FTP and FTPS

AMWScan can inspect a remote website through FTP or FTPS. It downloads the selected directory to a protected temporary mirror, scans the local copy, writes a report, and removes the mirror. The integration never uploads, edits, quarantines, or deletes remote files.

Requirements

• PHP must provide ext-ftp.
• FTPS requires ftp_ssl_connect in the PHP runtime.
• The server must support passive mode and MLSD directory listings.
• The FTP hostname must resolve only to public IP addresses. Private and reserved addresses are rejected.

Use FTPS whenever credentials or sensitive files are involved. Plain FTP sends credentials and file contents without encryption.

CLI configuration

Pass one ftp://host/path or ftps://host/path URL as the scan path. You may include a port; otherwise AMWScan uses port 21.

Do not put credentials, a query, or a fragment in the URL. Set the username with --ftp-user or AMWSCAN_FTP_USER, and provide the password through AMWSCAN_FTP_PASSWORD. When no username is set, AMWScan uses anonymous access.

AMWSCAN_FTP_USER=scanner \
AMWSCAN_FTP_PASSWORD=secret \
php scanner ftps://files.example.com/public_html --report-only

FTP sources always use report mode, run sequentially even when --jobs requests multiple workers, and cannot be combined with --scan-wordpress-db.

WordPress configuration

1. Open Antimalware > Settings > Scope and limits.
2. Select FTP server as the scan source.
3. Enter a credential-free server URL and, if needed, a username.
4. Define AMWSCAN_FTP_PASSWORD in the PHP environment used by WordPress.
5. Save the settings and run the scan.

The settings page reports whether FTP, FTPS, and the password environment variable are available. WordPress never stores the FTP password in its options. Remote findings can be reviewed and reported, but file actions are disabled.

Safety limits

Each scan accepts one FTP source and stops when any of these limits is exceeded:

Limit	Value
Files	10,000
Directory entries	20,000
Directory depth	64
Individual file size	64 MiB
Total downloaded size	512 MiB
Connection timeout	15 seconds

AMWScan rejects unsafe or duplicate entry names. Partial downloads use temporary .part files and are removed when a download fails.

Troubleshooting

Error	Check
FTP extension is missing	Enable ext-ftp in the CLI or WordPress PHP runtime that starts the scan.
FTPS is unavailable	Use a PHP build with ftp_ssl_connect; do not fall back to plain FTP for sensitive data.
Authentication fails	Verify AMWSCAN_FTP_USER, AMWSCAN_FTP_PASSWORD, and server permissions.
Connection is rejected	Use a public hostname and confirm that it does not resolve to a private or reserved address.
Directory listing fails	Enable MLSD support on the FTP server.
A safety limit is exceeded	Select a narrower remote path or reduce the files stored below it.

Scan reports use the sanitized remote URL as the source label and never include the password.