FAQ

Does pausing a plugin deactivate it?

No. The pause is held in a file and applied while the page is being built. The plugin is still active in WordPress’s own list, nothing in the database is rewritten, and resuming it is one click. That is also why the crash guard still works when the database is the thing that broke.

The scan flagged a file inside a plugin I trust. Is it malware?

Probably not. Legitimate libraries do generate and evaluate code — a well-known cryptography library does it for performance. That is why a finding shows you the rule, the line and the code instead of a verdict. Mark as reviewed remembers that decision against the file’s contents, so it comes back on its own if the file is ever changed. Nothing is deleted or quarantined on your behalf. See the malware scanner.

Why does it say “recorded” instead of “verified” for my premium plugin?

Because WordPress.org has no checksums for it, so there is nothing authoritative to compare against. The plugin records the files itself and can tell you if they change later — which is genuinely useful, and a different thing from verification. It will not pretend otherwise. See file integrity.

Does it slow down every request?

The crash guard loads on every request, but on a production site its cost is effectively nothing — the one thing it would add, an output buffer, is only started when PHP is set to display errors to the browser, which a live site is not. The file and malware scanners cost nothing until a scan runs. Login protection only does work when someone signs in.

Does it scan on its own?

Yes. Unattended scanning is set to daily by default — you can change it to weekly or off on the Settings tab. It runs the file and malware checks in short steps so a full scan is not bound by one request, and it emails you when it finds something. A clean result sends nothing, emails are limited to one an hour, and they mention only findings you have not already reviewed.

My scheduled scans run late. Why?

WordPress only runs scheduled work when somebody visits the site, so a quiet site runs it late or not at all. The Settings tab counts how many jobs are overdue and gives you the exact cron line for your host. Once a real cron job is genuinely in place, it offers to take WP-Cron off your visitors’ page loads — storing a copy of wp-config.php before it makes the change, and refusing outright if it cannot store one first. There is also a keyed URL that runs only this plugin’s checks, for an external monitor or to force a scan by hand.

What happens on a false positive?

Nothing automatic. A malware finding is a reason to look, never an action: the scanner does not delete or quarantine anything on its own. You mark a finding reviewed once, and it only returns if that file’s contents change. The crash guard is just as careful in the other direction — it ignores the one class of error a healthy plugin can recover from, because a false pause is the worst thing it could do.

What if the Alovio server is unreachable?

Nothing stops working. The plugin has no licence key and no server-side dependency to run, so there is nothing to “deactivate” when our server is down. An update check that cannot reach the server never reads as “you are up to date” and never disturbs the Plugins screen — it simply tries again later. See licence & updates.

What data leaves my site?

Two things, and only when the relevant part is switched on:

• The update check sends one request to our server about twice a day, carrying the plugin slug, the version, your site’s domain, and the WordPress and PHP versions — no content, no customer data, and no key.
• The file integrity check fetches the official checksums from WordPress.org (api.wordpress.org and downloads.wordpress.org). Those requests carry your site’s address, the way WordPress’s own update requests do, ask for a public list, and send nothing about your files — the comparison happens on your own server.

Everything the plugin finds — pause state, integrity and malware findings, login counters — stays on your own site. The admin webfont is bundled with the plugin, so nothing is fetched from Google either. You can stop both outbound requests: ALOVIO_NO_UPDATE_CHECK for the update check, and switching the integrity module off for the checksum requests.

Does it work on multisite?

The uninstaller cleans every site in a network, but the interface is per-site and has not been through a full multisite test. Treat multisite as untested rather than supported.

Can I manage it from the command line?

Yes. Alovio Protect ships WP-CLI commands under wp alovio — for example:

wp alovio status                 # is the guard active? what is paused?
wp alovio modules                # list modules
wp alovio scan                   # run a file integrity scan
wp alovio malware                # run a malware scan
wp alovio snapshots              # list restore points
wp alovio restore <id>           # put a restore point back