Your First Scan

Your First Scan

Quick Scan (Single Site)

After adding a site, run a full scan:

wp_full_scan("my-site")
# or with password auth:
wp_full_scan("my-site", password="ssh-password")

This runs all scans in sequence:

1. Core file integrity (wp core verify-checksums)
2. Plugin integrity (wp plugin verify-checksums)
3. MU-plugins scan (backdoor detection)
4. Uploads directory scan (PHP files that shouldn't exist)
5. Deep malware pattern scan (obfuscated code, known signatures)
6. Database injection scan (malicious content in posts/options)
7. Recently modified files (infection timeline)
8. Hidden admin detection (suspicious administrator accounts)
9. Application password scan (REST API entry vectors)
10. Web shell detection (file manager backdoors)

Verbose Scan (See Everything)

For detailed output including every command:

wp_full_scan_verbose("my-site")

Understanding the Output

The scan produces a structured report. Here's what to look for:

Clean Site

## Full Malware Scan Report
Status: CLEAN
Issues found: 0

No action needed. The site is healthy.

Infected Site

## Full Malware Scan Report
Status: INFECTED
Issues found: 7

### Core Verification
  - wp-includes/class-wp-backdoor.php (should not exist)

### MU-Plugins
  - SUSPICIOUS: wp-update-manager.php (user-hiding filter)

### Admin Users
  - admlnlx (created 2 days ago, typosquatted email)

Each finding includes:

• What was found (file, user, option, etc.)
• Why it's suspicious (pattern match, checksum mismatch, etc.)
• Recommended action (quarantine, delete, review, etc.)

What To Do After a Scan Finds Issues

Option A: Automated Full Cleanup (Recommended)

wp_complete_cleanup("my-site")

This runs 16 steps automatically: backup, revoke app passwords, remove hidden plugins, remove malware themes, delete DB markers, reinstall core, reinstall plugins/themes, remove rogue admins, reset passwords, regenerate salts, clean uploads, harden wp-config, install security MU-plugin, fix permissions, update everything.

Option B: Manual Step-by-Step

For more control, follow the Cleanup Workflow in the README.

Next Steps

• Set up Daily Automated Scans to catch infections early
• Read Understanding Scan Results for detailed finding explanations
• Check the FAQ for common questions