Fixes a restore failure on busy sites, warns when WP-Cron is not running, applies retention immediately, and cleans up corrupted backups.<\/p>","1.1.0":"
Adds free encrypted Google Drive backups with one-click restore and undo.<\/p>","1.0.12":"
Fixes broken Update buttons on the Actions tab.<\/p>","1.0.11":"
Actions tab with update links and one-click exposure remedies.<\/p>","1.0.10":"
Clearer plugin title and directory tags for security search.<\/p>","1.0.9":"
Actionable findings plus local login attempt limiting.<\/p>","1.0.8":"
WordPress.org Plugin Check clean-up.<\/p>","1.0.7":"
Connects more reliably without editing wp-config.php.<\/p>","1.0.6":"
Privacy and uninstall cleanup.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3694724,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3694724,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3694724,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3694724,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3694724,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.10","1.0.11","1.0.12","1.0.8","1.0.9","1.1.0","1.1.1"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[151,2439,1229,600,139069],"plugin_category":[54],"plugin_contributors":[280611],"plugin_business_model":[],"class_list":["post-362788","plugin","type-plugin","status-publish","hentry","plugin_tags-backup","plugin_tags-brute-force","plugin_tags-login-security","plugin_tags-security","plugin_tags-vulnerability-scanner","plugin_category-security-and-spam-protection","plugin_contributors-korisec","plugin_committers-korisec"],"banners":{"banner":"https:\/\/ps.w.org\/korisec\/assets\/banner-772x250.png?rev=3694724","banner_2x":"https:\/\/ps.w.org\/korisec\/assets\/banner-1544x500.png?rev=3694724","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/korisec\/assets\/icon.svg?rev=3694724","icon":"https:\/\/ps.w.org\/korisec\/assets\/icon.svg?rev=3694724","icon_2x":false,"generated":false},"screenshots":[],"raw_content":"\n
Korisec is a hosted<\/strong> website security service. This plugin is the official WordPress client: it does not run port scans, Nuclei, or other scanners inside WordPress.<\/p>\n\n After you paste a plugin key from your Korisec account, the plugin:<\/p>\n\n Without a key, login protection and optional exposure remedies (XML-RPC, public usernames, install.php) still run locally. Those features do not send data to Korisec.<\/p>\n\n Backups are free for every site and do not need a Korisec key.<\/p>\n\n Paid plans, daily scan limits, and white-label PDFs are features of the Korisec service<\/strong>, not locked code inside this plugin. The plugin\u2019s PHP is fully available under GPLv2 or later.<\/p>\n\n Hosted security checks require a Korisec account and talk to Nothing is sent until a site administrator pastes a Typical payloads include this site\u2019s URL and host, WordPress and PHP versions, names and versions of installed plugins\/themes (and whether they are active), heartbeat, scan start\/status requests, and billing\/team\/alert settings for the Korisec account that issued the key.<\/p>\n\n Nothing is contacted until an administrator clicks Connect Google Drive<\/strong> on the Backups tab.<\/p>\n\n Backups are encrypted before they leave your server. The encryption key is stored in this site\u2019s database, wrapped with the salts in The plugin connects to Korisec automatically. You do not need to edit wp-config.php.<\/p>\n\n\n No. Checks run on Korisec workers. The plugin only reports inventory and displays results.<\/p><\/dd>\n The key authenticates this site to the Korisec API. It is not a license gate for local scanner code. Without a key the plugin does not contact Korisec.<\/p><\/dd>\n The hosted service pauses cloud checks until the account is renewed. The plugin itself remains installed and GPLv2 licensed.<\/p><\/dd>\n Disconnect on the Connection tab, or delete the plugin. Deleting removes the stored key from WordPress. Korisec account history is managed in the Korisec dashboard.<\/p><\/dd>\n Yes. Backups to your own Google Drive are free on any site and do not need a Korisec account or key. Storage comes from your Google Drive quota.<\/p><\/dd>\n No. The database and files are encrypted on your server before upload. Only someone with this site\u2019s key (or your downloaded recovery key) can decrypt them.<\/p><\/dd>\n Before every restore Korisec takes and verifies a safety backup of the current site. The restore swaps tables and folders in one step. You can then undo it with one click, or keep it once you have checked the site.<\/p><\/dd>\n Install WordPress and Korisec on the new server, connect the same Google Drive, then import your recovery key on the Backups tab. Your backups appear and can be restored.<\/p><\/dd>\n wp-config.php is included in every backup but is not overwritten on restore, so database credentials for a new host are kept. WordPress core files are not backed up; reinstall core from WordPress.org. Multisite networks are not supported yet.<\/p><\/dd>\n Backups stay in your Google Drive. The encryption key is kept in the database so a reinstall can still read them. Download the recovery key before moving or wiping the site.<\/p><\/dd>\n Yes. In wp-config.php set \n
Free encrypted backups to Google Drive<\/h4>\n\n
\n
wp-content<\/code> (plugins, themes, uploads) plus wp-config.php<\/code><\/li>\nExternal services<\/h4>\n\n
https:\/\/api.korisec.com<\/code> (unless you set KORISEC_API_BASE<\/code> in wp-config.php).<\/p>\n\n\n
kr_live_\u2026<\/code> key and clicks Connect.<\/p>\n\nData sent after Connect<\/h4>\n\n
Google Drive backups<\/h4>\n\n
\n
https:\/\/www.googleapis.com<\/code>, https:\/\/oauth2.googleapis.com<\/code>) stores the encrypted backup files in a \u201cKorisec Backups\u201d folder in your own Drive. The plugin asks only for the drive.file<\/code> permission, so it can see only the files it created. Google\u2019s terms: https:\/\/policies.google.com\/terms and privacy policy: https:\/\/policies.google.com\/privacy<\/li>\nhttps:\/\/api.korisec.com<\/code>, the same service that runs Korisec\u2019s own Sign in with Google) completes the Google sign-in and renews short-lived Google access tokens, because Google requires a client secret that cannot ship inside a plugin. The relay receives this site\u2019s admin URL, a one-time public key, and (on each renewal) the Google refresh token. It returns the tokens encrypted to this site and stores nothing. It never receives backup contents or your encryption key.<\/li>\n<\/ul>\n\nwp-config.php<\/code>, and can be downloaded as a recovery key.<\/p>\n\n\n\n
\n
Does this plugin scan my server?<\/h3><\/dt>\n
Why do I need a key?<\/h3><\/dt>\n
What if my Korisec plan ends?<\/h3><\/dt>\n
How do I stop sending data?<\/h3><\/dt>\n
Are backups really free?<\/h3><\/dt>\n
Can Korisec or Google read my backups?<\/h3><\/dt>\n
What happens if a restore goes wrong?<\/h3><\/dt>\n
What if I lose the whole site?<\/h3><\/dt>\n
What is not restored automatically?<\/h3><\/dt>\n
What happens to backups if I delete the plugin?<\/h3><\/dt>\n
Can I point the plugin at my own API?<\/h3><\/dt>\n
define( 'KORISEC_API_BASE', 'https:\/\/your-host.example' );<\/code><\/p><\/dd>\n\n<\/dl>\n\n\n1.1.1<\/h4>\n\n
\n
1.1.0<\/h4>\n\n
\n
1.0.12<\/h4>\n\n
\n
1.0.11<\/h4>\n\n
\n
1.0.10<\/h4>\n\n
\n
1.0.9<\/h4>\n\n
\n
1.0.8<\/h4>\n\n
\n
1.0.7<\/h4>\n\n
\n
1.0.6<\/h4>\n\n
\n
1.0.5<\/h4>\n\n
\n
1.0.4<\/h4>\n\n
\n
1.0.3<\/h4>\n\n
\n
1.0.2<\/h4>\n\n
\n
1.0.1<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n