Setup wizard

The wizard has seven steps. A progress bar shows where you are, Back never saves anything, and every step except the first and last can be skipped. Everything it sets can be changed later in Settings, and you can run it again from Qartvelo Guard > Setup Wizard.

1. Welcome

A short overview of what the plugin does. Press Let's start, or I will do this later to go to the Dashboard.

2. Environment

The plugin checks your server and lists problems first, then recommendations, then the checks that passed. It also says which hosting panel it detected; the fix steps follow that panel, and a Change link lets you pick another one.

The checks cover: PHP and WordPress versions, HTTPS, the data folder, whether held files can be opened from the web, whether the uploads folder blocks PHP, scheduled tasks (cron), auto_prepend_file, command execution and ClamAV, open_basedir, ZipArchive, wp-config.php permissions, code folders that every user on the server can write, the theme and plugin file editor, your hosting, the web server, installed plugins and other security plugins. Press Check again after you change something on the server.

Since 1.0.1, "Code folders other users can write to" finds plugin, theme and core folders that any user on the server can change (for example a plugin folder with drwxr-xrwx). The fix below handles the files PHP owns; for the rest, see Plugin folders writable by every user.

One-click fixes

When some findings can be fixed for you, a box offers Fix them all. Each fix is tested right away and undone if it would break something. It runs these, in this order:

Fix	What it changes
Move the data folder outside the web root	Moves the folder with held files next to (not inside) your WordPress folder, so it can never be opened from the web. Not offered on multisite or when the folder is set in wp-config.php.
Fix wp-config.php permissions	Sets the file to 640. Undone if WordPress can no longer read it. Not offered on Windows or when WordPress does not own the file.
Remove write access for other users	Removes only the write permission for other users (chmod o-w) from the listed code files and folders that PHP owns, never following symlinks, then checks again. Offered when PHP owns at least one of them.
Turn off the code editor	Switches off the theme and plugin file editor in the admin (the plugin defines DISALLOW_FILE_EDIT).
Block PHP in uploads	Writes a marked block into wp-content/uploads/.htaccess, then tests it live: a test PHP file must not run and a test text file must still load. Removed again if the test fails. On nginx you get the rule to copy instead.
Add the tamper-check key	Writes a random WPCYBERSEC_HMAC_KEY line into wp-config.php. It lets the plugin notice if someone edits its allowlist directly in the database.

The early upload guard and switching off WP-Cron are not part of Fix them all. They have their own buttons in step 6, because they need a decision.

3. Protection

Choose Strict, Balanced (recommended) or Relaxed, then fine-tune:

• New uploads: "Hold every upload" or "Hold only risky uploads". Uploads that look malicious are always held, whichever you choose.
• Hold administrators' own uploads too.
• Hold new plugin and theme installs.
• Move new unknown PHP files to quarantine automatically. Keep this off on development or staging sites where you edit code.

If your choices differ from the level you picked, the level is saved as Custom. Protection levels explains each setting.

The upload volume hint

The wizard counts the Media Library uploads of the last 30 days. When the site gets more than 15 uploads a day, it says so, for example: "This site receives about 40 uploads a day (60% from users who are not administrators). Holding every upload means approving about 40 files a day."

It then recommends Balanced, but holding only risky uploads, while new plugins and themes are still held. Press Use this to apply it. Clean images and documents then pass after the malware scan; anything that could run code still waits for you.

4. Baseline scan

Press Scan and trust current files. The plugin records a SHA-256 fingerprint of every file and checks each one for malware. It usually takes 1 to 5 minutes. If you leave the page, the scan continues in the background, more slowly.

Files that look like malware are reported as threats and are not trusted. Continue unlocks when the scan is done.

5. Alerts

• Instantly: an email as soon as something is held or found, at most one every 10 minutes. Anything else goes into the next one.
• Daily digest: one summary email per day.
• Off: no emails. You check the Reports page yourself.

Add recipients one per line; leave the box empty to use the site admin email. Send test email checks that mail arrives. A Webhook URL (https only, for example a Slack incoming webhook) is optional.

6. Server

This step is for system administrators and is optional. It offers:

• Block PHP in the uploads folder, if not done yet.
• Freeze mode: blocks every plugin, theme and core install, update, delete and editor action from the dashboard until you unlock it for a few minutes.
• Real cron job: the line for your panel or crontab, and Switch off visitor-triggered cron once a real cron job has run. See Real cron.
• Early upload guard: install and switch it on with one click where the server allows it. See Early upload guard.
• Antivirus (optional): the ClamAV status and Turn on ClamAV for uploads when it works. See ClamAV and maldet.
• wp-config.php additions: moving the data folder and the tamper-check key.

Press Finish setup to save.

7. Done

A summary of your protection level, how uploads and installs are handled, scheduled scans, the baseline, alerts, freeze mode, the guard and antivirus, with links to the Dashboard, Reports and the advanced settings.