Description
PW Security and Backup brings practical WordPress security and backup tools into one administration panel.
Main features:
- Login attempt limiting and temporary IP bans.
- Optional custom login path, additional password, and challenge question.
- WordPress hardening controls with rollback support.
- Suspicious-code scanning for WordPress files.
- SHA-256 file integrity baselines and chunked site-directory monitoring.
- Email notifications for administrator login, file changes, and IP bans.
- WordPress site-file and database backups in ZIP format, excluding authentication secrets and environment configuration files.
- Read-only backup comparison without overwriting or deleting WordPress core, theme, or plugin files.
- Security logs, traffic records, and a security analysis report.
- Translation-ready English source interface for translate.wordpress.org.
Login-path hiding and live traffic recording are disabled by default. They can be enabled after the administrator reviews the related settings and confirms that the hosting or proxy configuration is compatible.
The plugin does not require a license key, send telemetry, or load remote scripts. Email notifications are sent through the WordPress mail system to the configured address when enabled.
Important: WordPress scheduled events depend on site traffic unless the hosting provider runs a real server cron. FTP changes are reported after a complete scheduled integrity scan finishes.
Privacy
The plugin does not send telemetry, scan results, traffic records, credentials, or backup contents to PW Feed or another external service.
Security logs may store an IP address, WordPress username, event time, and event description. When live traffic recording is explicitly enabled, the plugin locally stores a limited rolling set of request paths, IP addresses, request methods, referrers, and user-agent strings. Administrators can clear these records from the plugin screens. The configured retention period applies to security logs.
Quarantined files and their local metadata are stored below the WordPress uploads directory in the plugin-specific pw-security-and-backup storage directory. The quarantine directory has a random component and access-blocking files. Quarantine data is not sent to an external service.
Email notifications are sent through the site’s WordPress mail configuration to the address selected by the administrator. Backups can contain personal and sensitive site data because they include site files and database tables. WordPress authentication configuration files, including wp-config.php and environment files, are excluded. Backup archives are placed below the WordPress uploads directory in the plugin-specific pw-security-and-backup storage directory with a random component and access-blocking files. Archives are downloaded through a capability- and nonce-protected administration action. Server-level access rules should also protect the uploads directory on hosting configurations that do not honor Apache or IIS access files.
More Information
For more information, documentation, and product updates, visit PW WordPress Plugin. Turkish-language information is available at PW WordPress Plugin Türkiye.
Screenshots
Installation
- Upload the plugin ZIP through Plugins > Add New > Upload Plugin, or install it from the WordPress Plugin Directory.
- Activate PW Security and Backup.
- Open PW Security in the WordPress administration menu.
- Review the login, hardening, notification, scan, integrity, and backup settings before enabling changes.
- Create a file-integrity baseline after confirming that the site files are clean.
FAQ
-
Does the plugin send data to an external service?
-
No. It does not send telemetry or security scan data to PW Feed.
-
Visit https://www.pwfeed.com or email support@pwfeed.com.
-
Are FTP file changes detected immediately?
-
Not at the exact moment of the FTP operation. WordPress cannot observe an FTP event directly. The chunked integrity scan detects new, modified, or deleted files when the scheduled scan reaches them and sends a summary after the scan completes.
-
Why can scheduled scans run late?
-
WP-Cron normally runs when the site receives a request. On low-traffic sites, configure a real server cron to request WordPress cron regularly.
-
Where are backups stored?
-
Backups are stored in a protected directory below the WordPress uploads directory. Access-blocking files are created for common Apache and IIS configurations.
-
Does uninstalling remove plugin settings?
-
Yes. Uninstalling from the WordPress Plugins screen removes plugin settings, reports, logs, and scheduled events. Backup ZIP files are deliberately preserved so an uninstall does not destroy recovery data.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“PW Security and Backup” is open source software. The following people have contributed to this plugin.
Contributors
Translate “PW Security and Backup” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
3.1.11
- Excluded
wp-config.php, environment files, and related configuration copies from all newly created backups. - Added a warning for legacy backup archives that may contain authentication secrets and blocked comparison of those archives.
- Moved backup and quarantine data into the plugin-specific directory resolved through
wp_upload_dir(). - Replaced hard-coded theme and content paths with WordPress directory APIs.
- Removed runtime definition of
DISALLOW_FILE_EDIT; the plugin now reports the existing configuration without changing it. - Replaced direct server-rule file writes with WordPress marker management.
- Made backup comparison read-only and removed operations that overwrote or deleted WordPress core, theme, or plugin files.
3.1.10
- Replaced plugin-owned three-character identifiers with the unique
pwfsabprefix. - Moved plugin classes to the
PWFeedTR\SecurityAndBackupnamespace. - Aligned the WordPress.org contributor and website metadata with
pwfeedtrandpwfeed.com. - Standardized plugin-owned administration slugs, assets, cron hooks, storage keys, backup names, and quarantine paths.
- Fixed XML-RPC blocking so it no longer refers to an undefined server class.
- Aligned the plugin author identity with PW Feed, pwfeed.com, and the
pwfeedtrWordPress.org account. - Sanitized request, query-string, login-field, settings, scanner, and backup-path inputs before use.
- Removed bundled runtime translation files and explicit translation loading for WordPress.org language packs.
3.1.9
- Corrected translatable numbered placeholders reported by the WordPress.org automated plugin scan.
- Added the remaining Reporting label to the translation catalogue.
- Updated the plugin version and stable tag for the corrected WordPress.org submission package.
3.1.8
- Corrected numbered sprintf placeholders in translatable administrator-login and IP-ban notification messages for WordPress Plugin Check compatibility.
- Moved the remaining Reporting label into the standard translation catalogue.
- Completed a source-level English and Turkish localization audit and removed all HTML and JavaScript from translation entries.
- Moved administration interactions and confirmation prompts to an enqueued JavaScript file.
- Corrected remaining mixed-language labels, stored scanner risk keys, traffic status keys, plural strings, and locale-sensitive analysis reports.
- Hardened request handling, verified client IP handling, CSV exports, secure-cookie behavior, notification preferences, and private backup directory naming.
- Disabled login-path hiding and live traffic recording by default for safer first activation and documented local privacy-related data.
- Added administrator-login notifications and cleared all plugin cron hooks during uninstall.
3.1.7
- Audited the complete translation catalogue and corrected mixed Turkish-English source strings.
- Removed nested gettext calls and corrected untranslated conditional interface messages.
- Rebuilt the POT, PO and MO language files from the corrected English source.
3.1.6
- Replaced the legacy runtime translation dictionary with standard WordPress gettext source strings.
- Completed English-source coverage for administration screens, notices, email messages, scheduled tasks, scanner results, backup operations, and conditional interface states.
3.1.5
- Added English translations for short Latin-only Turkish status labels and dynamic analysis metrics missed by the previous character-based audit.
- Covered scan totals, skipped files, traffic metrics, protection level, risk labels, action labels, and empty-state values.
3.1.4
- Expanded English coverage for legacy Turkish administration text, scanner findings, hardening controls, backup messages, reports, and emergency recovery guidance.
- Added complete sentence translations to prevent mixed Turkish-English interface output.
3.1.3
- Moved explicit translation loading to the WordPress
initaction. - Removed early translation calls from stored default settings to prevent WordPress 6.7+ just-in-time translation warnings and related header warnings.
3.1.2
- Fixed invalid translated default parameter expressions that caused a PHP fatal error while loading the plugin.
- Kept translated fallback messages inside the affected methods for PHP 7.4 and later compatibility.
3.1.1
- Prepared the package for the WordPress Plugin Directory.
- Standardized the permanent slug and text domain as
pw-security-and-backup. - Added a WordPress.org-compatible readme and uninstall cleanup.
- Connected legacy interface text to standard WordPress gettext calls while retaining a compatibility fallback.
- Expanded the POT and Turkish PO/MO catalogs for administration, email, log, CSV, and error messages.
- Preserved chunked full-directory integrity monitoring from version 3.0.8.