FAQ

Can a WordPress plugin really detect a bug in PHP?

It can tell whether your PHP version is vulnerable, which temporary protections are on, and whether the traces researchers describe appear in your logs — and it can find the backdoors an attacker leaves afterwards. It can't see inside PHP's memory or stop the attack; only updating PHP does that.

Will it change, quarantine or delete anything?

Scans never do. Changes happen only when you click a fix button (or run wp jat-shell fix): a file is moved into quarantine and renamed so it can't run, or an admin is made a Subscriber. Every fix can be undone from the Quarantine tab. See One-click fixes.

Will it slow my site down?

No. It does nothing for visitors. Scans run only when you click Scan or on the weekly schedule, in short slices.

It says "Vulnerable". Was I hacked?

Not necessarily. "Vulnerable" means no evidence of a break-in was found, but your PHP or WordPress can be attacked. Get it updated, then scan again.

It says "No signs". Am I definitely safe?

It means none of the known traces were found. Attackers can rename and rewrite things, and PHP2Shell's memory leak leaves nothing on disk, so no scanner can promise 100%. If your site ran a vulnerable PHP after October 17, 2026, change your passwords and keys anyway.

Does it work alongside Wordfence / Sucuri / Solid Security / my host's scanner?

Yes. It's narrowly focused on these two attacks and recognises those tools' files. It complements them rather than replacing them.

Does it send my data anywhere?

No. See Privacy and stored data.

Can I remove it once I'm sure my site is clean?

Yes — deactivate and delete it; it removes everything it stored. Keeping it gives you weekly checks and alerts as new indicators are added.

I installed a version before 1.6 from GitHub. How do I move to 1.6?

Version 1.6 renamed the plugin to JAT Shell Scanner, including its folder (jat-shell-scanner) and this repository, so older copies don't update to it by themselves. Deactivate the old copy, upload jat-shell-scanner.zip from the latest release and activate it, then remove the old wp2shell-scanner folder with your host's file manager or SFTP. Removing it that way keeps your settings, scan history and quarantine; Delete on the Plugins screen would erase them.