CLI reference
Run php scanner --help to see the options supported by your installed version.
php scanner [path] [options]
path accepts a file, directory, wildcard, or one FTP or FTPS URL. When omitted, the scanner uses the current directory.
Detection
| Option | Purpose |
|---|---|
--lite, -l | Reduce common false positives while retaining broad detection |
--only-signatures, -s | Scan for malware signatures only |
--only-exploits, -e | Scan for exploit patterns only |
--only-functions, -f | Scan for dangerous PHP functions only |
--exploits=<names> | Include selected exploit definitions, separated by commas |
--ignore-exploits=<names> | Exclude selected exploit definitions, separated by commas |
--functions=<names> | Scan for selected PHP functions, separated by commas |
--scan-all, --all | Inspect files regardless of extension |
--scan-archives | Inspect ZIP entries within safety limits |
--scan-wordpress-db | Run read only checks against a local WordPress database |
--max-filesize=<size> | Skip files larger than the given size |
Scope and progress
| Option | Purpose |
|---|---|
--ignore-paths=<patterns> | Exclude comma separated paths or wildcards |
--filter-paths=<patterns> | Include only matching paths or wildcards |
--offset=<number> | Start at a position in the candidate file list |
--limit=<number> | Limit the number of mapped files |
--checkpoint=<path> | Save resumable scan progress in a private JSON file |
--resume | Continue a checkpoint when its files and settings still match |
--disable-cache, --no-cache | Ignore cached scan results |
php scanner /var/www/example --lite --report \
--ignore-paths="*/cache/*,*/logs/*" \
--max-filesize=5MB
Reports and output
| Option | Purpose | Default |
|---|---|---|
--report, -r | Disable interactive actions and write a report | Off |
--report-format=<format> | Select html, txt, json, or sarif | html |
--path-report=<path> | Set the report file path | ./scanner-report.html |
--log=<path> | Write a scan log | Off |
--path-logs=<path> | Set the scanner log path | ./scanner.log |
--silent | Hide terminal output and prompts | Off in CLI |
--disable-report, --no-report | Prevent report generation | Off in CLI |
--disable-colors, --no-colors, --no-color | Remove ANSI colors | Off |
--debug | Display all PHP errors and warnings | Off |
Text reports include scan totals, verification counts, severity totals, infected file metadata, and matched finding details. JSON and SARIF suit automated processing.
File actions
Use automated cleaning or deletion only with current backups and a tested recovery plan. Start with --report on each new project.
| Option | Purpose |
|---|---|
--backup, -b | Back up every file changed by the scanner |
--auto-clean | Remove matched code without confirmation |
--auto-clean-line | Remove the matched line without confirmation |
--auto-delete | Delete detected files without confirmation |
--auto-quarantine | Move detected files to quarantine |
--auto-skip | Leave every finding unchanged |
--auto-whitelist | Add every finding to the whitelist |
--auto-prompt=<action> | Apply one prompt response to every finding |
--whitelist-only-path | Match whitelist entries by path without line matching |
Store backups, quarantine, reports, and whitelist data outside the public document root:
| Option | Purpose |
|---|---|
--path-backups=<path> | Set the backup directory |
--path-quarantine=<path> | Set the quarantine directory |
--path-whitelist=<path> | Set the whitelist JSON file |
--findings-store=<path> | Set the canonical finding lifecycle JSON file |
--path-deobfuscate=<path> | Set the directory for deobfuscated files |
Integrity and definitions
| Option | Purpose |
|---|---|
--disable-checksum, --no-checksum, --no-verify | Skip platform and package checksum verification |
--path-definitions=<path> | Set the private Maltrail definition cache |
--disable-definitions-update | Use the last verified Maltrail cache without an update request |
--defs | Print exploit and function definitions |
--defs-exploits | Print exploit definitions |
--defs-functions | Print dangerous function definitions |
--defs-functions-encoded | Print encoded function definitions |
Built in signatures remain available offline. Platform checksums and Maltrail definition updates can require outbound HTTPS on the first scan.
Utility options
| Option | Purpose |
|---|---|
--ftp-user=<username> | Set the FTP username, or use AMWSCAN_FTP_USER |
--update, -u | Update the standalone scanner file |
--version, -v | Print the installed version |
--help, -h, -? | Print command help |
FTP sources
Pass one ftp://host/path or ftps://host/path URL as the scan path. PHP needs the FTP extension, and FTPS needs ftp_ssl_connect.
Do not place credentials in the URL. Set the username with --ftp-user or AMWSCAN_FTP_USER. Set the password with AMWSCAN_FTP_PASSWORD. Prefer FTPS because FTP sends credentials and file contents without encryption.
AMWSCAN_FTP_USER=scanner \
AMWSCAN_FTP_PASSWORD=secret \
php scanner ftps://files.example.com/public_html --report
FTP scans use a temporary local mirror, force report mode, and remove the mirror after completion. One scan accepts one FTP source with limits of 10,000 files, 64 MiB per file, and 512 MiB total. FTP sources cannot use --scan-wordpress-db.
Platform checksum verification
Checksum verification supports WordPress, selected WordPress plugins, Drupal, Joomla, Magento Open Source, and public Composer packages. The scanner skips only files that match trusted release bytes. It scans modified, generated, and unknown files.
A first check for a platform version can require outbound HTTPS. Successful manifests remain in a local cache. Use --disable-checksum when the scan must make no checksum requests.
Coverage and resume
Reports separate discovered, eligible, scanned, cached, verified, and skipped files. Skip reasons include path filters, extensions, file size, unreadable files, and archive limits.
--checkpoint=<private-path> saves progress after each candidate. --resume continues only when the candidate list and scan settings still match.
ZIP scanning requires ext-zip. The scanner limits entry paths, symbolic links, entry count, file size, expanded size, compression ratio, and nesting depth. Reports mark content beyond those limits as incomplete coverage.
WordPress database scan
--scan-wordpress-db runs an optional read only phase against locally discovered WordPress installations. It checks database triggers, inventories primary site administrators, flags multiple administrators for review, and reports orphaned posts. It does not modify database content.
The option requires ext-mysqli. AMWScan reads literal database settings from wp-config.php without executing the file. Dynamic or ambiguous settings produce an incomplete coverage result.
Exit and automation guidance
Use JSON when another program will process detailed findings. Use SARIF for tools that understand the standard format. Keep reports as build artifacts, protect any local paths or code excerpts they contain, and test the scanner's exit behavior in your own continuous integration job before making it a release gate.