Malware Scanner

Requirements

Installation

1. Download the ZIP file from your account
2. Go to Plugins → Add New → Upload Plugin
3. Upload the ZIP and click Install Now
4. Click Activate

Uninstalling

Deactivate and delete from the Plugins screen. The scheduled scan cron job is removed on deactivation. Options (ssp_malware_options, ssp_malware_scan_history, ssp_malware_ignored_threats) and the quarantine folder remain in the database and uploads directory. Remove these manually if you want a clean removal.

Quick Start

1. Go to Malware Scanner in your WordPress admin sidebar
2. Click the Run Scan Now button in the top-right of the header
3. Wait for the scan to complete — a progress bar and live log show what's happening
4. Review the results on the Dashboard tab
5. Set up automatic scans in the Schedule tab so your site is monitored continuously
6. Configure Email alerts so you're notified when issues are found

Dashboard

The Dashboard tab is the main screen you see when opening the plugin. It shows a grid of status cards and your most recent scan results.

Status Cards

Severity Legend

Below the cards is a color legend explaining the three severity levels: Serious (red), Suspicious (yellow), and Notice (blue).

Running a Scan

Click Run Scan Now from any tab. The Dashboard tab opens automatically and shows:

• Progress bar — fills from 0% to 100% as the scan runs
• Status text — shows what phase the scan is in (core files, plugins, themes, uploads, database, .htaccess)
• Live log — a dark terminal-style area showing real-time scan activity

When the scan completes, the page reloads automatically after 1.5 seconds to show the fresh results.

Understanding Results

Scan results appear in the Recent Results section on the Dashboard. Each result shows:

Up to 50 results are shown on the Dashboard. If more were found, a note at the bottom tells you to check the History tab for the full list.

Bulk Selection

Above the results is a Select All checkbox and a selected count. Check multiple items and click Ignore Selected to bulk-dismiss notices you've reviewed and trust.

Severity Levels

Taking Action on Results

Each result has action buttons on the right side:

Schedule Tab

Scan Schedule

Performance

Scan Options Tab

Sensitivity

What to Scan

Email Tab

Email Recipients

Add one or more email addresses to receive scan alerts. Click + Add Email to add more addresses. Click the × to remove one. The admin email is pre-filled on first activation.

Alert Settings

Email Templates

You can customize the email content for both threat and clean-scan emails separately. Use the dropdown to switch between the two template types.

For each type you can configure:

• Subject Line — supports placeholders
• Format — HTML or Plain Text
• Custom HTML Template — leave blank to use the built-in default template, or paste your own HTML

Template Placeholders

Exclusions Tab

Skip These Paths

Enter file paths to completely skip during scans (one per line). Use this for directories that contain many false positives or are irrelevant to security, like cache or backup folders.

Example:

• /wp-content/cache/
• /wp-content/backups/

Trusted Plugins

Enter plugin folder names (one per line) to skip scanning entirely. Useful for large, well-known plugins that trigger false positives due to their use of encoding or complex code.

Pre-filled defaults: woocommerce, woocommerce-subscriptions, woocommerce-square, all-in-one-seo-pack, wp-mail-smtp.

Safe Upload Paths

Subfolder names inside /uploads/ that legitimately contain PHP files. Files in these paths won't be flagged as “PHP File in Uploads.”

Ignored Issues

Shows the count of currently ignored issues. Click Clear All Ignored Issues to reset the ignore list so all previously ignored items will appear again in future scans.

Quarantine Tab

Quarantine is a safe holding area for suspicious files. When you quarantine a file:

1. The file is moved to /wp-content/uploads/ssp-quarantine/
2. The folder is protected with deny from all in .htaccess so files cannot be executed or accessed via the web
3. A .meta file is created alongside it recording the original location and quarantine time
4. The file is renamed with a timestamp and .quarantined extension

For each quarantined file you can see the original name, original path, quarantine date, and file size.

Actions

History Tab

Shows a chronological list of all past scans, newest first. Each entry shows:

• Date and time of the scan
• Status: clean (green left border) or issues found (red left border) with count
• Duration and file count

Click any history entry to expand it and see the full list of issues found during that scan. Each issue shows the same type, severity, location, and details as the Dashboard results.

Use Clear History to delete all scan records. History retention is also controlled by the Keep scan history setting in the Schedule tab.

What Gets Scanned

File Scanning

The scanner recursively walks through the directories you've enabled (core, plugins, themes) and reads each file looking for malicious code patterns. In Standard mode it checks .php, .phtml, .php5, and .pht files. In Thorough mode it checks additional file types.

Files larger than the configured max file size are skipped. The scanner's own files and quarantine folder are always excluded.

Uploads Scanning

The uploads directory gets special treatment. Instead of checking for malware patterns inside files, it checks for files that shouldn't exist in an uploads folder at all — PHP executables and files with disguised double extensions like .php.jpg.

Database Scanning

The scanner queries the wp_posts table for published posts containing <script> tags with external sources, <iframe> tags, eval(atob(...)), and document.write(unescape(...)). It also checks wp_options for entries containing both eval and base64 together.

.htaccess Scanning

Checks the root .htaccess for auto_prepend_file/auto_append_file directives and long encoded strings.

Detection Patterns

The scanner checks for these specific malware patterns in PHP files:

• eval(base64_decode(...)) — the most common PHP malware pattern
• eval(gzinflate(...)) and eval(gzuncompress(...)) — compressed malware payloads
• eval(str_rot13(...)) — simple obfuscation
• eval($_GET[...]) / eval($_POST[...]) / eval($_REQUEST[...]) / eval($_COOKIE[...]) — direct execution of user-controlled input
• assert($_GET[...]) / assert($_POST[...]) — assert used as eval alternative
• preg_replace with /e modifier and user input — deprecated code execution via regex
• create_function with user input — dynamic function creation
• file_put_contents with php://input — writing raw POST data to files
• shell_exec, system, passthru, popen, proc_open with user input — command injection
• Long base64 strings (500+ chars) followed by eval — obfuscated payloads
• Nested function chains like @eval(@$a(@$b(@$c — heavily obfuscated backdoors

Performance

• Scans run as a single AJAX request (manual) or cron job (scheduled). They don't affect frontend visitor performance
• The plugin sets set_time_limit(0) so scans don't timeout on slow servers
• Memory limit is configurable (default 256 MB) and set via ini_set at scan start
• Files over the max size limit are skipped automatically
• Low resource mode reduces processing speed to avoid overwhelming shared hosting
• Schedule scans during off-peak hours (2:00–5:00 AM) to minimize any impact

Data Storage

What's Stored

External Connections

The plugin makes zero external connections. No data is sent to third-party servers. All scanning, storage, and email delivery happens on your own server using WordPress core functions (wp_mail for emails, wp_options for storage).

Recommendations by Site Type

Troubleshooting