Troubleshooting

Troubleshooting

Problem	Likely cause	Fix
No Upload Plugin button	Host or plan blocks uploads, or DISALLOW_FILE_MODS	Ask your host to install it, or use WP-CLI
"PHP … is vulnerable" but my host says it's patched	Your host uses OS packages that keep the old version number	If they confirm both CVEs are fixed, click Ignore on that finding
PHP version shown is "command line"	The scan ran from WP-CLI and the dashboard hasn't been opened since installing	Open the scanner page once in the dashboard; the website's PHP is then remembered
Progress bar stops with "HTTP 500/503/504"	Host killed the request, or a temporary hiccup	It retries three times. Click Scan again — it continues where it stopped.
"Waiting for another scan in progress…"	Another tab or a scheduled scan is working on the same scan	Normal — they take turns
"Your session expired"	You were logged out	Reload the page and log in again
"Couldn't get core checksums"	Server can't reach wordpress.org	Harmless; other checks still ran
"Log file not readable"	Wrong path, or PHP isn't allowed to read it (open_basedir, permissions)	See Finding your logs, or leave the setting empty
Lots of Low findings about plugin/theme updates	Things were updated after July 17	Expected. Glance at the names; Ignore them.
it-api.php in the site root	Your host's one-click installer (Installatron, used by IONOS and others)	Shown as information since 1.3.2. Safe to leave; it deletes itself after a while
A hidden .ht….appconfig.php (or similar) file	A plugin storing a key or settings in a file that can only answer "404"	Low since 1.3.2. Check its date against when you installed plugins; quarantining it is harmless
wp-includes/collaboration/… files flagged	Left over from WordPress 7.0 (later versions removed them)	Low since 1.3.1 if they match the official files; safe to delete
temp-write-test-… files in wp-content	WordPress's own write check, not cleaned up	Low since 1.3.1 when they predate the attacks; safe to delete
An admin you know is flagged	Created (or promoted) after July 17 / since the last scan	If it's yours, click Ignore
"A role has administrator powers"	A plugin (e.g. a membership or shop plugin) changed a role	If you trust that plugin, click Ignore
Weekly scans don't seem to run	Quiet site, or WP-Cron disabled with no server cron	Visit the site now and then, or ask your host for a real cron
No alert emails arrive	Your site can't send email	Install an SMTP plugin; check the alert address
"The … stopped early: …" info finding	One check hit an unexpected error; the rest still ran	Please open an issue with that message

Finding your logs

Logs let the scanner see attack attempts, not just leftovers. Both are optional, and PHP must be allowed to read them — on shared hosting it often can't, and that's fine.

PHP error log — where PHP2Shell attempts show up. Leave the setting empty and the scanner uses the log PHP itself reports plus WordPress's debug.log.

Setup	Typical location
PHP-FPM (Debian/Ubuntu)	/var/log/php8.3-fpm.log (pool errors), or the error_log set in the pool config
PHP-FPM (RHEL family)	/var/log/php-fpm/www-error.log
Apache mod_php	Apache's error log (below) — PHP lines are tagged [php:error]
cPanel	error_log files in the site folders, or ~/logs/
WordPress	wp-content/debug.log when WP_DEBUG_LOG is on

Web server access log

Setup	Typical location
Apache on Debian / Ubuntu	/var/log/apache2/access.log · errors: /var/log/apache2/error.log
Apache on RHEL / Alma / Rocky	/var/log/httpd/access_log · errors: /var/log/httpd/error_log
Nginx	/var/log/nginx/access.log · errors: /var/log/nginx/error.log
LiteSpeed / OpenLiteSpeed	/usr/local/lsws/logs/access.log
cPanel	~/access-logs/<your-domain> · server-wide /usr/local/apache/domlogs/<your-domain>
Plesk	/var/www/vhosts/<your-domain>/logs/access_log
Managed WordPress hosts	Usually not readable by PHP — use the host's log viewer, or ask support

Attacks began October 17, 2026 — make sure the logs you check go back that far. Rotated logs (access.log.2.gz) work too: wp jat-shell scan --log=/var/log/nginx/access.log.2.gz.

Hosting compatibility

Environment	Works?	Notes
Shared hosting with 30-second PHP limits	✅	Scans run in slices of a few seconds with automatic resume
Managed WordPress (WP Engine, Kinsta, SiteGround, GoDaddy…)	✅	Hosts' own must-use plugins are recognised as low-risk
DISABLE_WP_CRON with a real server cron	✅	Scheduled scans use bigger slices
Quiet sites (WP-Cron rarely triggered)	✅	Scheduled scans resume across visits
Persistent object cache (Redis, Memcached)	✅	Scan state is read fresh each slice
Multisite	✅	One network-wide scan and report; admins on every site
Server blocks outbound requests	✅	Core-checksum and self-check against GitHub are skipped with a note
open_basedir restrictions	✅	Unreadable paths are counted and skipped
Symlinked plugin or upload folders (Bedrock, Capistrano, Pantheon)	✅	Followed once each; loops detected
Plugin / upload folders outside wp-content	✅	Scanned too
Huge folders (100,000+ files)	✅	Read one entry at a time; the scan can pause mid-folder
File names in old encodings (Latin-1)	✅	Handled without stalling the scan
Windows / IIS	⚠️	Should work (paths are normalised) but isn't tested in CI
PHP 7.0 → 8.5 · WordPress 6.2 → 7.x	✅	Tested in CI