Incident → resolved — the full triage flow
Walk through a PowerSEC incident from first alert to resolved.
Whole-site malware scanning and webshell detection
PowerSEC's malware scanner reviews PHP-like executable files across your entire WordPress installation, including writable and non-standard directories — uploads, cache, backup folders, and security-plugin log folders — where attackers often hide malicious files. Active…
AI Advisory: second-opinion malware reviews
AI Advisory is a second-opinion review for selected malware findings, on Pro Protection, Pro + Backup Plus and Agency.
Does PowerSEC scan for malware automatically?
Yes. As of plugin v1.4.107 PowerSEC runs its full malware scanner automatically in the background on a schedule, in addition to on-demand scans. Available on every plan.
Reading AI Advisory verdicts and incident summaries
How to read AI Advisory results and AI incident summaries.
How PowerSEC's malware scanner stays safe
PowerSEC's scanner detects malware by static pattern matching and never runs the code it scans.
Performance impact of PowerSEC
What PowerSEC runs on your server, when it runs, and how to reduce its footprint on a busy or small host.
False positives in malware scans
Sometimes the scanner flags a legitimate file. Here is how to tell, and what to do about it.
Web Application Firewall (WAF) basics
How PowerSEC's firewall layers inspect requests to your WordPress site, and how to handle a blocked legitimate request.
File integrity monitoring explained
File integrity monitoring (FIM) detects when files on your server change unexpectedly. PowerSEC compares your live filesystem against a known-good baseline. What PowerSEC monitors Two checks make up file integrity monitoring: - WordPress core check (on by default) — once a day,…
Understanding malware types found by PowerSEC
How PowerSEC rates the files it flags, common malware families, and what to do with a malicious file.
Common WordPress attack vectors
The kinds of attacks WordPress sites face, and what PowerSEC does about each one.
Why your WordPress site needs security
WordPress powers a large share of the web, which makes it a common target for attackers. Once your site is online, automated bots will probe it for known weaknesses. What attackers are after - Spam injection — your site sends pharmacy spam without your knowledge, ruining your…
Welcome to PowerSEC
PowerSEC protects your WordPress sites from malware, vulnerabilities, brute-force attacks and downtime, and lets you manage them all from one dashboard.
Plan comparison: all PowerSEC plans
Everything that runs on your own WordPress site is free on every plan. Paid plans add services that run on PowerSEC Central: cloud backups, the live malware feed, scheduled rescans, AI review, and alerts sent by Central.
Trigger an on-demand scan
You can start a malware scan at any time, on every plan. Scans run automatically too (see the end of this article), so an on-demand scan is for when you want a fresh result right away. From the site page 1. Open Dashboard → Sites and click the site 2. Click Scan at the top of…