WordPress Security Plugin

AMWScan Antimalware Scanner lets WordPress administrators run and review AMWScan checks without leaving the dashboard. It stores reports, backups, quarantine, and scan state outside the scanned directory.

Choose an edition

Edition	Download	Browser file editor	Restore quarantined files
AMWScan Antimalware Scanner Lite	WordPress.org	WordPress plugin editor when permitted	No
AMWScan Antimalware Scanner	GitHub / amwscan-X.Y.Z.zip	Built-in editor	Yes

Lite is a separate Store-safe package: full-only code is absent from the archive, not merely disabled. Both editions use the amwscan directory, text domain, settings, and data, and therefore cannot be active together. Deactivate and remove the installed edition before switching.

Install and activate

1. Install Lite from the WordPress.org plugin page, or download the latest full WordPress plugin release from GitHub.
2. In WordPress, open Plugins > Add New to install Lite, or choose Upload Plugin to upload a release ZIP. You can also copy release contents to wp-content/plugins/amwscan.
3. Activate AMWScan Antimalware Scanner.
4. Open Antimalware > Settings to confirm the scan target and policy.

The plugin requires WordPress 5.3 or newer and PHP 7.4 or newer. It automatically uses self-contained administration assets when an older WordPress installation does not provide the required JavaScript packages. Enable the PHP zip extension to inspect archives and restore trusted WordPress core files.

Run your first scan

Open Antimalware and select Run scan now. Scans run in the background through WP-Cron; the dashboard refreshes status and progress while a scan is active.

The dashboard summarizes daily manual and scheduled scan activity, detection totals, recent results, and the active scanner policy at a glance. Every detection remains visible in the activity chart: red segments need review, gray segments are whitelisted, and green segments were quarantined, deleted, or cleaned. Mixed outcomes split the same bar proportionally, while a dotted blue bar marks the next scheduled scan.

When the latest active report has unresolved security findings, administrators also see a shield and finding count in the WordPress toolbar. Select it to open the reports list directly; the indicator disappears when no findings need review.

The WordPress home dashboard also includes an Antimalware Scanner widget with scanner health, the latest scan result, stored traffic matches, and shortcuts to the scanner, Traffic console, and scan action.

When the scan completes, select Open report to inspect every detection. Select View code beside a local malware match to open a modal with three lines before and after the detection; the exact matched code is highlighted. Start with report-only mode, which is the default: it records findings without changing files.

caution

Review each finding and make a backup before using clean, delete, or quarantine actions. Automatic file-changing actions require an explicit setting, and every report action checks that the file still matches the scan snapshot.

Configure scans

Open Antimalware > Settings to set the scan target, detection mode, schedule, and storage locations. Scan policy remains visible, while advanced sections can be expanded individually or together. The browser remembers the sections you leave open.

The fully expanded settings view shows every advanced control available for scheduling, email notifications, upload and archive coverage, resumable scans, backups, and diagnostic logging.

• Scan policy controls the scan mode and default response. The sensitivity slider progresses from Signatures (the lowest alert volume) through Functions, Lite, and Exploits to Full (the broadest coverage). Lite is the default for new installations and omits the common `ls-la` signature to reduce false positives. Read-only database checks inspect triggers, administrator accounts, and orphaned posts during local scans by default and require MySQLi.
• Schedule can run hourly, twice daily, daily, or weekly. WP-Cron depends on site traffic; use a system scheduler to run wp cron event run --due-now for predictable timing.
• Detection definitions supports administrator-managed JSON rules in a private directory outside the WordPress web root.
• Scope and limits lets you define filters, choose a resource profile, and optionally inspect bounded ZIP archives. Low uses one worker, Balanced uses two, Fast detects available CPUs, and Custom accepts an explicit parallel-job count. Parallel execution applies only to eligible local report-only scans and requires PHP process-control support; the settings page reports unavailable support and scans fall back to one process. Archive scanning is disabled for manual and scheduled scans by default because large archives can consume substantial resources.
• GenAI finding review optionally sends a bounded excerpt around each malware detection to an AI provider. It is disabled by default and verdicts are advisory. Install the canonical WordPress AI plugin to enable the recommended WordPress AI / configured connectors option. Configure providers under Settings → Connectors (wp-admin/options-connectors.php) and manage AI plugin features under Settings → AI (wp-admin/options-general.php?page=ai-wp-admin). AMWScan retrieves compatible text-generation models dynamically from the configured connector registry; Automatic uses WordPress AI's filterable preferred-model fallback list. This path uses connector credentials and approval without storing another key in AMWScan. Direct OpenAI, Anthropic, and Gemini API configuration remains available as an advanced fallback.
• WordPress Abilities API integration is capability-detected and optional. Administrators and approved REST/MCP clients can read scan status, list unresolved findings, and retrieve one finding summary. These abilities never include code excerpts and cannot start scans or perform remediation.
• Engine and private storage manages report, backup, quarantine, and definition-cache locations. Keep these locations outside the site files that you scan. An optional report-storage limit applies across active and archived JSON reports; 0 leaves storage unlimited, and the newest report is always retained.

Review and remediate findings

Reports list integrity, vulnerability, and reputation checks under Security findings. Code and signature matches appear once under Malware detections, with every detection collapsed initially for easier scanning. Point to or focus a finding to reveal its row actions. Security findings provide Add exception, Reopen, and trusted-file restoration when available; malware detections provide Take action and Report finding when available. Findings that need a new scan or are already handled keep a visible, disabled selection checkbox.

The expanded report view keeps technical evidence and remediation controls together, making each finding easier to verify before acting.

The report history supports row selection and bulk actions and provides an audit trail with scan duration, scanned-file totals, and detected-threat counts. Move older reports to Archived before permanently deleting them; archived reports can be restored at any time until deletion.

Automatic clean, quarantine, and delete actions require confirmation. For detected files inside an installed plugin, Lite opens the WordPress plugin editor when WordPress permits editing that file; other locations remain view-only. Quarantined files can only be permanently removed from Antimalware > Quarantine. Full adds a diff-based browser editor and quarantine restoration. It refuses an action when the file changed after the scan, so run another scan before acting on stale results.

Edit a detected file in the full edition

Select Edit on a malware finding to inspect the scanned file. The editor highlights each affected line and opens at the first match.

Change the file, then select Review changes. The plugin keeps the original file untouched while you review the edit.

The review dialog compares both versions and checks PHP syntax. Confirm and save stays unavailable when the content has not changed or the syntax check fails. On confirmation, the plugin checks the file against the scan snapshot, saves it through the configured backup policy, and scans it again. A stale file or a remaining detection returns you to the report with its status.

Quarantine and whitelist

Quarantine safely isolates suspicious files while retaining the metadata needed to review or permanently delete them. The full edition also permits restoration.

The whitelist lists explicitly trusted findings so reviewed false positives remain suppressed and can be removed when they need to be evaluated again. Successful whitelist actions mark matching report findings as ignored. Successful quarantine, delete, clean, and remove-lines actions mark them as resolved. Both manual and automatic actions update unresolved counts immediately.

Protect WordPress uploads

Scan and block malicious WordPress uploads is enabled by default in Settings > Scan policy. It checks media uploads and plugin or theme ZIPs before WordPress accepts them. Files with detections, or files without authoritative scan coverage, are blocked and recorded in a report for review.

JavaScript files are checked with scoped malware definitions and dangerous-domain analysis by default. Disable domain analysis under Antimalware > Settings > Detection definitions when another control owns domain reputation scanning; JavaScript definitions remain active.

Disable this only when another upload security control is responsible for the same protection.

Trusted integrations can bypass the hook-triggered scan for one upload without changing the global setting:

add_filter('amwscan_should_scan_upload', function ($shouldScan, $file) {
    return $file['name'] === 'trusted-package.zip' ? false : $shouldScan;
}, 10, 2);

The amwscan_should_scan_upload filter runs only for otherwise valid pending uploads. Return false to leave that upload untouched.

Monitor suspicious traffic

Enable Request monitoring under Antimalware > Settings > Traffic detection. The passive monitor uses conservative built-in heuristics for traversal, sensitive-file, exploit-path, scanner user-agent, and unexpected-method probes. You can add a curated local plain-text or CSV indicator file for IP addresses, CIDR ranges, domains, URLs, paths, and ua: fragments. Heuristics remain active when no indicator file is configured.

Open Antimalware > Traffic to review seven-day severity and category summaries, filter recent detections, and download a defanged CSV investigation export. The main Antimalware dashboard and WordPress home widget also show recent traffic status.

The Traffic console combines monitor health, loaded indicator totals, seven-day trends, and recent request evidence. Use its severity, category, date, and search filters to narrow an investigation before exporting the visible results.

Only requests that reach WordPress can be inspected. Monitoring does not block visitors or inspect DNS, TLS, arbitrary ports, static files, rejected connections, or outbound traffic. Query strings are discarded, addresses are reduced to network prefixes, and duplicate detections are suppressed for five minutes.

Help and diagnostics

The plugin's About page shows installed plugin and engine versions alongside links to documentation, support, contribution guidance, and licensing.

Use these shortcuts to verify the installed version or open the project documentation, issue tracker, contribution guide, and support resources.

For FTP or FTPS scans, configure a credential-free server URL in settings and provide the password through the AMWSCAN_FTP_PASSWORD environment variable; the plugin never saves FTP passwords in WordPress options.

See FTP and FTPS integration for prerequisites, limits, security guidance, and troubleshooting.

For development, test, and release procedures, see the plugin README.