📅 Scan Schedule

⚡ Performance

🔍 What to Scan

Thorough mode checks more file types and may show extra notices that are usually safe.

📧 Email Recipients

⚙️ Alert Settings

✉️ Email Templates

🚫 Skip These Paths

One path per line

✅ Trusted Plugins

Plugin folder names, one per line. These won't be scanned.

📁 Safe Upload Paths

Subfolders in uploads/ that legitimately contain PHP files. SSP plugin folders (ssp-*) are automatically excluded.

🙈 Ignored Issues

You have 0 ignored issue(s). These won't appear in future scans.

🔒 Quarantined Files

🚀 Getting Started

SSP Malware Scanner checks your WordPress site for security issues. Here's how to use it:

1. Run your first scan - Click the "Run Scan Now" button on the Dashboard tab
2. Review the results - Check what was found and take action if needed
3. Set up automatic scans - Go to Schedule tab to enable daily or weekly scans
4. Configure email alerts - Get notified when issues are found

🚦 Understanding Scan Results

🔴 Serious Threat (Red)

These require immediate attention. They indicate code patterns commonly used by hackers:

• Malicious Code Detected - Code that can execute commands on your server. This is almost always bad.
• Backdoor Found - Hidden access points that let attackers control your site.
• PHP File in Uploads - Executable files where only images/documents should be. Usually injected by hackers.
• Suspicious Database Content - Injected scripts in your posts or pages.

What to do: Quarantine the file immediately, then investigate. If you don't recognize the file, it's likely malicious.

🟡 Suspicious (Yellow)

These need review but might be legitimate:

• Suspicious .htaccess Rules - Unusual server rules that could redirect visitors or hide files.
• Unusual Database Entry - Content that looks like it could be malicious but might be from a plugin.

What to do: Review the file or content. If it's from a plugin you installed, it's probably fine. When in doubt, contact the plugin developer.

🔵 Notice (Blue)

Informational findings that are usually harmless:

• Complex Code Pattern - Very long lines of code, often from minified JavaScript or legitimate optimization. Almost always safe.
• Encoded Content - Base64 or similar encoding used by many legitimate plugins for fonts, images, or license validation.

What to do: Usually nothing. These appear more often in Thorough scan mode. You can use "Select All" and "Ignore Selected" to bulk ignore these notices if you're confident they're safe.

⚙️ Scan Sensitivity Levels

• Quick - Fast scan of just PHP files. Good for regular checks. Catches obvious threats.
• Standard (Recommended) - Thorough scan of all code files. Best balance of speed and detection.
• Thorough - Deep scan of everything. Checks more file types and looks for subtle patterns. May show more notices that are usually safe. Use this if you suspect an infection.

🏥 Quarantine Explained

When you quarantine a file:

• The file is moved to a secure folder where it can't execute
• A record is kept of where it came from
• You can restore it if it was flagged incorrectly
• You can permanently delete it once you're sure it's malicious

Tip: Always quarantine before deleting. This gives you a chance to restore if something breaks.

🏢 Recommendations by Site Type

Personal Blog or Small Site

• Weekly scans are usually sufficient
• Standard sensitivity is recommended
• Enable email alerts for issues

Business Website

• Daily scans recommended
• Standard or Thorough sensitivity
• Enable all email alerts
• Add trusted plugins to exclusions to reduce noise

eCommerce / WooCommerce Store

• Daily or even hourly scans (you're handling customer data)
• Standard sensitivity to avoid false positives from payment plugins
• Add WooCommerce and payment gateway plugins to trusted list
• Enable email alerts - you need to know immediately if something's wrong

Membership or High-Traffic Site

• Enable low resource mode if scans affect performance
• Schedule scans during low-traffic hours
• Consider hourly scans if you have many users uploading content

❓ Frequently Asked Questions

My site is slow during scans. What can I do?

Enable "Low resource mode" in the Schedule tab. This makes scans slower but uses less server power. Also, schedule scans for low-traffic times like 3 AM.

I'm getting lots of notices about plugins I trust. How do I handle this?

You have two options: 1) Add the plugin folder name to "Trusted Plugins" in the Exclusions tab to skip scanning them entirely, or 2) Use the "Select All" checkbox and "Ignore Selected" button to bulk ignore all the notices at once.

I quarantined a file and now something is broken. What do I do?

Go to the Quarantine tab and click "Restore" on the file. This will put it back where it was.

How do I know if a threat is real or a false positive?

Check the file location. If it's inside a plugin or theme you installed from WordPress.org, it's likely a false positive. If it's in a random location or has a strange name, be suspicious. When in doubt, ask a developer.

The scanner found issues. Am I hacked?

Not necessarily. Red "Serious Threat" items need immediate attention. Yellow "Suspicious" items need review. Blue "Notice" items are usually fine. If you have multiple serious threats, especially in core WordPress files, you may have been compromised.

Your Pro license includes priority support.