Onboard 50 sites in one afternoon
How agencies and teams can connect 50 WordPress sites to PowerSEC Central in an afternoon using install tokens.
Incident → Receipt — the full triage flow
Walk through a PowerSEC incident from first alert to resolved receipt without leaving the platform.
Backup model: weekly full + daily incremental
PowerSEC uses a chain model to keep backups fast and storage-efficient: - One full backup as the base (scheduled weekly on plans with scheduled backups) - Daily differential backups that upload only what changed since that full - A restore point is the base full plus the…
Restore dry-run checks before recovery
Before anything on your site is modified, every restore runs its own safety checks at restore time: - The backup artifacts must be present (missing cloud copies are downloaded first) - Each required artifact is checked against its stored SHA-256 checksum - A safety checkpoint (a…
Restore confidence states and chain health
Each restore point can carry one of five readiness states: - Healthy: Central's records and checksum metadata look complete for this restore point. - Legacy format: informational only — the backup uses an older format without manifest integrity metadata. Restore-time safety…
Backup limits by plan: storage and restore points
Backup limits are enforced by site package policy. Typical controls include: - Total cloud storage cap - Restore-point cap per site - Max single backup size Important: - Incremental backups improve efficiency but do not bypass package limits. - Retention jobs prune old chains…
Bring Your Own Storage (BYOS): add your own cloud bucket
Bring Your Own Storage (BYOS) lets you mirror every PowerSEC cloud backup into a storage bucket you own and control — on top of the PowerSEC-managed copy. This adds an independent, off-site copy in an account you control, so a problem with one copy needn't affect the other. Who…
Allow PowerSEC through Cloudflare or a firewall
If Cloudflare or a firewall challenges PowerSEC's requests, actions to your site can be delayed. Here is the one-minute allow rule that fixes it.
Behavioral WAF: learning, monitor, and block modes
PowerSEC's Behavioral WAF is a pattern-inspection layer that runs on top of the standard Firewall. It is off by default and ships with three operating modes designed to roll out safely without breaking your site. Why three modes? Web Application Firewalls famously block…
Backup reliability on large or memory-constrained sites
PowerSEC backups are designed to run in passes so large sites can complete without relying on one long request. Reliability on constrained hosting Recent improvements reduce the chance of memory exhaustion on shared or memory-limited hosting. Large backup file lists are stored…
Whole-site malware scanning and webshell detection
PowerSEC's malware scanner reviews PHP-like executable files across your entire WordPress installation, including writable and non-standard directories — uploads, cache, backup folders, and security-plugin log folders — where attackers often hide malicious files. Active…
AI Advisory: second-opinion malware reviews
AI Advisory is a second-opinion review for selected malware findings in PowerSEC protection plans. What AI Advisory does AI Advisory reviews selected findings that were already identified by PowerSEC's deterministic security scanners. It can help provide an advisory label such…
Does PowerSEC scan for malware automatically?
Yes. As of plugin v1.4.107 PowerSEC runs its full malware scanner automatically in the background on a schedule, in addition to on-demand scans. Available on every plan.
Database Health: the safe cleanup workflow
How to safely tidy your WordPress database with PowerSEC — why a small overhead number is normal, the correct order of operations (back up first), and which cleanups are safe versus which need care.
Reading AI Advisory verdicts and incident summaries
This guide explains how to read AI Advisory results and incident summaries. For an overview of what AI Advisory is and which plans include it, see AI Advisory: second-opinion malware reviews. AI Advisory verdicts When PowerSEC's deterministic scanner flags a selected file, AI…
How PowerSEC's malware scanner stays safe (it never runs the code it scans)
PowerSEC's scanner detects malware by static pattern matching and never executes, evals, or unpacks-by-running the code it scans — so a scanned file can't compromise the scanner.
Actively-exploited vulnerabilities: why some are flagged "fix first"
PowerSEC flags vulnerabilities that are confirmed exploited in the wild (CISA KEV) and sorts them to the top so you patch what attackers are actually using first.
Performance impact of PowerSEC
PowerSEC is designed to be lightweight. Here's what to expect for performance impact and how to tune if needed. Typical impact The figures below are typical estimates for a site with average traffic (1000 visits/day) on standard shared hosting — actual impact varies by host,…
False positives in malware scans
Sometimes the scanner flags a legitimate file as suspicious or malicious. Here's how to handle it. What "false positive" means A false positive is a legitimate file that triggers heuristic detection because it has patterns commonly associated with malware: - Heavy obfuscation…
Site not syncing — what to check
If your site shows "Last sync: 24 hours ago" or "Connection lost" in the dashboard, work through this checklist. 1. Check the plugin is active WP admin → Plugins → confirm PowerSEC is Active. If it's been deactivated, reactivate it. Sync resumes within 5 minutes. 2. Check the…
Plugin installation troubleshooting
If the PowerSEC plugin won't install or activate, this guide walks through common causes. "The link you followed has expired" Your server's PHP uploadmaxfilesize or postmaxsize is smaller than the plugin ZIP. Fix: 1. SSH into your server 2. Edit php.ini (location varies; php…
Refund policy
We want PowerSEC to work for your business. Here's our refund policy in plain language. Free trial Pro Protection includes a 14-day free trial. You are not charged until the trial ends, and you can cancel anytime during the trial to avoid any charge. Refund windows (after the…
Managing your subscription
Manage your PowerSEC subscription, payment methods, and invoices from the /dashboard/billing page. Viewing your current plan Dashboard → Billing shows: - Current plan (Free / Pro / Agency) - Billing cycle (monthly / annual) - Next billing date + amount - Payment method on file…
IP blocking and rate limiting
Beyond brute-force protection, PowerSEC lets you block specific IPs, IP ranges, or set general rate limits for your site. Manual IP blocking To block a specific IP (or range): 1. PowerSEC → Firewall → IP Blocklist 2. Click Add rule 3. Enter: - IP or CIDR range (e.g.,…
Login security: brute-force protection
Brute-force attacks are the 1 most common attack against WordPress sites. PowerSEC blocks them before they can guess your password. How brute-force attacks work A bot tries thousands of username + password combinations against /wp-login.php and /xmlrpc.php. Common patterns: -…
Vulnerability scanner: reading reports
Your vulnerability report shows known security issues in the plugins, themes, and WordPress core installed on your sites. Where to find it Dashboard → Vulnerabilities tab. Or per-site: open a site → Vulnerabilities sub-tab. What each row means Each vulnerability shows: - CVE ID…
Web Application Firewall (WAF) basics
The PowerSEC WAF inspects every HTTP request to your WordPress site and blocks attacks before they reach your code. How requests flow Rule sets PowerSEC includes: - OWASP Core Rule Set — covers SQL injection, XSS, RFI/LFI, and other OWASP Top 10 categories - WordPress-specific…
File integrity monitoring explained
File integrity monitoring (FIM) detects when files on your server change unexpectedly. PowerSEC compares your live filesystem against a known-good baseline. What PowerSEC monitors PowerSEC's File Integrity Monitoring watches for file changes across your entire WordPress…
Understanding malware types found by PowerSEC
When PowerSEC scans your site, suspicious files get one of these verdicts: clean The file matches a known-good signature (WordPress core, official plugin, or your committed code). No action needed. low risk (unconfirmed) Heuristics suggest the file is benign but it doesn't match…
Common WordPress attack vectors
Here are the attacks PowerSEC defends against most often, in rough order of frequency. 1. Brute-force login attacks Bots try thousands of common username/password combinations against /wp-login.php and /xmlrpc.php. Most attacks come from compromised IoT devices. PowerSEC…
Why your WordPress site needs security
WordPress powers 43% of all websites — which makes it the 1 target for attackers. If your site is online, it's being probed automatically every few minutes by bots looking for known weaknesses. What attackers are after - Spam injection — your site sends pharmacy spam without…
Welcome to PowerSEC
PowerSEC is an all-in-one WordPress security platform that protects your sites from malware, vulnerabilities, brute-force attacks, and downtime — without you needing to become a security expert. What PowerSEC does for your sites - Scheduled threat detection — regular scanning…
Installing the WordPress plugin
The PowerSEC plugin is the agent that connects your WordPress site to PowerSEC Central. You install it like any other WP plugin. Method 1 — From the WordPress admin 1. Go to Plugins → Add New in your WP admin 2. Search for PowerSEC 3. Click Install Now, then Activate 4. After…
Connecting your first site
Once the PowerSEC plugin is installed and active, you need to pair it with your PowerSEC Central account. The pairing flow 1. In your WP admin, click PowerSEC → Connect 2. The plugin opens a secure browser tab on powersec.io to confirm the connection (a one-time session — you…
Plan comparison: Free vs Pro vs Agency
Choose the plan that fits your needs. You can upgrade or downgrade at any time from your billing page. Free For personal sites and developers trying out PowerSEC. - ✅ Up to 10 sites - ✅ Daily malware scans - ✅ Vulnerability alerts (manual scan) - ✅ Basic firewall (rule updates…
List all sites under your account
Retrieve all sites connected to your PowerSEC account via the CLI or API. Using the CLI Via the API Parameters | Parameter | Type | Default | Description | |-----------|------|---------|-------------| | status | string | all | Filter by status: online, offline, atrisk | |…
Trigger an on-demand scan
You can trigger a manual security scan at any time from the dashboard, CLI, or API. Using the CLI From the dashboard 1. Dashboard → Sites → your site 2. Click Run scan now 3. Choose scan type: - Quick scan — malware signatures + changed files only (30 seconds) - Full scan —…
Restore a site from backup
How to restore a WordPress site from a PowerSEC backup — full restore, DB-only, or single file.
Fetch open incidents across all sites
Retrieve all open incidents across your fleet via the CLI or API. Using the CLI Via the API Parameters | Parameter | Type | Default | Description | |---|---|---|---| | status | string | all | Filter: open, investigating, resolved, closed | | severity | string | — | Filter:…
Backup schedule: weekly full + daily differential
PowerSEC's automatic cloud backups use a GFS (grandfather-father-son) schedule that keeps storage and transfer small while protecting every day: How it works - Weekly full backup — a complete snapshot (database + all files) is taken on a regular cadence (about every 7 days). -…