Skip to content
Documentation

Your EMCP guide

Answers from our docs

YOUR CHAT, YOUR CHOICE

Before we chat

MSR Builds processes your question and up to four recent messages on our server to answer from the EMCP docs. AI is optional and needs your separate permission.

The chat is kept in this page's memory, not saved as a conversation in our database or browser storage. Our hosting and security services process connection information, such as your IP address, to prevent abuse.

Cloudflare Turnstile checks your browser and connection to prevent automated abuse when you send a question. No login is required.

Please leave out personal, sensitive or confidential information, passwords and API keys.

You can withdraw consent and clear this page's chat at any time. This cannot undo a request already sent or erase provider/security records.

Chat privacy, retention & your rights ↗ · Privacy contact

Starting chat consents to this processing. You can browse our docs without using the chat.

Security & Malware Scanner

The security counterpart to the Performance Analyzer: a single read-only tool that scans your site across four dimensions and returns a detailed, scored report (0-100 + an A–F grade) with severity-tagged findings and ranked recommendations. It is self-contained: the only off-site calls are to wordpress.org (optional, and graceful when offline).

Enabled by default. Requires manage_options. Read-only. It never writes or quarantines anything.

A scanner, not a guarantee. The malware pass is heuristic static analysis. It surfaces suspicious patterns for a human to review; a clean report is not proof a site is uncompromised, and a flagged line is not proof of malware. Use it alongside, not instead of, a server-level security posture.

emcp-tools/scan-security

Section titled “emcp-tools/scan-security”

Input (all optional):

  • checks: an array selecting a subset of malware / integrity / hardening / software. Omit to run all four.
  • deep: when true, the malware walk covers the whole WordPress tree instead of just uploads + active plugins/themes. Default false.
  • max_files: cap on the number of PHP files the malware walk reads (partial results are flagged when hit).
  • max_seconds: wall-clock cap on the malware walk (partial results are flagged when hit).

Returns: a report object with summary (score, grade, severity counts), sections (one per dimension), and top_recommendations (ranked, highest-severity first). Each finding carries an id, dimension, severity, a short message, and a recommendation.

What it checks

Section titled “What it checks”

Malware heuristics: scans PHP in uploads + active plugins/themes (deep:true for the whole tree) for eval/base64 obfuscation, request-driven code execution, command execution, webshell markers, large encoded blobs, and executable PHP under uploads. The walk is confined to the WordPress installation (ABSPATH, no traversal or symlink escape) and bounded by file-count + time caps (partial results flagged). It never returns full file contents, only path:line plus a short snippet, and it excludes the plugin’s own directory and its managed snippet sandbox.

Core integrity: verifies WordPress core files against the official wordpress.org checksums: a modified core file is critical, a missing one a warning. Degrades gracefully offline (skips with a note rather than failing).

Hardening: DISALLOW_FILE_EDIT, debug output in production, an admin username, XML-RPC exposure, version disclosure (readme.html / generator meta), HTTPS, and security headers (one same-host loopback GET).

Outdated / abandoned software: outdated core, plugins, and themes, plus plugins closed or removed from wordpress.org (bounded, transient-cached), and inactive-component housekeeping.

Scope and safety

Section titled “Scope and safety”
  • Read-only and manage_options-gated; registers unconditionally and is enabled by default.
  • Self-contained: no third-party security API; the only network calls are to wordpress.org for checksums and plugin status, and they degrade gracefully when blocked.
  • Its switch is in the Performance & Security section of the WordPress tab on EMCP Tools → Tools. Both this scanner and the Performance Analyzer appear there with a READ-ONLY badge.