Skip to main content
Version: v0.21

Installation Guide

Choose a release file for a standalone scanner. Choose Composer when you want dependency management or programmatic use.

Requirements

PHP 7.4 or newer is required. Review the required extensions before installation.

Standalone release​

Download the latest scanner file from the GitHub releases page or fetch the current build:

curl --fail --silent --show-error --location \
  --output scanner \
  https://raw.githubusercontent.com/marcocesarato/PHP-Antimalware-Scanner/master/dist/scanner

Check the scanner version, then run a report only scan:

php scanner --version
php scanner /var/www/example --lite --report-only

Keep the scanner outside the directory you scan. This prevents the release file and generated reports from appearing in the scan scope.

Keep TLS verification enabled

Do not use --no-check-certificate or an equivalent option. A failed certificate check can indicate a network or trust store problem that needs attention.

Composer​

The package is published as marcocesarato/amwscan.

Install for one project​

composer require marcocesarato/amwscan
php vendor/bin/amwscan /var/www/example --lite --report-only

A project installation pins the scanner version in composer.lock, which helps teams and continuous integration use the same release.

Install for the current user​

composer global require marcocesarato/amwscan
php "$(composer global config home)/vendor/bin/amwscan" /var/www/example --lite --report-only

On Windows PowerShell:

$composerHome = composer global config home
php "$composerHome\vendor\bin\amwscan" "C:\Sites\example" --lite --report-only

Source checkout​

Use a source checkout when contributing or testing unreleased changes:

git clone https://github.com/marcocesarato/PHP-Antimalware-Scanner.git
cd PHP-Antimalware-Scanner
composer install
php bin/amwscan /var/www/example --lite --report-only

Do not use the development branch as a silent replacement for a pinned production release.

Docker​

Use the Docker guide to run a report-only scan, pin image versions, and build the included image locally.

WordPress plugin​

The WordPress plugin adds scheduled scans, report review, upload protection, quarantine, and controlled file actions to the administration area.

Install the WordPress plugin

Verify the installation​

A healthy installation should return a version and show help without PHP startup errors:

php scanner --version
php scanner --help

Continue with Run your first scan.