Features

PW Security and Backup brings essential WordPress security, monitoring, login protection and backup tools together in one manageable interface.

The plugin is designed for website owners, administrators, developers and agencies that want to monitor important changes, reduce common login risks and maintain accessible backups without installing several disconnected plugins.

Its features support three important parts of WordPress website management:

• Prevention through login protection and access controls
• Monitoring through file scans, change detection and security logs
• Recovery through backups, restore functions and emergency tools

PW Security and Backup does not promise complete protection against every possible threat. Instead, it provides practical layers that help administrators recognise unexpected activity, strengthen access and prepare for operational problems.

WordPress file monitoring

WordPress websites contain thousands of files distributed across the core installation, themes, plugins, uploads and other directories. These files may change because of legitimate updates, administrative actions, FTP uploads or automated processes.

However, file changes can also be caused by:

• Unauthorised access
• Vulnerable plugins or themes
• Malicious file uploads
• Incorrect server operations
• Accidental deletion
• Failed updates
• Unapproved FTP activity

PW Security and Backup scans the WordPress file structure and records information that can be used to identify later changes.

After a file baseline has been created, subsequent scans can compare the current state of the installation with its previously recorded state. This comparison gives administrators greater visibility into what has changed across the website.

A detected change is not automatically a security threat. WordPress, themes and plugins regularly modify files during updates. The purpose of the monitoring system is to provide clear information for review rather than automatically label every change as malicious.

New file detection

The plugin can identify files that did not exist when the previous valid baseline was created.

A newly detected file may be completely legitimate. For example, it may have been created by:

• A WordPress update
• A newly installed plugin
• A theme update
• A cache system
• An image optimisation tool
• A backup process
• An administrator using FTP

It may also require investigation when the filename, location or file type is unfamiliar.

New file detection helps administrators notice unexpected additions, particularly in directories where executable files are not normally expected.

Modified file detection

PW Security and Backup can report files that have changed since the previous baseline.

Modified files may result from normal operations, including software updates or authorised code changes. Nevertheless, an unexpected modification to a sensitive PHP, configuration or theme file may require immediate review.

The feature can help answer questions such as:

• Which file was changed?
• Was the change expected?
• Did it occur after a known update?
• Is the file located in a sensitive directory?
• Was the change made through WordPress, FTP or the hosting panel?
• Should the file be compared with a trusted original copy?

The plugin identifies the change, but the website administrator remains responsible for determining whether it is legitimate.

Deleted file detection

Files may be removed intentionally during updates, plugin removal or website maintenance. They can also disappear because of an incomplete installation, incorrect permissions, server errors or unauthorised activity.

When a recorded file is no longer present, PW Security and Backup can include it in the scan results as a deleted file.

This allows administrators to investigate whether the removal was expected and determine whether the file should be restored from a trusted source or backup.

New directory detection

Security reviews should not focus only on individual files. Unexpected directories can also indicate an unauthorised upload, an incomplete migration or a newly installed component.

PW Security and Backup can detect newly created folders within the scanned WordPress structure. This is useful when content has been added through FTP, a hosting file manager or another process outside the WordPress administration area.

The plugin does not continuously watch the operating system. A new directory is identified when a completed manual or scheduled scan examines the affected location.

Full directory scanning

The plugin is designed to inspect the WordPress installation directory and its relevant subdirectories rather than monitoring only a small selection of core files.

Depending on the website structure and configured exclusions, scanning may cover:

• WordPress core files
• Installed plugins
• Installed themes
• The uploads directory
• Configuration-related files
• Custom application directories
• Other files located within the WordPress installation

Websites can contain generated, temporary or frequently changing files that do not provide useful security information. Exclusion settings can help administrators prevent suitable files and directories from creating unnecessary scan results.

Exclusions should be configured carefully. Excluding a sensitive directory may prevent important changes from being reported.

File baseline management

A baseline represents the known state of the website at a particular time.

The first baseline should ideally be created when:

• WordPress is working correctly.
• Core, themes and plugins are current.
• The website has been reviewed for suspicious files.
• Recent authorised changes have been completed.
• The administrator trusts the current installation.

If a baseline is created while malicious or unwanted files are already present, those files may be treated as part of the known state. The baseline should therefore not be considered a malware-clean guarantee.

After legitimate updates, administrators can review the detected changes and update the baseline when they are satisfied that the new state is trustworthy.

Manual security scans

Administrators can start a file scan from the WordPress management interface when an immediate review is required.

Manual scans may be useful:

• Before an important update
• After updating WordPress
• After installing or updating a plugin
• After changing the active theme
• After uploading files through FTP
• When unexpected website behaviour appears
• After a suspicious login attempt
• Before creating an important backup

The duration of a scan depends on the number and size of files, available server resources and hosting restrictions.

Scheduled security scans

Regular monitoring is more effective when it does not depend entirely on the administrator remembering to start each scan.

PW Security and Backup supports scheduled scanning at configurable intervals. Depending on the available settings, administrators can select periods such as:

• Every 6 hours
• Every 12 hours
• Every 48 hours
• Weekly
• Every two weeks
• Monthly

The most suitable interval depends on how frequently the website changes, its importance, server capacity and the administrator’s monitoring needs.

A frequently updated WooCommerce store may require more regular checks than a small informational website that rarely changes.

Scheduled operations can use WordPress Cron. Because WordPress Cron is normally triggered by site visits, execution may be delayed on low-traffic websites. A real server Cron task can provide more reliable scheduling where supported by the hosting provider.

Performance-conscious processing

Scanning a large WordPress website in a single uninterrupted request can exceed PHP memory or execution-time limits.

PW Security and Backup uses a structured process intended to divide demanding scan operations into more manageable stages. This reduces dependence on one long-running browser request and makes the system more suitable for shared hosting environments.

Actual resource usage still depends on:

• The total number of files
• The size of the installation
• Available PHP memory
• Server CPU and disk performance
• Hosting restrictions
• Other active WordPress processes
• The configured scanning frequency

Large websites should schedule scans during periods of lower traffic and use sensible exclusions for trusted temporary or cache directories.

Security scan results

Detected events are displayed in the WordPress administration interface so that administrators can review them from one central location.

Results may include:

• New files
• Modified files
• Deleted files
• New folders
• Scan completion information
• Scan errors or interruptions
• Date and time information
• Relevant file locations
• Actions requiring administrator attention

Security results should be interpreted alongside recent updates, deployments and maintenance activity. A large number of changed files immediately after a WordPress update may be expected, while a single unfamiliar PHP file in an uploads directory may deserve closer examination.

Email security notifications

Administrators do not need to remain logged in to WordPress to learn that a scheduled operation has completed or an important event has occurred.

PW Security and Backup can send email notifications through the standard WordPress email system.

Depending on the configuration and detected event, notifications may report:

• Completed health checks
• Detected file changes
• Important scan results
• Login-related security events
• Backup events
• Errors requiring attention

Email delivery depends on the WordPress installation, hosting mail service and SMTP configuration. If WordPress messages are unreliable, administrators may need to configure a suitable SMTP or transactional email service.

Notifications should not contain passwords, database credentials, private keys or complete authentication secrets.

Login attempt limitation

Automated systems frequently test common usernames and passwords against WordPress login pages.

PW Security and Backup can limit repeated failed login attempts and temporarily restrict access when the configured threshold is exceeded.

This feature helps reduce:

• Automated password guessing
• Repeated login requests
• Basic brute-force attempts
• Unnecessary authentication traffic
• Persistent attempts from the same address

Login attempt limitation should be combined with strong passwords, current software, restricted administrator accounts and two-factor authentication where available.

Administrators should configure the limits carefully to avoid unnecessarily blocking legitimate users.

Temporary IP blocking

When repeated failed login attempts meet the configured conditions, the originating IP address can be temporarily blocked.

Temporary blocking discourages automated systems from making unlimited attempts within a short period.

The effectiveness of IP-based protection can vary because attackers may use multiple addresses, proxies or distributed networks. It is therefore one protective layer rather than a complete authentication solution.

IP allowlist management

Trusted IP addresses can be added to an allowlist where appropriate.

This can help administrators reduce the chance of accidentally restricting known management connections. However, allowlists should be used carefully when internet connections have dynamic IP addresses or when multiple administrators connect from different locations.

An address should only be added when its purpose and ownership are understood.

IP blocklist management

Administrators can use the IP blocklist to restrict addresses associated with unwanted or suspicious access attempts.

This may be useful for blocking:

• Repeated login abuse
• Known unwanted connections
• Addresses identified during a security review
• Specific sources of persistent automated activity

IP blocklists require ongoing management. A blocked address may later be reassigned to another user, and an attacker may change addresses. For that reason, IP blocking should support broader login security practices rather than replace them.

Custom WordPress login address

The standard WordPress login location is widely known and frequently targeted by automated bots.

PW Security and Backup can provide an option to use a custom login address. This may reduce automated requests directed at common login URLs and make the normal access path less visible.

Changing the login address does not replace:

• Strong passwords
• Two-factor authentication
• Login attempt limits
• Secure administrator accounts
• Updated WordPress software
• Proper server protection

Administrators should record the custom address in a secure location before activating this feature.

Additional login password

An optional additional password can create another verification layer before normal WordPress authentication.

The additional password should:

• Be strong and unique
• Differ from the WordPress account password
• Be stored securely
• Never be shared through unprotected channels
• Be updated if exposure is suspected

Administrators should test the configuration after enabling it and confirm that emergency access information is available.

CAPTCHA protection

CAPTCHA can help distinguish ordinary human login attempts from some automated submissions.

It can reduce basic bot activity and complement login limits. CAPTCHA is not effective against every automated system and should not be treated as a substitute for strong authentication.

Accessibility and usability should also be considered when enabling any CAPTCHA mechanism.

Security questions

Optional security questions can add another verification step to the login process.

Answers should not be based on information that can easily be found through social media, company websites or public records. Predictable answers can weaken the value of the feature.

A security answer should be treated like a password and stored securely.

Login activity records

Security logs provide administrators with information that may help them understand repeated authentication activity and access-related events.

Depending on the enabled settings, records may contain:

• Attempt dates and times
• IP addresses
• Success or failure status
• Blocking events
• Related security actions

IP addresses may be considered personal data under applicable privacy laws. Website administrators are responsible for defining an appropriate retention period, limiting access to logs and providing required privacy information.

WordPress backup creation

PW Security and Backup includes tools for creating backups through the WordPress administration area.

Depending on the selected backup type and available features, a backup may contain:

• WordPress files
• Installed plugins
• Installed themes
• Uploaded media
• Website configuration files
• WordPress database information
• A combination of files and database data

Before starting a backup, the server must have enough free storage space and permission to read the required files and database content.

Backup management

Created backups can be reviewed and managed from the plugin interface.

Administrators should be able to identify important information such as:

• Backup creation date
• Backup type
• Archive status
• Backup size
• Available management actions
• Download availability

Backups should be named and retained according to a clear policy so that administrators can distinguish recent, trusted recovery points from outdated archives.

Downloadable backups

Important backups can be downloaded from the website and stored in a separate, protected location.

This is a critical part of a responsible recovery strategy. A backup stored only within the same hosting account may become inaccessible if:

• The server fails.
• The hosting account is suspended.
• The website is compromised.
• Files are deleted.
• Storage becomes corrupted.
• Access credentials are lost.

Downloaded archives should be protected against unauthorised access because they may contain database information, customer data, configuration details or other sensitive content.

Restore functions

The plugin includes restore-related tools intended to help administrators recover website data from a compatible backup.

Restoration may overwrite current files or database content. Before starting, administrators should confirm:

• The backup belongs to the correct website.
• The archive was completed successfully.
• The required content is present.
• Newer data has been protected.
• Sufficient server resources are available.
• Hosting and administrator access is working.
• The website can be placed into maintenance mode if necessary.

A restore should not be treated as a routine operation. It must be planned carefully, especially on active WooCommerce, membership or publishing websites where new data is continuously created.

Emergency recovery

A WordPress problem may sometimes prevent access through the normal administration interface.

PW Security and Backup includes emergency recovery capabilities designed to support administrators during serious access or operational problems.

Emergency features should be configured before an incident occurs. Administrators should understand how they work, protect related credentials and test the approved recovery procedure on a safe staging environment where possible.

Emergency recovery does not replace hosting-level access, external backups or professional incident response.

File and directory exclusions

Some directories contain cache files, temporary archives, logs or other content that changes frequently. Scanning them may produce unnecessary results and consume additional resources.

The exclusion system allows suitable locations to be omitted from monitoring.

Typical candidates may include:

• Trusted cache directories
• Temporary processing folders
• Large generated archives
• Known application logs
• Other verified, frequently changing content

Sensitive directories should never be excluded merely to reduce warnings. Every exclusion creates an area that receives less monitoring and should therefore have a clear operational reason.

Security activity logs

Centralised logs help administrators review important actions and understand the sequence of security-related events.

Logs may support investigations involving:

• Completed or interrupted scans
• Detected file changes
• Login restrictions
• IP management actions
• Backup operations
• Restore activity
• Configuration changes
• Errors requiring attention

Access to security records should be limited to authorised administrators. Old records should be removed according to a reasonable retention policy.

Multilingual WordPress interface

PW Security and Backup uses the standard WordPress translation system.

English is the source language, while Turkish translation files are included with the plugin. The standard gettext structure also allows additional translations to be contributed through the WordPress translation ecosystem.

This structure helps ensure that:

• English WordPress installations display English source text.
• Turkish installations can use the included Turkish translations.
• User-facing strings can be identified by translation tools.
• Future languages can be added without changing the plugin’s core logic.

Translation availability may vary depending on the selected WordPress locale and the completion level of the relevant language catalogue.

WooCommerce-compatible website monitoring

PW Security and Backup can be used on WordPress websites that also run WooCommerce.

WooCommerce stores often contain frequently changing data, customer accounts, orders, payment integrations and business-critical files. For this reason, store administrators should combine security monitoring with careful backup planning.

Before restoring a WooCommerce database, administrators must consider whether the selected backup could overwrite newer:

• Orders
• Customer registrations
• Product changes
• Stock information
• Payment records
• Store settings

Active stores should ideally test restoration procedures in a staging environment before using them on the live website.

Privacy-conscious configuration

The plugin performs its primary security, monitoring and backup functions within the WordPress environment.

Depending on enabled features, it may store information such as:

• File change records
• Scan status data
• Security event logs
• IP addresses
• Backup metadata
• Notification settings
• Login protection records

Website administrators remain responsible for configuring the plugin in accordance with applicable privacy and data-protection requirements.

This includes controlling access, defining retention periods, protecting backups and explaining relevant data processing in the website’s privacy policy when required.

One central management interface

Using separate plugins for every security and recovery task can increase management complexity.

PW Security and Backup brings its primary functions together within a unified WordPress administration area. From this interface, administrators can review monitoring status, configure security controls, manage scans and access backup functions.

A central interface can help website owners understand:

• Which protections are active
• When the last scan was completed
• Whether changes were detected
• Which IP controls are configured
• Whether backups are available
• Which events require attention
• Whether notifications are working

This makes routine security management easier, especially for users who do not work with advanced server tools.

A layered approach to WordPress security

No individual plugin can guarantee complete website security.

PW Security and Backup is designed to provide useful prevention, monitoring and recovery layers. For better protection, it should be combined with:

• Reliable WordPress hosting
• Current WordPress, plugin and theme versions
• Strong and unique passwords
• Two-factor authentication
• Limited administrator access
• HTTPS encryption
• Secure FTP and hosting accounts
• Off-site backup storage
• Regular log reviews
• Trusted software sources
• Professional assistance when suspicious activity is detected

The combination of these practices gives administrators a stronger and more realistic WordPress security strategy.

Explore PW Security and Backup

PW Security and Backup helps website owners monitor changes, strengthen login access, create backups and prepare for recovery from a single WordPress dashboard.

Use its features to build a clearer website maintenance routine, respond to unexpected events sooner and reduce dependence on multiple disconnected tools.

PW Security and Backup — practical monitoring, stronger access and better recovery preparation for WordPress.