On the Security plans, Backvera scans the backups of your site for malware and for signs of an attack. The scans run on Backvera’s servers against the backups already in the Backvera Cloud, so your site does no extra work. A Backvera security analyst confirms each threat before it appears in your dashboard.
Which plans include it
Security scanning comes with the Security plans: Security Starter, Security Business, and Security Scale. Each one includes everything in the matching backup plan, so storage, retention, and restores stay the same. Free and the backup-only plans do not include security scanning.
Plans are set per site. Once a site is on a Security plan, a Security tab appears on it. To move a site to a Security plan, see Buy, change, or cancel a plan. For prices, see the pricing page.
What each scan checks
Each scan reads one backup of your site, including its database.
- Files compared with official releases. WordPress core and every plugin and theme from WordPress.org are compared, file by file, with the release your site runs. Changed files, files that belong to no release, and plugin releases found to ship with a backdoor are flagged.
- Malware rules. Your files are matched against rules for backdoors, web shells, spam injections, and malicious redirects. Backvera follows live injection campaigns and writes new rules from what it finds.
- The database. New administrator accounts, user roles given takeover rights, sign-ups that create administrators, a site address pointed at another domain, suspicious scheduled tasks, and scripts hidden in posts or settings.
A person confirms each threat
Automated checks raise false alarms, so a Backvera security analyst looks at everything they flag. Only what the analyst confirms is malicious appears in your dashboard, marked Confirmed malicious. Anything found harmless stays out of it.
No confirmed threats means nothing in the latest checked backup has been confirmed malicious. It does not promise that the site is free of malware: new kinds of attack keep appearing, and Backvera adds rules as it finds them.
When backups are checked
Backvera checks new backups automatically after they finish. The Security tab reports on the newest full backup that has been checked, for example Checked the backup of Oct 22, 2026, 3:10 AM., and says how many newer backups are still waiting. Until the first check, it reads Not checked yet.
Where threats show up
- Sites list. A red badge, such as 2 threats, takes the place of the site’s Healthy status. A red Security threats panel above the summary cards lists the affected sites, the Needs attention card counts them first, and the status filter gets a Security threats option.
- The site page. The same badge shows next to the site name, the Security tab shows a count, and the Overview tab shows Threats found with a Review threats button.
- Security tab. Each threat with its file path or database entry, the plugin or theme it belongs to, and the first backup that contained it. See A threat was found on my site: what to do next.
- History tab. A grey shield marks a backup that was checked with no confirmed threats, and a red badge marks a backup that contains one. A backup with no mark has not been checked.
- Files tab. When you browse a backup that contains a threat, a banner lists the affected files, and each one is marked Malicious in the tree.
The Sites list can take a few minutes longer than the Security tab to show a change. Backvera does not send emails or notifications about threats, so check the Sites list or the Security tab to see them.
What Backvera does not do
- It does not remove malware for you. The Security tab shows what was found and the first backup that contained it, so you can remove it or restore from a backup taken before it appeared.
- It has no firewall and no login protection. If you use a security plugin for those, keep it.
- It checks your backups, not your live site. A change made after the latest checked backup shows up once a newer backup is checked.
Still need help? Email our team at [email protected].