for that URL path or parameter
- Or add your own values under WAF Exception Lists
If the core firewall blocks you while you are logged in as an administrator, it only logs the match: administrators are not blocked by the firewall's signature checks.
What a firewall can't do
- Stop attacks that exploit logic flaws — it inspects requests, not your business logic
- Replace updates — keep plugins and themes updated; the firewall is a safety net
- See threats that never pass through WordPress — such as files uploaded over FTP or changes made directly in the database
Combine the firewall with malware scanning, file change monitoring and backups.