Onboard 50 sites in one afternoon
How agencies and teams can connect 50 WordPress sites to PowerSEC Central in an afternoon using install tokens.
Whole-site malware scanning and webshell detection
PowerSEC's malware scanner reviews PHP-like executable files across your entire WordPress installation, including writable and non-standard directories — uploads, cache, backup folders, and security-plugin log folders — where attackers often hide malicious files. Active…
Database Health: the safe cleanup workflow
How to safely tidy your WordPress database with PowerSEC — why a small overhead number is normal, the correct order of operations (back up first), and which cleanups are safe versus which need care.
Actively-exploited vulnerabilities: why some are flagged "fix first"
PowerSEC flags vulnerabilities that are confirmed exploited in the wild (CISA KEV) and sorts them to the top so you patch what attackers are actually using first.
Performance impact of PowerSEC
PowerSEC is designed to be lightweight. Here's what to expect for performance impact and how to tune if needed. Typical impact The figures below are typical estimates for a site with average traffic (1000 visits/day) on standard shared hosting — actual impact varies by host,…
False positives in malware scans
Sometimes the scanner flags a legitimate file as suspicious or malicious. Here's how to handle it. What "false positive" means A false positive is a legitimate file that triggers heuristic detection because it has patterns commonly associated with malware: - Heavy obfuscation…
Plugin installation troubleshooting
If the PowerSEC plugin won't install or activate, this guide walks through common causes. "The link you followed has expired" Your server's PHP uploadmaxfilesize or postmaxsize is smaller than the plugin ZIP. Fix: 1. SSH into your server 2. Edit php.ini (location varies; php…
Vulnerability scanner: reading reports
Your vulnerability report shows known security issues in the plugins, themes, and WordPress core installed on your sites. Where to find it Dashboard → Vulnerabilities tab. Or per-site: open a site → Vulnerabilities sub-tab. What each row means Each vulnerability shows: - CVE ID…
File integrity monitoring explained
File integrity monitoring (FIM) detects when files on your server change unexpectedly. PowerSEC compares your live filesystem against a known-good baseline. What PowerSEC monitors PowerSEC's File Integrity Monitoring watches for file changes across your entire WordPress…
Common WordPress attack vectors
Here are the attacks PowerSEC defends against most often, in rough order of frequency. 1. Brute-force login attacks Bots try thousands of common username/password combinations against /wp-login.php and /xmlrpc.php. Most attacks come from compromised IoT devices. PowerSEC…
Welcome to PowerSEC
PowerSEC is an all-in-one WordPress security platform that protects your sites from malware, vulnerabilities, brute-force attacks, and downtime — without you needing to become a security expert. What PowerSEC does for your sites - Scheduled threat detection — regular scanning…
Installing the WordPress plugin
The PowerSEC plugin is the agent that connects your WordPress site to PowerSEC Central. You install it like any other WP plugin. Method 1 — From the WordPress admin 1. Go to Plugins → Add New in your WP admin 2. Search for PowerSEC 3. Click Install Now, then Activate 4. After…
Connecting your first site
Once the PowerSEC plugin is installed and active, you need to pair it with your PowerSEC Central account. The pairing flow 1. In your WP admin, click PowerSEC → Connect 2. The plugin opens a secure browser tab on powersec.io to confirm the connection (a one-time session — you…
Trigger an on-demand scan
You can trigger a manual security scan at any time from the dashboard, CLI, or API. Using the CLI From the dashboard 1. Dashboard → Sites → your site 2. Click Run scan now 3. Choose scan type: - Quick scan — malware signatures + changed files only (30 seconds) - Full scan —…