# Security check-up

> A read-only check of updates, core files, suspicious code, administrators, exposed files and risky settings, with a plan for each finding.

Your AI app can run a security check-up on your site without changing anything: outdated software, changed core files, suspicious code, unexpected administrators, public files that should be private, and risky settings. Then it tells you what to fix first. The scan is heuristic: a clean result does not prove a site is clean.

## What you need

- **Read-only diagnostics** is enough for the whole check-up, including on the Free plan.
- Do not give the connection **Secrets** for this. See the note below.
- To fix findings you need more: **Plugins & themes** to update or remove plugins, **Users** to change accounts, **Files** to remove files.

## Before you start

- Read-only means safe: nothing is changed, deleted or cleaned up during the check-up. If your AI app finds a password or a key, it says where it is, not what it is.
- Before you fix anything, make a backup and set a checkpoint (see [Work safely on a live site](/docs/guides/safe-workflow/)).
- If you already know the site was hacked, stop here. Make a backup and ask a security professional to clean it up. A heuristic scan is no replacement.

> [!WARNING] The Secrets permission lets an AI app read wp-config.php credentials, API keys and password hashes, and edit wp-config.php and .htaccess. Whatever it reads becomes part of the conversation with your AI provider. Without Secrets, PowerWP AI masks such values in files, options and database answers. A check-up never needs it. Full access includes it, so give that preset only to people who must have it.

## Steps

:::steps
1. **Check what is outdated.** Old WordPress, plugins and themes are the most common way in.
   - Example prompt: `List everything on my site that is out of date: WordPress, plugins and themes. Flag anything that is far behind. Don't update.`
   - Your AI app will use `site_overview` and `updates_check` with a refresh.
2. **Compare core and plugin files with the official ones.**
   - Example prompt: `Check that the WordPress core files and my wordpress.org plugins are unchanged. List modified, missing and unexpected files. Tell me which plugins and themes could not be checked.`
   - Your AI app will use `integrity_check`. Premium plugins show as unverifiable and themes are not checked, so they are listed as unverified.
3. **Scan for suspicious files and code.**
   - Example prompt: `Run a security scan for the last 30 days: PHP files in uploads, obfuscated code, unknown must-use plugins, strange redirects in .htaccess and recently created administrators.`
   - Your AI app will use `security_scan`. A deeper scan of every PHP file is only for when something looks wrong.
4. **Review the accounts.**
   - Example prompt: `List my administrators, editors, shop managers and authors. Which accounts are new, unknown or unused? Is anyone allowed to register, and as which role?`
   - Your AI app will use `users_list` and `option_get`. Recently created administrators are flagged.
5. **Look at what is installed.**
   - Example prompt: `Which plugins and themes are installed but inactive, and which active plugins have no update path, so nobody seems to maintain them?`
   - Your AI app will use `plugins_list` and `themes_list`.
6. **Look for exposure.** Public logs, backups and leftovers, and settings that leak.
   - Example prompt: `Check whether debug.log, .env or a wp-config backup are publicly reachable. Look for leftover .sql, .zip and .bak files in the web root. Check debug settings, the security headers of the home page, and the permissions of wp-config.php.`
   - Your AI app will use `page_check` (a 200 answer on a file that is not a page means it is public), `fs_find`, `debug_mode` (status), `site_overview`, `server_info` and `fs_stat`. wp-config.php should be 0640 or stricter.
7. **Review sign-in attempts to PowerWP AI.**
   - Example prompt: `Show the security events of the last 30 days: failed attempts, lockouts, and connections from new addresses.`
   - Your AI app will use `audit_log`. It only holds events about connections to PowerWP AI. Failed WordPress logins can only be read in a security plugin's own log.
:::

## What to do with the findings

Ask for the report sorted into Critical, Should fix and Nice to have, with the evidence for each.

| Finding | What to do | Permission |
|---|---|---|
| Outdated plugin or theme | Update it. See [Update plugins and themes safely](/docs/guides/safe-updates/). | Plugins & themes |
| Unknown or unused administrator | Ask your team first. Then change the role or remove the account. Content is reassigned to another user. | Users |
| Inactive, unmaintained plugin | Remove it. Its folder is saved first, so the removal is recorded. | Plugins & themes |
| Public log, backup or leftover file | Confirm it is not needed, then remove it. | Files |
| Modified core file or suspicious code | Treat it as a possible break-in. Back up, then have the site checked and cleaned by a professional. | Backups & restore |
| Debug display on in production | Switch debug mode off. | Settings & maintenance |

## Check the result

- Run the check-up again and compare. The critical and should-fix lists are shorter.
- For the file checks, run `integrity_check` again after you fixed them.

## How to undo

The check-up changes nothing, so it has nothing to undo. Fixes made through your AI app are recorded in **PowerWP AI › Changes**: a removed plugin or file comes back with its snapshot, and a changed or deleted user is restored from the rows that were saved. Snapshots are kept for 30 days by default.

> [!NOTE] If your AI app sees signs of an active compromise, it should say so first, change nothing, and recommend a backup and a professional clean-up.

## Recipes that do this

[security_audit](/docs/reference/recipes/#security_audit) runs these steps and reports by severity. [monthly_checkup](/docs/reference/recipes/#monthly_checkup) repeats a short version each month. [diagnose_site](/docs/reference/recipes/#diagnose_site) looks at errors and performance as well. After a break-in or crash, use [site_recovery](/docs/reference/recipes/#site_recovery).

:::cards
- [Keys and access control](/docs/security/access-control/) — How connections are protected.
- [Permissions and presets](/docs/concepts/permissions/) — What the Secrets permission allows.
- [Update plugins and themes safely](/docs/guides/safe-updates/) — Close the update gap.
- [Fix a critical error](/docs/guides/fix-critical-error/) — If the site is down.
:::

Source: https://powerwp.ai/docs/guides/security-checkup/