PW Security and Backup frequently asked questions
PW Security and Backup brings essential WordPress security monitoring, login protection, file-integrity controls and manual backup tools together in one administration panel.
This frequently asked questions page explains how the plugin works, what its tools can and cannot do, how website information is handled and which precautions administrators should take when configuring important security settings.
The plugin is intended to reduce common WordPress risks, improve visibility and provide practical recovery options. No security plugin can guarantee complete protection against every vulnerability, compromised password, unsafe extension, server failure or targeted attack.
General questions
What is PW Security and Backup?
PW Security and Backup is a WordPress plugin that provides login protection, security hardening, suspicious-code scanning, SHA-256 file-integrity monitoring, manual full backups, selected-file recovery, live traffic monitoring, security analysis, notifications and activity logs.
Its tools are managed from a dedicated menu inside the WordPress administration area.
Who should use PW Security and Backup?
The plugin is suitable for WordPress website owners, administrators, developers and agencies that want to manage important security and backup operations from one location.
It can be used on business websites, blogs, service websites, portfolio websites and WooCommerce stores, provided that the website meets the technical requirements.
Administrators should still understand the effects of important login, file and server-rule changes before enabling them on a live website.
Does the plugin guarantee complete WordPress security?
No. No plugin can guarantee complete protection against every possible threat.
PW Security and Backup helps reduce common risks, identify unexpected activity and provide useful recovery tools. Secure hosting, current software, strong passwords, appropriate account permissions, multi-factor authentication and external backups remain essential.
Does the plugin modify WordPress core files?
The plugin does not replace or directly edit WordPress core PHP files as part of its normal operation.
Some security-hardening features may create or update supported configuration rules, such as rules used to restrict directory listing or PHP execution in the uploads directory. These changes should be reviewed and tested carefully.
Does the plugin require a licence key?
No. The current plugin operates without a licence key.
It does not require a remote Poyraz Web or PW Feed account to use its main security, monitoring and backup features.
Does the plugin require an external security service?
No. The plugin’s main scans, integrity checks, logs, traffic records and backup operations run within the user’s own WordPress installation and hosting environment.
The plugin does not depend on an external malware-scanning or cloud-backup service.
Installation and requirements
What are the minimum system requirements?
The website should have:
• WordPress 5.8 or later.
• PHP 7.4 or later.
• Permission to install and activate WordPress plugins.
• A writable WordPress uploads directory.
• Sufficient disk space for backup archives.
• PHP ZipArchive support for ZIP backup creation.
• A working WordPress email configuration for notifications.
A current PHP version and HTTPS connection are strongly recommended.
How is the plugin installed?
Sign in to WordPress, open Plugins, select Add New Plugin and then select Upload Plugin. Choose the plugin ZIP file, install it and activate it.
If the plugin is available in the WordPress Plugin Directory, it can also be installed by searching for PW Security and Backup from the Add Plugins screen.
After activation, the PW Security menu appears in the WordPress administration area.
What should be done immediately after activation?
Begin with a controlled setup:
- Create a current website backup.
- Confirm the notification email address.
- Review the Security Center.
- Configure failed-login protection.
- Review IP allowlist and blocklist settings.
- Apply an appropriate hardening profile.
- Run the first suspicious-code scan.
- Investigate the reported findings.
- Create a file-integrity baseline only after confirming that the website is clean.
- Configure scheduled health and integrity checks.
Do not enable every restriction simultaneously on an important live website.
Can the plugin be used with WooCommerce?
Yes. The plugin can operate on a WooCommerce website.
WooCommerce stores contain frequently changing order, customer and product information. Backups and recovery operations should therefore be planned carefully. Restoring an older database through an external recovery method may remove orders or customer records created after the backup date.
Important changes should preferably be tested in a staging environment.
Login security
How does failed-login protection work?
The plugin records unsuccessful login attempts according to the configured tracking window. When an IP address reaches the selected limit, it can be temporarily banned.
Administrators can configure the allowed attempt count, tracking period and ban duration.
A failed login may be caused by an attacker, an automated bot or a legitimate user who entered an incorrect password. Ban records should therefore be reviewed in context.
Can the WordPress login address be changed?
Yes. A custom login path can be configured to reduce direct exposure of the standard WordPress login address.
The new address should be stored securely and tested in a private browser window before the current administrator session is closed.
Changing the login address can reduce basic automated traffic, but it does not replace strong passwords, multi-factor authentication or failed-login limits.
Can /wp-login.php be hidden?
The plugin can restrict access to the standard WordPress login address when the custom login-path protection is enabled.
Test the custom address before hiding the standard address. Keep hosting file-manager or FTP access available in case the configured path cannot be reached.
Can unauthorised /wp-admin requests return a 404 response?
Yes. The plugin can return a 404 response when an unauthenticated visitor attempts to access the protected administration path.
This option helps reduce exposure but should be tested with the website’s normal login flow, membership features and other integrations.
What is the additional security password?
The additional security password creates another verification step on the WordPress login form.
It should be different from the user’s normal WordPress password and stored securely. Only authorised users should know it.
This feature does not replace individual WordPress accounts or secure account-password practices.
Does PW Security and Backup provide multi-factor authentication?
The current feature set described on this website does not include built-in authenticator-app-based multi-factor authentication.
Where available, administrators should use a compatible multi-factor authentication solution as an additional security layer.
What happens if the custom login address or additional password is forgotten?
Use the hosting file manager or FTP to temporarily rename the plugin directory:
/wp-content/plugins/pw-security-and-backup/
For example:
/wp-content/plugins/pw-security-and-backup-disabled/
WordPress will stop loading the plugin under its original directory name. After access is restored, investigate and correct the relevant setting before renaming the directory back and reactivating the plugin.
What is an IP allowlist?
An allowlisted IP address is excluded from automatic login bans.
Only trusted and reasonably stable IP addresses should be added. Dynamic IP addresses may change and may later be assigned to a different user.
An allowlist should not be treated as proof that every request from the listed address is safe.
What is an IP blocklist?
A blocklisted IP address is denied access according to the plugin’s protection rules.
Confirm the address carefully before adding it. Do not block an address if it may belong to an administrator, hosting provider, monitoring service, reverse proxy or another required system.
Why is the wrong visitor IP address appearing?
A reverse proxy, content delivery network or load balancer may cause WordPress to see an intermediary server address instead of the original visitor address.
The hosting or proxy configuration should be checked before relying on IP-based restrictions. Trusting unverified forwarded headers can also create security risks.
Security hardening
What does security hardening mean?
Security hardening means reducing unnecessary exposure and applying protective configuration rules to WordPress or the hosting environment.
PW Security and Backup may provide controls for XML-RPC protection, REST API user-list protection, author-enumeration protection, directory-listing protection and blocking PHP execution in the uploads directory.
Hardening reduces particular risks but does not make the website immune to attack.
Which protection profile should be selected?
Standard Protection is generally the most appropriate starting point for a typical WordPress website.
Basic Protection applies a smaller set of controls. Maximum Protection may be more restrictive and can affect integrations or specialised features.
Review the included settings and test important website functions after applying a profile.
Can hardening settings affect other plugins?
Yes. A plugin, mobile application, publishing tool or external integration may depend on XML-RPC, REST API behaviour or another feature affected by a security rule.
Test forms, user accounts, mobile applications, WooCommerce functions, external connections and other important operations after applying new rules.
Can hardening changes be reversed?
Supported changes created through the plugin can be recorded in the Changes and Rollback area and reversed when rollback is available.
A rollback restores the relevant supported configuration change. It does not guarantee that every compatibility problem has been resolved, particularly if another plugin or administrator modified the same configuration separately.
File scanning
What does the File Scanner inspect?
The scanner reviews important WordPress areas for patterns that may require investigation. These areas can include WordPress core directories, installed plugins, themes, uploaded files and important configuration files.
It may report suspicious PHP patterns, command-execution functions, obfuscated code, hidden iframes, unusual filenames or other potentially risky content.
Does every scanner finding mean malware?
No. A finding means that a file or code pattern requires review.
Legitimate themes, plugins and custom software may use functions that also appear in malicious code. The file’s origin, path, content, modification date and relationship to recent updates should be investigated before action is taken.
Does the scanner automatically delete suspicious files?
No. Automatic deletion could damage WordPress or remove legitimate software.
The administrator must review the finding and decide whether the file is legitimate, should be ignored, requires quarantine or needs professional investigation.
What should be checked when a suspicious file is reported?
Review:
• The complete file path.
• The reported risk level.
• The relevant code or line.
• The finding description.
• The file’s modification date.
• Recent administrator activity.
• Recent WordPress, theme or plugin updates.
• The same file in an original verified package.
Do not execute an unknown file simply to discover what it does.
What does ignoring a finding do?
Ignoring a finding removes a verified item from the active findings list so it does not repeatedly distract administrators.
Ignoring a finding does not change the file or prove that it is safe. Add an explanatory note and review ignored findings again after software updates.
What is quarantine?
Quarantine moves a selected file away from its normal active location into a protected area.
This may prevent the file from continuing to operate, but it can also break WordPress, a theme or a plugin if the wrong file is selected.
Create a backup and confirm the purpose of the file before using quarantine.
Can quarantined files be considered permanently safe?
No. Quarantine is an isolation measure, not a complete incident-resolution process.
If malicious activity is confirmed, administrators should also investigate the entry point, affected accounts, other changed files, database content, scheduled tasks, server logs and installed software.
File-integrity monitoring
What is a file-integrity baseline?
A baseline is a trusted reference containing information about the website’s files and directories.
Later checks compare the current website with this trusted state and report modified, added or deleted items.
When should the first baseline be created?
Create the baseline only after confirming that the website is clean, updated and functioning correctly.
If a baseline is created while an unknown malicious file is present, that file may become part of the trusted reference.
When should a baseline be renewed?
A new baseline may be appropriate after:
• A verified WordPress update.
• A verified theme or plugin update.
• Approved development work.
• A controlled website migration.
• A completed and verified security clean-up.
Investigate unexplained differences before replacing the existing baseline.
Does a changed file always indicate an attack?
No. Normal software updates, cache processes, image optimisation, authorised development and configuration changes can alter website files.
Integrity monitoring shows that a change occurred. The administrator must determine whether it was expected and authorised.
Why are many changes reported after an update?
An update may replace, add or remove multiple files. This can produce a large number of legitimate integrity differences.
Confirm that the update came from a trusted source, verify that the website works correctly and then create a new baseline if the updated state is accepted as trusted.
Are large websites supported by integrity checks?
The plugin can process large file sets in smaller portions to reduce server load and timeout risk.
The exact completion time depends on the number of files, hosting resources, disk performance and other activity on the server.
Scheduled checks and notifications
Which operations can be scheduled?
Scheduled health and file-integrity checks can be configured at supported intervals.
The available schedule may include:
• Every 6 hours.
• Every 12 hours.
• Every 48 hours.
• Weekly.
• Every two weeks.
• Monthly.
Scheduling does not create automatic full backup archives in the current version.
Why did a scheduled check run late?
WordPress normally uses WP-Cron, which is triggered by website activity. On a low-traffic website, an event may run later than its planned time.
A real server cron can provide more consistent execution when the hosting provider supports it.
Which email notifications are available?
Depending on the selected settings, notifications may be sent for file changes, administrator logins and IP bans.
Email delivery relies on the WordPress mail system. If messages are not received, check the recipient address, spam folder, hosting restrictions and SMTP configuration.
Does an email warning prove that the website was compromised?
No. A notification means that an event matched the configured reporting conditions.
Review the related file, user, IP address, time and recent administrator activity before reaching a conclusion.
Backups
What does a full backup contain?
The manual full-backup process creates a ZIP archive containing WordPress files and database tables.
Because the archive may contain configuration values, user information, content and other sensitive data, it must be protected carefully.
Are backups created automatically?
No. Full backup creation is manual in the current version.
Scheduled health and integrity checks are separate operations and do not generate backup ZIP files.
Where are backup files stored?
Backup archives are stored in a randomly named, protected directory below the WordPress uploads directory.
This provides local access for the administrator, but important backups should also be downloaded and stored securely outside the same hosting account.
Why should a backup be stored outside the website server?
A backup stored only on the same server may become unavailable during a server failure, storage problem, hosting suspension, account compromise or destructive attack.
An external copy provides an additional recovery option.
How much storage is required for a backup?
The required space depends on the size of the WordPress files, uploaded media and database.
The server may require additional temporary space while creating the archive. Confirm that sufficient free disk capacity is available before starting a large backup.
Why did backup creation fail?
Common causes include:
• PHP ZipArchive is unavailable.
• The backup directory is not writable.
• The server has insufficient disk space.
• PHP memory or execution limits are too low.
• A hosting security rule interrupted the process.
• The browser page was closed before completion.
Check the displayed error, WordPress logs and hosting resource limits.
Can a backup be downloaded?
Yes. Available backup archives can be downloaded from the Server Backups area.
Store the downloaded file in a protected location. Do not place it in a public web directory or share it through an unsecured link.
Can old backups be deleted?
Yes. Backup archives can be deleted from the administration screen.
Deletion is permanent. Confirm that the archive is no longer required or that another verified copy exists before removing it.
Does uninstalling the plugin delete backup archives?
No. Backup ZIP files are deliberately preserved during uninstall so that removing the plugin does not automatically destroy recovery data.
The administrator remains responsible for downloading, retaining or manually removing those files securely.
Recovery
Can the plugin restore the complete website with one click?
No. The current administration interface does not provide automatic one-click restoration of the complete website and database.
It provides backup comparison and selected-file recovery. Full restoration may require hosting tools, database-management tools or professional assistance.
What is selected-file recovery?
Selected-file recovery replaces a current file with the corresponding version contained in a chosen backup.
It is useful when a particular file has been damaged or modified, but it must be used carefully.
What should be checked before recovering a file?
Confirm that:
• The backup belongs to the current website.
• The backup contains the required file version.
• The selected file is compatible with the current WordPress, theme or plugin version.
• A current recovery copy exists.
• The change can be reversed if the restored file causes a problem.
Testing in a staging environment is recommended for important websites.
Can a file that does not exist in the backup be deleted?
The comparison screen may offer deletion for a current file that is absent from the selected backup.
This does not automatically mean that the current file is unsafe. It may have been created legitimately after the backup. Delete it only after confirming its purpose and creating an appropriate recovery copy.
Does selected-file recovery restore database information?
No. Selected-file recovery operates on selected files.
Although a full backup archive may contain database tables, complete database restoration is not provided as a one-click operation through the current administration interface.
Live traffic and logs
What does Live Traffic record?
When enabled, Live Traffic can locally record a limited history of website requests, including request paths, IP addresses, HTTP methods, referrers and user-agent information.
It can classify activity as normal, bot-related or potentially suspicious.
Is Live Traffic enabled automatically?
No. Live traffic recording is disabled by default.
Enable it only when the information is needed and after considering website traffic, database growth, privacy obligations and retention requirements.
Does a suspicious traffic label prove an attack?
No. Traffic classifications are indicators based on request characteristics.
A legitimate tool, search engine, integration or unusual visitor request may sometimes appear suspicious. Review the available context before blocking an address.
Can traffic records be cleared?
Yes. Stored live traffic records can be cleared from the plugin screen.
Before clearing information related to an active security investigation, consider whether an authorised copy should be preserved.
What information is stored in security logs?
Logs may include the date and time, event type, event description, IP address and related WordPress user.
The exact records depend on which plugin features and events are active.
Can logs be exported?
Yes. Security logs can be exported in CSV format for authorised review.
Exported files may contain security-related or personal information. They should be stored securely and shared only with authorised people.
What does log retention control?
Log retention determines how long security records remain in the WordPress database.
A longer period provides more historical information, while a shorter period can reduce database growth. Choose a period appropriate for the website’s security, operational and legal requirements.
Security Analysis
What is the Security Analysis screen?
Security Analysis combines available plugin information into an overall assessment.
It may display a security score, risk score, priority risk, overall assessment, recommended actions, analysis metrics, risk records and the latest log summary.
Does a high security score prove that the website is safe?
No. The score is a practical configuration and monitoring indicator.
It cannot prove that every file, account, server component or external integration is secure. A high score should not replace updates, professional audits, external backups or careful administration.
Can the analysis report be downloaded?
Yes. The report can be downloaded in TXT format for authorised review or record-keeping.
Review the report before sharing it because it may contain information about the website’s security configuration.
Privacy and data handling
Does the plugin send telemetry to PW Feed or Poyraz Web?
No. The plugin does not send telemetry, scan findings, traffic records, login information, credentials or backup contents to PW Feed, Poyraz Web or another external service.
The plugin’s main security information remains within the user’s WordPress and hosting environment.
What personal or security-related information may be stored locally?
Depending on the enabled features, the website may store:
• IP addresses.
• WordPress usernames.
• Login-attempt records.
• Request paths.
• Referrer and user-agent information.
• Security events.
• File-integrity signatures.
• Scanner findings.
• Quarantine records.
• Backup archives.
Website administrators are responsible for access control, retention and applicable privacy requirements.
Does the plugin make a website automatically compliant with privacy laws?
No. Privacy and data-protection responsibilities depend on the website, its visitors, enabled features, operating location and applicable regulations.
The website administrator must determine which disclosures, retention periods and access controls are required.
Troubleshooting and support
What should be done if the website stops working after a security change?
Use hosting file-manager or FTP access to inspect or temporarily disable the plugin by renaming its directory.
After access is restored, review the most recently applied login or hardening setting. Do not reactivate the same configuration until the cause has been identified.
What information should be included in a support request?
Provide non-sensitive details such as:
• WordPress version.
• PHP version.
• PW Security and Backup version.
• The relevant administration screen.
• The exact error message.
• The operation performed before the problem appeared.
• Whether the problem continues after a compatibility check.
Never send passwords, database credentials, private keys or complete backup archives in a public support request.
What should never be shared publicly?
Do not publicly share:
• WordPress administrator passwords.
• The additional security password.
• Hosting or FTP credentials.
• Database usernames or passwords.
• Private keys or secret tokens.
• Complete backup archives.
• Unredacted logs containing sensitive information.
• Personal customer or user information.
Can the plugin replace professional security assistance?
No. The plugin provides practical monitoring, protection and recovery tools, but a serious compromise may require professional incident response.
Professional assistance should be considered when malicious code is confirmed, administrator accounts are unknown, files continue to return after removal, database content has been altered or the source of the compromise cannot be identified.
What regular maintenance is recommended?
A practical routine includes:
• Keep WordPress, plugins and themes updated.
• Review the Security Center regularly.
• Check failed-login attempts and IP bans.
• Run scans after important changes.
• Investigate unexplained integrity differences.
• Create a manual full backup before updates.
• Store important backups outside the hosting account.
• Review ignored findings.
• Confirm that notification emails are delivered.
• Remove unused plugins, themes and administrator accounts.
• Review traffic and log-retention settings.
• Test emergency access and recovery procedures.
PW Security and Backup is most effective when its tools are combined with careful administration, secure hosting, strong account protection, current software and verified external backups.
For detailed setup instructions, continue to the Documentation page. For assistance with a specific problem, visit the Support page.