Incident → Receipt — the full triage flow
Walk through a PowerSEC incident from first alert to resolved receipt without leaving the platform.
Whole-site malware scanning and webshell detection
PowerSEC's malware scanner reviews PHP-like executable files across your entire WordPress installation, including writable and non-standard directories — uploads, cache, backup folders, and security-plugin log folders — where attackers often hide malicious files. Active…
AI Advisory: second-opinion malware reviews
AI Advisory is a second-opinion review for selected malware findings in PowerSEC protection plans. What AI Advisory does AI Advisory reviews selected findings that were already identified by PowerSEC's deterministic security scanners. It can help provide an advisory label such…
Does PowerSEC scan for malware automatically?
Yes. As of plugin v1.4.107 PowerSEC runs its full malware scanner automatically in the background on a schedule, in addition to on-demand scans. Available on every plan.
Reading AI Advisory verdicts and incident summaries
This guide explains how to read AI Advisory results and incident summaries. For an overview of what AI Advisory is and which plans include it, see AI Advisory: second-opinion malware reviews. AI Advisory verdicts When PowerSEC's deterministic scanner flags a selected file, AI…
How PowerSEC's malware scanner stays safe (it never runs the code it scans)
PowerSEC's scanner detects malware by static pattern matching and never executes, evals, or unpacks-by-running the code it scans — so a scanned file can't compromise the scanner.
Performance impact of PowerSEC
PowerSEC is designed to be lightweight. Here's what to expect for performance impact and how to tune if needed. Typical impact The figures below are typical estimates for a site with average traffic (1000 visits/day) on standard shared hosting — actual impact varies by host,…
False positives in malware scans
Sometimes the scanner flags a legitimate file as suspicious or malicious. Here's how to handle it. What "false positive" means A false positive is a legitimate file that triggers heuristic detection because it has patterns commonly associated with malware: - Heavy obfuscation…
Web Application Firewall (WAF) basics
The PowerSEC WAF inspects every HTTP request to your WordPress site and blocks attacks before they reach your code. How requests flow Rule sets PowerSEC includes: - OWASP Core Rule Set — covers SQL injection, XSS, RFI/LFI, and other OWASP Top 10 categories - WordPress-specific…
File integrity monitoring explained
File integrity monitoring (FIM) detects when files on your server change unexpectedly. PowerSEC compares your live filesystem against a known-good baseline. What PowerSEC monitors PowerSEC's File Integrity Monitoring watches for file changes across your entire WordPress…
Understanding malware types found by PowerSEC
When PowerSEC scans your site, suspicious files get one of these verdicts: clean The file matches a known-good signature (WordPress core, official plugin, or your committed code). No action needed. low risk (unconfirmed) Heuristics suggest the file is benign but it doesn't match…
Welcome to PowerSEC
PowerSEC is an all-in-one WordPress security platform that protects your sites from malware, vulnerabilities, brute-force attacks, and downtime — without you needing to become a security expert. What PowerSEC does for your sites - Scheduled threat detection — regular scanning…
Plan comparison: Free vs Pro vs Agency
Choose the plan that fits your needs. You can upgrade or downgrade at any time from your billing page. Free For personal sites and developers trying out PowerSEC. - ✅ Up to 10 sites - ✅ Daily malware scans - ✅ Vulnerability alerts (manual scan) - ✅ Basic firewall (rule updates…
Trigger an on-demand scan
You can trigger a manual security scan at any time from the dashboard, CLI, or API. Using the CLI From the dashboard 1. Dashboard → Sites → your site 2. Click Run scan now 3. Choose scan type: - Quick scan — malware signatures + changed files only (30 seconds) - Full scan —…