Onboarding many sites
How agencies and teams connect many WordPress sites to PowerSEC Central, one site at a time, without copying keys by hand.
Incident → resolved — the full triage flow
Walk through a PowerSEC incident from first alert to resolved.
Restore dry-run checks before recovery
Before anything on your site is modified, every restore runs its own safety checks at restore time: - The backup artifacts must be present (missing cloud copies are downloaded first) - Each required artifact is checked against its stored SHA-256 checksum - A safety checkpoint (a…
Restore confidence states and chain health
Each restore point can carry one of five readiness states: - Healthy: Central's records and checksum metadata look complete for this restore point. - Legacy format: informational only — the backup uses an older format without manifest integrity metadata. Restore-time safety…
Backup limits by plan: storage and restore points
Cloud storage, restore points and the largest single backup for each plan, and what happens when a limit is reached.
Bring Your Own Storage (BYOS): add your own cloud bucket
Bring Your Own Storage (BYOS) lets you mirror every PowerSEC cloud backup into a storage bucket you own and control — on top of the PowerSEC-managed copy. This adds an independent, off-site copy in an account you control, so a problem with one copy needn't affect the other. Who…
CVE-2026-82901 in Ultra Addons for Contact Form 7
Ultra Addons for Contact Form 7 up to 3.5.50 lets unauthenticated visitors upload arbitrary files via a signature field. Update to 3.5.51 or later. Affected component: Ultra Addons for Contact Form 7 (plugin) Fixed in: 3.5.51 PowerSEC coverage: PowerSEC detects the affected…
CVE-2026-19859 in JetFormBuilder
JetFormBuilder before 3.6.5.2 lets unauthenticated visitors run arbitrary shortcodes through its 'status' parameter. Update to version 3.6.5.2 or later. Affected component: JetFormBuilder — Dynamic Blocks Form Builder (plugin) Fixed in: 3.6.5.2 PowerSEC coverage: PowerSEC…
CVE-2026-84750 in Ultra Addons for Contact Form 7
Ultra Addons for Contact Form 7 3.2.4 to 3.5.50 lets unauthenticated visitors upload arbitrary files through a form field. Update to 3.5.51 or later. Affected component: Ultra Addons for Contact Form 7 (plugin) Fixed in: 3.5.51 PowerSEC coverage: PowerSEC detects the affected…
CVE-2020-11738 in Duplicator and Duplicator Pro
Duplicator before 1.3.28 and Duplicator Pro before 3.8.7.1 let unauthenticated attackers read any file on the server. It is being exploited; update now. Affected component: Duplicator Pro and Duplicator (plugin) Fixed in: 3.8.7.1 (Duplicator Pro), 1.3.28 (Duplicator) Known…
CVE-2020-25213 in File Manager
WP File Manager 6.8 and earlier lets unauthenticated attackers upload and run PHP files. It has been exploited in the wild; update to 6.9 or later now. Affected component: File Manager (plugin) Fixed in: 6.9 Known exploited: this CVE is listed in the CISA Known Exploited…
CVE-2026-63030 in WordPress
WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 have a remote code execution flaw in the REST API batch route that is being exploited. Update to 6.9.5 or 7.0.2. Affected component: WordPress (core) Fixed in: 6.9.5, 7.0.2 Known exploited: this CVE is listed in the CISA Known…
Allow PowerSEC through Cloudflare or a firewall
If Cloudflare or a firewall challenges PowerSEC's requests, actions to your site can be delayed or fail. Here is how to allow them.
Behavioral WAF: learning, monitor, and block modes
PowerSEC's Behavioral WAF is an optional signature layer on top of the core firewall. It is off by default and has three modes so you can turn it on without breaking your site.
Backup reliability on large or memory-constrained sites
PowerSEC backups are designed to run in passes so large sites can complete without relying on one long request. Reliability on constrained hosting Recent improvements reduce the chance of memory exhaustion on shared or memory-limited hosting. Large backup file lists are stored…
Whole-site malware scanning and webshell detection
PowerSEC's malware scanner reviews PHP-like executable files across your entire WordPress installation, including writable and non-standard directories — uploads, cache, backup folders, and security-plugin log folders — where attackers often hide malicious files. Active…
AI Advisory: second-opinion malware reviews
AI Advisory is a second-opinion review for selected malware findings, on Pro Protection, Pro + Backup Plus and Agency.
Does PowerSEC scan for malware automatically?
Yes. As of plugin v1.4.107 PowerSEC runs its full malware scanner automatically in the background on a schedule, in addition to on-demand scans. Available on every plan.
Database Health: the safe cleanup workflow
PowerSEC's Database Health screen (in the plugin under Database → Database Health, and on the Central dashboard under your site's Database Health panel) shows a health score, a per-table breakdown, and a set of one-click cleanup actions. This guide explains what those numbers…
Reading AI Advisory verdicts and incident summaries
How to read AI Advisory results and AI incident summaries.
How PowerSEC's malware scanner stays safe
PowerSEC's scanner detects malware by static pattern matching and never runs the code it scans.
Why some vulnerabilities are flagged "fix first"
PowerSEC flags vulnerabilities that are confirmed exploited in the wild (CISA KEV) and sorts them to the top so you patch what attackers are actually using first.
Performance impact of PowerSEC
What PowerSEC runs on your server, when it runs, and how to reduce its footprint on a busy or small host.
False positives in malware scans
Sometimes the scanner flags a legitimate file. Here is how to tell, and what to do about it.
Site not syncing — what to check
If a site shows an old "last sync" time in the dashboard, work through this checklist.
Plugin installation troubleshooting
If the PowerSEC plugin won't install, activate, or reach PowerSEC Central, this guide walks through common causes.
Refund policy
Our refund policy in plain language: the Pro Protection trial, refund windows, and how to ask for a refund.
Managing your subscription
Manage plans, add-ons, and invoices from the Billing page. Plans are per site, so each site has its own package. Viewing your plans Billing → My Site Packages lists every site with its package, billing interval, status, and next renewal or end date. Invoices & Emails lists past…
IP blocking and rate limiting
Block specific addresses or ranges, block countries, and limit how many requests one address can make.
Login security: brute-force protection
How PowerSEC stops password-guessing attacks against your WordPress login, and what to do if you lock yourself out.
Vulnerability scanner: reading reports
How to read the vulnerability list for your sites, how often it is checked, and what to do about each finding.
Web Application Firewall (WAF) basics
How PowerSEC's firewall layers inspect requests to your WordPress site, and how to handle a blocked legitimate request.
File integrity monitoring explained
File integrity monitoring (FIM) detects when files on your server change unexpectedly. PowerSEC compares your live filesystem against a known-good baseline. What PowerSEC monitors Two checks make up file integrity monitoring: - WordPress core check (on by default) — once a day,…
Understanding malware types found by PowerSEC
How PowerSEC rates the files it flags, common malware families, and what to do with a malicious file.
Common WordPress attack vectors
The kinds of attacks WordPress sites face, and what PowerSEC does about each one.
Why your WordPress site needs security
WordPress powers a large share of the web, which makes it a common target for attackers. Once your site is online, automated bots will probe it for known weaknesses. What attackers are after - Spam injection — your site sends pharmacy spam without your knowledge, ruining your…
Welcome to PowerSEC
PowerSEC protects your WordPress sites from malware, vulnerabilities, brute-force attacks and downtime, and lets you manage them all from one dashboard.
Installing the WordPress plugin
The PowerSEC plugin is the agent that connects your WordPress site to PowerSEC Central. You install it like any other WP plugin. Method 1 — From the WordPress admin 1. Go to Plugins → Add New in your WP admin 2. Search for PowerSEC 3. Click Install Now, then Activate 4. After…
Connecting your first site
Connecting a site gives PowerSEC Central three keys that belong to that site. You create them in Central and paste them into the plugin once. Connect a site 1. In PowerSEC Central, open Sites → Add site and enter the site's URL 2. Central shows three keys once: API Key,…
Plan comparison: all PowerSEC plans
Everything that runs on your own WordPress site is free on every plan. Paid plans add services that run on PowerSEC Central: cloud backups, the live malware feed, scheduled rescans, AI review, and alerts sent by Central.
List all sites under your account
List the sites connected to your PowerSEC account with the CLI or the API.
Trigger an on-demand scan
You can start a malware scan at any time, on every plan. Scans run automatically too (see the end of this article), so an on-demand scan is for when you want a fresh result right away. From the site page 1. Open Dashboard → Sites and click the site 2. Click Scan at the top of…
Restore a site from backup
Restoring a site from a PowerSEC backup takes a few clicks from your Central dashboard.
Fetch open incidents across all sites
List open security incidents across your sites with the CLI or the API.
Backup schedule: weekly full + daily differential
Scheduled cloud backups take a full backup about once a week and a daily differential in between. Every restore point carries a complete copy of the database.