Settings and Alerts

All settings are on the scanner page (Tools → JAT Shell Scanner, right-hand box):

Setting	Default	What it does
Automatic scans	Weekly	Off, Daily or Weekly. The first run happens within an hour of activating.
Email me when an automatic scan finds something new	On	Emails only when a scheduled scan finds a new High/Critical problem, or the site becomes vulnerable. You won't get the same alert twice.
Alert email address	Site admin email	Where alerts go.
Core and plugin files	On	Downloads the official checksums for your WordPress version and for each plugin from wordpress.org (cached for a day).
PHP error log (Server logs)	Detected automatically	Where PHP2Shell attempts show up. Leave empty to use the log PHP reports, plus WordPress's debug.log.
Web server access log (Server logs)	(empty)	Optional. Lets scans spot attack traffic. See Finding your logs.

The bottom of the box shows the PHP your website runs (version, server type, operating system), as seen by the scanner.

You'll also see results:

• in a red notice across the admin area when the result is Compromised, Suspicious or Vulnerable (dismissible; it comes back only if a later scan is still bad),
• under Tools → Site Health, which also warns when the last clean scan is out of date.

How a scheduled scan runs on a host with short time limits:

sequenceDiagram
    participant C as WP-Cron
    participant S as Scanner
    participant DB as Database
    participant M as Your inbox
    C->>S: Weekly scan is due
    S->>DB: Start a scan job
    loop Until finished
        S->>S: Scan for as long as this request safely can
        S->>DB: Save its exact place
        S->>C: Schedule the next slice
    end
    S->>DB: Save the report
    alt New High or Critical problem
        S->>M: Plain-text alert (once per problem)
    else Nothing new
        Note over S: Stays quiet
    end

Loading

Note

WordPress's built-in scheduler only runs when someone visits the site. On a very quiet site a scheduled scan may take a while — it always picks up where it left off, and is only abandoned after a full day with no progress. With a real server cron (DISABLE_WP_CRON), scans run in bigger slices.