Quick Start Guide

Start in report mode. The scanner will inspect files and write its findings without changing the project.

Before you begin

Confirm that PHP 7.4 or newer is available:

php --version

Download the current release file as described in Installation, then place it outside the directory you plan to scan.

Scan a project

Run the scanner against the project root:

php scanner /var/www/example --lite --report-only

Replace /var/www/example with the real path. On Windows, quote paths that contain spaces:

php scanner "C:\Sites\example" --lite --report-only

This command uses two options:

• --lite reduces common false positives while retaining broad detection.
• --report-only prevents interactive file actions and writes a report.

The default report path is ./scanner-report.html. Open the file in a browser and review each finding in its source context.

Choose a scan mode

Mode	Option	Best use	Tradeoff
Full	No mode option	Incident response and deep investigation	Produces the most findings
Lite	--lite, -l	A practical first scan	Skips some noisy patterns
Signatures	--only-signatures, -s	WordPress and known malware checks	Can miss suspicious custom code
Exploits	--only-exploits, -e	Review of risky code patterns	Can produce false positives
Functions	--only-functions, -f	Audit of dangerous PHP calls	Function names alone lack context

Do not combine modes unless you understand how their filters interact. Use Lite for an unfamiliar codebase, then run a full scan when you need broader coverage.

Read a finding

Check these details before taking action:

1. File path: confirm that the file belongs to the application you intended to scan.
2. Detection type: signatures carry different confidence than generic exploit patterns or dangerous functions.
3. Matched code: inspect the surrounding function, class, or template.
4. Integrity result: a modified vendor or platform file deserves closer attention.
5. Recent changes: compare the file with version control, a trusted release, or a known backup.

A finding needs context

A legitimate plugin, deployment script, or maintenance tool can use code that resembles malware. Confirm the file's origin and purpose before changing it.

Act on confirmed findings

Interactive scans can show source, skip a finding, add it to the whitelist, clean code, quarantine a file, or delete it. Prefer reversible actions.

Action	Effect	Recommended use
Show source	Displays the surrounding code	First review step
Skip	Leaves the file unchanged	You need more evidence
Whitelist	Suppresses the accepted match	You verified the exact finding
Clean	Shows a diff and validates PHP syntax	The malicious fragment is isolated
Quarantine	Moves the file out of its original location	You confirmed the site can run without it
Delete	Removes the file	A backup exists and the file is confirmed malware

Use --backup before any scan that can modify files:

php scanner /var/www/example --lite --backup

Common next steps

Create a machine readable report

php scanner /var/www/example --lite --report-only --report-format=json

Available report formats are HTML, text, JSON, and SARIF.

Exclude generated files

php scanner /var/www/example --lite --report-only --ignore-paths="*/cache/*,*/logs/*"

Scan every extension

php scanner /var/www/example --scan-all --report-only

This option increases scan time and can inspect binary or generated content. Use path filters and file size limits on large projects.

Continue

Browse the CLI reference for reporting, archive, FTP, WordPress database, path, and automation options. WordPress administrators can use the dashboard guide.