Configure Omega Security Engine Pro

1. Review firewall, IP handling and login-guard settings before enabling stronger controls.
2. Only trust proxy headers when the hosting/CDN proxy path is known and explicitly configured.
3. Create or refresh the File Integrity baseline before relying on later change reports.
4. Treat malware scan results as indicators for administrator review; the plugin does not automatically delete files.
5. Enable HSTS, CSP, HTTPS redirects or REST restrictions only after site-specific testing.
6. Keep HSTS and CSP opt-in unless the site is already fully compatible with the intended policies.
7. Review security logs and scheduled maintenance behavior after configuration changes.

1. Back up the WordPress site/database and install/activate the plugin.
2. Open Omega Security and review settings before enabling high-impact hardening.
3. Configure IP handling, login protection and optional firewall/hardening controls.
4. Run a manual File Integrity scan/baseline.
5. Run the malware scan and review indicators.
6. Enable HSTS, CSP, REST restriction, HTTPS redirect or proxy headers only when the site environment has been tested for them.
7. Review security logs and scheduled maintenance behavior.

• HSTS and CSP are off by default.
• REST restriction is off by default.
• Proxy IP headers are ignored unless explicitly trusted.
• Malware findings do not trigger automatic deletion/healing.
• DISALLOW_FILE_MODS, FORCE_SSL_ADMIN and WP_DEBUG are not forced.
• Asset version query strings are preserved.
• Admin actions require capabilities and nonces.

After configuration, test the pages, forms, checkout/payment flows, authentication, media, scripts/styles and integrations that matter to the site. Use staging where practical for higher-risk changes.