Product docs
Set up local WordPress security reviews, login protection, firewall controls, file-integrity checks, incidents, and optional cloud-connected security workflows.
Editorial trust
Problem, cause, fix, verify
Problem
Security Center is local-first, so setup guidance must separate free in-admin checks from optional cloud policy, monitoring, reporting, and response features.
Why it matters
Free local checks remain useful without a paid plan or cloud connection.
Safe check
Install and activate Web Plura Security Center from WordPress.org or a trusted plugin ZIP.
Verify
Review filenames, dates, contents, and upload paths before removing confirmed malicious files and blocking execution where hosting supports it.
On this page
Scope
For: WordPress administrators and agencies responsible for security review and response.
Quick Start
Install and activate Web Plura Security Center from WordPress.org or a trusted plugin ZIP.
Open the Security Center dashboard in wp-admin and run the first local security review.
Review suspicious files, administrator drift, risky uploads, debug exposure, login protection, and firewall findings before changing the site.
Enable only the protections the site is ready to support, then test login, forms, checkout, REST, and editor access.
Use Pro or Cloud language only for connected monitoring, response, reporting, or shared team workflows that are active for the site.
Workflow
Install the WordPress plugin, open the Security Center area in wp-admin, and start with local checks for suspicious file changes, public-risk indicators, risky configuration, administrator drift, uploads, debug logs, and component changes.
Use login protection, firewall rate-limiting and temporary blocking controls, incidents, audit views, and email notifications where they fit the site.
Cloud-assisted checks, policy sync, command polling, scheduled reports, virtual patching, and incident workflows belong to the connected plan layer when the active entitlement allows them.
Tutorials
Use the local dashboard to create a baseline before you remove files, change users, or install another security layer.
Harden the public login surface while preserving administrator recovery, form submissions, checkout, and integrations.
Guides
Use the product after suspicious changes, before maintenance windows, and during agency handoffs to organize evidence before cleanup.
Open related guideSecurity Center can support the local evidence layer, while hosts, developers, or response teams handle server-level compromise and code repair when needed.
Open related guideCommon Problems
Symptom: Executable files are found where only media files are expected.
Resolution: Review filenames, dates, contents, and upload paths before removing confirmed malicious files and blocking execution where hosting supports it.
Open related problemSymptom: wp-login.php receives noisy failed attempts even after passwords are changed.
Resolution: Combine account cleanup, 2FA or passkeys, rate limiting, temporary blocking, and recovery planning.
Open related problemSymptom: A file or configuration is flagged after a legitimate update.
Resolution: Compare findings with update timing and known plugin/theme ownership before deleting or replacing files.
Open related problemFAQ
No. The WordPress.org package provides local security checks and admin workflows without a cloud account.
No. Suspicious file samples are not uploaded automatically by the free plugin.
The local advisor checks are designed as review workflows. Treat cleanup or account changes as administrator-approved actions.
Use connected workflows when a site needs shared reporting, monitoring, response coordination, or hosted security operations that are verified for the active plan.
Free vs Pro
Local scans, login protection, firewall controls, incident visibility, reports, admin guidance, privacy tools, and plugin-owned data controls are the Free baseline.
Pro may extend the local workflow through the matching add-on and verified entitlement, but the free local security baseline remains usable.
Cloud-backed support, hosted security operations, cross-site workflows, policy, reporting, or response features require explicit connection and consent.
Do not present future security automation as available unless the product catalog and plugin source both verify it.
Verified Sources
Continue
