Security & Malware Scanner

The security counterpart to the Performance Analyzer: a single read-only tool that scans your site across four dimensions and returns a detailed, scored report (0-100 + an A–F grade) with severity-tagged findings and ranked recommendations. It is self-contained: the only off-site calls are to wordpress.org (optional, and graceful when offline).

Enabled by default. Requires manage_options. Read-only. It never writes or quarantines anything.

A scanner, not a guarantee. The malware pass is heuristic static analysis. It surfaces suspicious patterns for a human to review; a clean report is not proof a site is uncompromised, and a flagged line is not proof of malware. Use it alongside, not instead of, a server-level security posture.

emcp-tools/scan-security

Input (all optional):

• checks: an array selecting a subset of malware / integrity / hardening / software. Omit to run all four.
• deep: when true, the malware walk covers the whole WordPress tree instead of just uploads + active plugins/themes. Default false.
• max_files: cap on the number of PHP files the malware walk reads (partial results are flagged when hit).
• max_seconds: wall-clock cap on the malware walk (partial results are flagged when hit).

Returns: a report object with summary (score, grade, severity counts), sections (one per dimension), and top_recommendations (ranked, highest-severity first). Each finding carries an id, dimension, severity, a short message, and a recommendation.

What it checks

Malware heuristics: scans PHP in uploads + active plugins/themes (deep:true for the whole tree) for eval/base64 obfuscation, request-driven code execution, command execution, webshell markers, large encoded blobs, and executable PHP under uploads. The walk is confined to the WordPress installation (ABSPATH, no traversal or symlink escape) and bounded by file-count + time caps (partial results flagged). It never returns full file contents, only path:line plus a short snippet, and it excludes the plugin’s own directory and its managed snippet sandbox.

Core integrity: verifies WordPress core files against the official wordpress.org checksums: a modified core file is critical, a missing one a warning. Degrades gracefully offline (skips with a note rather than failing).

Hardening: DISALLOW_FILE_EDIT, debug output in production, an admin username, XML-RPC exposure, version disclosure (readme.html / generator meta), HTTPS, and security headers (one same-host loopback GET).

Outdated / abandoned software: outdated core, plugins, and themes, plus plugins closed or removed from wordpress.org (bounded, transient-cached), and inactive-component housekeeping.

Scope and safety

• Read-only and manage_options-gated; registers unconditionally and is enabled by default.
• Self-contained: no third-party security API; the only network calls are to wordpress.org for checksums and plugin status, and they degrade gracefully when blocked.
• The admin tools section is named Performance & Security. Both this scanner and the Performance Analyzer appear there with a read-only badge.