Daily Automated Scans

Daily Automated Scans

Set up the MCP server as a daily service for proactive malware detection. Ideal for hosting companies monitoring client sites.

Strategy Overview

┌─────────────┐     ┌──────────────┐     ┌─────────────┐
│  Cron Job   │────>│  Claude Code  │────>│  MCP Server  │
│  (daily)    │     │  (headless)   │     │  (scans)     │
└─────────────┘     └──────────────┘     └──────┬───────┘
                                                 │
                                          ┌──────▼───────┐
                                          │  Threat DB    │
                                          │  (auto-learn) │
                                          └──────────────┘

Option 1: Batch Scan via Claude Code

Daily Full Scan of All Sites

Use wp_batch_scan() to scan every configured site:

# Scan all sites
wp_batch_scan()

# Scan only sites that haven't been scanned recently
wp_batch_scan(status_filter="pending")

This runs wp_full_scan() on each site sequentially. Results are logged per-site and findings update the threat DB automatically.

Targeted Daily Scans

For hosting companies with 100+ sites, run lighter daily scans and full scans weekly:

Daily (fast):

# Quick checks on all sites
for site in wp_list_sites():
    wp_verify_core(site)          # Core file integrity
    wp_scan_hidden_admins(site)   # New suspicious admins
    wp_scan_app_passwords(site)   # New app passwords

Weekly (thorough):

wp_batch_scan()  # Full scan of everything

Option 2: Cron-Based Automation

Setup Script

Create a scan script that Claude Code can run:

#!/bin/bash
# ~/.scripts/daily-wp-scan.sh

# Run batch scan via Claude Code in non-interactive mode
claude -p "Run wp_batch_scan() and summarize any infected sites. \
If any site is infected, run wp_generate_report() for each." \
  --output-format json > /var/log/wp-scan-$(date +%Y%m%d).json

Cron Entry

# Edit crontab
crontab -e

# Run daily at 3 AM
0 3 * * * /bin/bash ~/.scripts/daily-wp-scan.sh 2>&1 | tee -a /var/log/wp-daily-scan.log

Option 3: Scan + Alert Pipeline

Scan and Notify on Findings

#!/bin/bash
# ~/.scripts/scan-and-alert.sh

RESULT=$(claude -p "Run wp_batch_scan(). Return ONLY a JSON array of site names with status infected." --output-format text 2>/dev/null)

if echo "$RESULT" | grep -q "infected"; then
    # Send alert (customize for your notification system)
    echo "MALWARE DETECTED: $RESULT" | mail -s "WP Malware Alert" ops@yourhost.com

    # Or Slack webhook:
    # curl -X POST -H 'Content-type: application/json' \
    #   --data "{\"text\":\"Malware detected: $RESULT\"}" \
    #   YOUR_SLACK_WEBHOOK_URL
fi

Hosting Company Recommended Schedule

Time	Action	Tool
3:00 AM	Core integrity check (all sites)	wp_verify_core() per site
3:30 AM	Hidden admin scan (all sites)	wp_scan_hidden_admins() per site
4:00 AM	App password scan (all sites)	wp_scan_app_passwords() per site
Sunday 2 AM	Full deep scan (all sites)	wp_batch_scan()
After any cleanup	Verification scan	wp_full_scan() on cleaned site

Monitoring the Threat DB

Check your learning pipeline is working:

# See how many detections/cleanups are recorded
wp_threat_db_stats()

The cleanup_records count should grow over time. If it stays at 0 after running scans, check that the threat DB module is loading correctly.

Auto-Update All Clean Sites

After daily scans, keep clean sites updated:

# Update all sites that passed the scan
wp_batch_update()

This runs wp_update_all() on every site with status "clean" - updates core, plugins, and themes.