Reports and approvals

Everything the plugin holds or finds ends up on Qartvelo Guard > Reports. This is where you decide. A count on the menu shows how many items wait for you, and the alerts you chose in the wizard tell you when something new arrives.

The tabs

Tab	What it shows
Pending approvals	Held uploads, plugin and theme installs, unknown files and new administrator accounts that wait for your decision.
Threats	Files and database values that look like malware.
Quarantine	Items whose file is in the locked quarantine folder.
History	Every decision: who decided, when, and what happened to the file.
Recent changes	Code and configuration files modified in the last 7, 14 or 30 days, and what explains each change. See Scanning.
Allowlist	Every fingerprint, plugin, theme and database value you approved.
Activity	Everything the plugin did or was asked to do, with user and IP address. Kept for 90 days by default.

Allow, Deny and the other actions

Action	What it does
Allow	Allows the item and remembers its SHA-256 fingerprint permanently. The exact same file is never held again, wherever it appears.
Deny	Rejects a held upload or install and deletes the held copy.
Mark safe	For a threat you know is a false positive: this exact content is trusted from now on.
Quarantine	Moves the file to the locked quarantine folder where it cannot run. You can restore it later.
Restore	Puts a quarantined file back where it was, without trusting it.
Delete	Deletes the file permanently. This cannot be undone.
Restore official file	Replaces a modified WordPress core file with the verified official copy. The current version is kept as a copy.
Remove admin role	For a new administrator account: turns it into a subscriber, removes super admin rights and signs it out everywhere.

What happens after Allow depends on where the file came from:

• Media Library uploads are added to the Media Library automatically, in the original upload folder and with the original author.
• Plugin and theme ZIPs and installs: upload or install them again and they go through without being held.
• Uploads to other forms: the file is allowed; ask the sender to upload it again.

Each row also has Details, Download (saved with a .quarantined extension so it cannot run by accident) and, for code files, Changes or View code.

Deny first on risky items

When an item is rated high or critical, the safe action (Deny, Quarantine or Restore official file) becomes the main button. Allow and Mark safe still work, but ask first: "Allowing it remembers its SHA-256 fingerprint for good: this exact file is never held or reported again, wherever it appears on the site. Only continue if you know the file and trust where it came from."

Files that cannot be quarantined

Files WordPress needs to start, such as wp-config.php, index.php, wp-load.php, wp-settings.php, the root .htaccess and core files in wp-admin and wp-includes, are never quarantined, denied or deleted, because the site would stop working. When they differ from the official file you get Restore official file. If many core files are affected, use the clean core reinstall.

The "what changed" view

For a modified file, Changes opens a line-by-line diff against the last version you approved or, for WordPress core and WordPress.org plugins, the official original. Each malware match is linked to its line. Switch between Unified and Split. Passwords, keys, salts and tokens are replaced with ******** and never shown; when such a value changed, the page only names it.

Image previews

Held JPEG, PNG, GIF and WebP uploads show a thumbnail and a larger preview, so you can recognise a photo without downloading it. A preview is only shown after the plugin has verified that the content really is an image of that type. Risky files and SVG files never get a preview.

Allow all clean images

On sites with many uploads, Allow all clean images on the Pending tab allows every waiting upload that is a verified JPEG, PNG, GIF or WebP image with no findings at all, and adds each one to the Media Library, exactly like a single Allow. Everything else stays for you to review one by one.

Bulk actions

Tick several rows, choose an action under Bulk actions and press Apply. The available actions depend on the tab:

• Pending approvals: Allow, Deny, Quarantine, Delete.
• Threats: Mark safe, Quarantine, Restore, Delete.
• Quarantine: Allow, Restore, Deny, Delete.
• History: Allow, Quarantine, Restore, Delete.

Rows that cannot take the chosen action are skipped and named in the result.

The allowlist

Every approval is stored on the allowlist. A file approved under a harmless name (for example photo.jpg) is never accepted under an executable name (such as photo.php), even with the same content: running as code needs its own approval. Approved plugins and themes are stored by folder name, database values by their own fingerprint.

Remove takes an entry off the list. No file is deleted, but the next time it appears it is held for your approval again.

Database findings

Scripts found in options, widgets or posts are cleaned where they are stored, for example by editing the post or the widget. The report closes by itself after the next scan that no longer finds them. If a finding is your own code, use Mark safe.

Where held files are kept

Held copies are stored in the plugin's data folder under random names with a .bin extension, so they cannot run even if someone finds them. They stay until you decide: there is no automatic expiry.

The security report

Download report at the top of the Dashboard and Reports pages creates one HTML file with the scan results, every open item with the code that triggered it, your settings, server checks and recent activity. Passwords, keys and other secret values are hidden and email addresses shortened, so it is safe to send to your developer or host. From the command line: wp wpcybersec report --file=report.html.