CLI Command Reference
Run php scanner --help to see the options supported by your installed version.
php scanner [path] [options]
path accepts a file, directory, wildcard, or one FTP or FTPS URL. When omitted, the scanner uses the current directory.
Detection
| Option | Purpose |
|---|---|
--lite, -l | Reduce common false positives while retaining broad detection |
--only-signatures, -s | Scan for malware signatures only |
--only-exploits, -e | Scan for exploit patterns only |
--only-functions, -f | Scan for dangerous PHP functions only |
--exploits=<names> | Include selected exploit definitions, separated by commas |
--ignore-exploits=<names> | Exclude selected exploit definitions, separated by commas |
--functions=<names> | Scan for selected PHP functions, separated by commas |
--scan-all, --all | Inspect files regardless of extension |
--scan-archives | Inspect ZIP entries within safety limits |
--scan-wordpress-db | Inspect a local WordPress database and offer confirmed cleanup interactively |
--disable-domain-analysis, --no-domain-analysis | Disable dangerous-domain analysis; scoped JavaScript definitions remain active |
--domain-analysis-scope=<scope> | Analyze dangerous domains in scripts or all eligible files (default: all) |
--max-filesize=<size> | Skip files larger than the given size |
Scope and progress
| Option | Purpose |
|---|---|
--ignore-paths=<patterns> | Exclude comma separated paths or wildcards |
--filter-paths=<patterns> | Include only matching paths or wildcards |
--offset=<number> | Start at a position in the candidate file list |
--limit=<number> | Limit the number of mapped files |
--checkpoint=<path> | Save resumable scan progress in a private JSON file |
--resume | Continue a checkpoint when its files and settings still match |
--scan-control=<path> | Cooperatively pause or cancel a scan from a private control file |
--scan-heartbeat=<path> | Update a private heartbeat file while a scan is active |
--disable-cache, --no-cache | Ignore cached scan results |
php scanner /var/www/example --lite --report-only \
--ignore-paths="*/cache/*,*/logs/*" \
--max-filesize=5MB
GenAI finding review
GenAI review is disabled by default. When enabled, AMWScan asks the selected provider for an advisory malware, false_positive, or uncertain verdict after detection finishes. Each request contains the matched rule and a bounded code excerpt around the detected line. It never changes finding status or modifies files automatically. See GenAI Finding Review for provider setup, privacy considerations, and a safe review workflow.
| Option | Purpose | Default |
|---|---|---|
--ai-provider=<provider> | Use openai, anthropic, gemini, claude-code-cli, codex-cli, copilot-cli, or opencode-cli | disabled |
--ai-model=<model> | Override the provider or installed CLI model | Provider default |
--ai-context-lines=<number> | Include 0 to 20 lines above and below the detection | 5 |
--ai-max-findings=<number> | Limit review attempts per scan to 1 through 100 | 20 |
--ai-timeout=<seconds> | Limit each provider request to 5 through 300 seconds | 30 |
--ai-executable=<path> | Override the executable used by an installed CLI provider | Provider command |
API keys are read from OPENAI_API_KEY, ANTHROPIC_API_KEY, or GEMINI_API_KEY. AMWSCAN_AI_API_KEY overrides the provider-specific variable. Keys are not accepted as command options because command arguments can appear in shell history and process listings.
GEMINI_API_KEY=your-key php scanner /var/www/example \
--report-only --report-format=json --ai-provider=gemini
php scanner /var/www/example --report-only \
--ai-provider=claude-code-cli --ai-model=claude-sonnet-4-5
Direct API defaults are gpt-5.6-luna, claude-haiku-4-5, and gemini-3.8-flash. Installed CLI integrations invoke claude, codex, copilot, or opencode without a shell in an isolated directory. They normally send source excerpts to remote model services; installed does not mean local inference. Use --ai-executable when the command is installed under another name or path.
Reports and output
| Option | Purpose | Default |
|---|---|---|
--report | Write a report while retaining interactive actions | Off |
--report-only, -r | Disable interactive actions and write a report | Off |
--jobs=<count>, -j | Set parallel workers for eligible report-only scans (auto or 0 uses every detected CPU core; 1 disables parallelism) | Detected CPU cores, capped at 8 |
--report-format=<format> | Select html, txt, json, or sarif | html |
--path-report=<path> | Set the report file path | ./scanner-report.html |
--log=<path> | Write a scan log | Off |
--path-logs=<path> | Set the scanner log path | ./scanner.log |
--silent | Hide terminal output and prompts | Off in CLI |
--disable-report, --no-report | Prevent report generation | Off in CLI |
--disable-colors, --no-colors, --no-color | Remove ANSI colors | Off |
--debug | Display all PHP errors and warnings | Off |
See Scan reports for a screenshot, format guidance, coverage details, and report storage advice.
File actions
Use automated cleaning or deletion only with current backups and a tested recovery plan. Start with --report-only on each new project.
| Option | Purpose |
|---|---|
--backup, -b | Back up every file changed by the scanner |
--auto-clean | Remove matched code without confirmation |
--auto-clean-line | Remove the matched line without confirmation |
--auto-delete | Delete detected files without confirmation |
--auto-quarantine | Move detected files to quarantine |
--auto-skip | Leave every finding unchanged |
--auto-whitelist | Add every finding to the whitelist |
--auto-prompt=<action> | Apply one prompt response to every finding |
--whitelist-only-path | Match whitelist entries by path without line matching |
Store backups, quarantine, reports, and whitelist data outside the public document root:
| Option | Purpose |
|---|---|
--path-backups=<path> | Set the backup directory |
--path-quarantine=<path> | Set the quarantine directory |
--path-whitelist=<path> | Set the whitelist file (JSON by default; legacy CSV is supported) |
--findings-store=<path> | Set the canonical finding lifecycle JSON file |
--path-deobfuscate=<path> | Set the directory for deobfuscated files |
Integrity and definitions
| Option | Purpose |
|---|---|
--disable-checksum, --no-checksum, --no-verify | Skip platform and package checksum verification |
--path-definitions=<path> | Set the private Maltrail definition cache |
--disable-definitions-update | Use the last verified Maltrail cache without an update request |
--defs | Print exploit and function definitions |
--defs-exploits | Print exploit definitions |
--defs-functions | Print dangerous function definitions |
--defs-functions-encoded | Print encoded function definitions |
Built in signatures remain available offline. Platform checksums and Maltrail definition updates can require outbound HTTPS on the first scan.
Utility options
| Option | Purpose |
|---|---|
--ftp-user=<username> | Set the FTP username, or use AMWSCAN_FTP_USER |
--update, -u | Update the standalone scanner file |
--version, -v | Print the installed version |
--help, -h, -? | Print command help |
FTP sources
Pass one ftp://host/path or ftps://host/path URL as the scan path. PHP needs the FTP extension, and FTPS needs ftp_ssl_connect.
Do not place credentials in the URL. Set the username with --ftp-user or AMWSCAN_FTP_USER. Set the password with AMWSCAN_FTP_PASSWORD. Prefer FTPS because FTP sends credentials and file contents without encryption.
AMWSCAN_FTP_USER=scanner \
AMWSCAN_FTP_PASSWORD=secret \
php scanner ftps://files.example.com/public_html --report-only
FTP scans use a temporary local mirror, force report mode, and remove the mirror after completion. One scan accepts one FTP source with limits of 10,000 files, 64 MiB per file, and 512 MiB total. FTP sources cannot use --scan-wordpress-db.
See FTP and FTPS integration for WordPress setup, server requirements, complete safety limits, and troubleshooting.
Platform checksum verification
Checksum verification supports WordPress, selected WordPress plugins, Drupal, Joomla, Magento Open Source, and public Composer packages. The scanner skips only files that match trusted release bytes. It scans modified, generated, and unknown files. When every eligible file matches trusted bytes, it also skips supplemental component-inventory and reputation checks.
A first check for a platform version can require outbound HTTPS. Successful manifests remain in a local cache. Use --disable-checksum when the scan must make no checksum requests.
Coverage and resume
Reports separate discovered, eligible, scanned, cached, verified, and skipped files. Skip reasons include path filters, extensions, file size, unreadable files, and archive limits.
--checkpoint=<private-path> coalesces sequential progress writes (normally every 100 candidates or two seconds) to reduce disk overhead. Parallel scans persist each completed worker chunk in the parent process, including chunks that finish out of order, and merge their reports in scan order. --resume continues only when candidate metadata and scan settings still match; unfinished ranges are always scanned. For cooperative control, write paused or cancelled to the private file passed to --scan-control; a paused checkpoint can be resumed, while cancellation should discard it.
ZIP scanning requires ext-zip. The scanner limits entry paths, symbolic links, entry count, file size, expanded size, compression ratio, and nesting depth. Reports mark content beyond those limits as incomplete coverage.
WordPress database scan
--scan-wordpress-db runs an optional inspection phase against locally discovered WordPress installations. It checks database triggers, inventories primary site administrators, flags suspicious or multiple administrators for review, and reports orphaned posts. Detection is read only. In an interactive local CLI session, every destructive operation requires confirmation: triggers can be dropped, suspicious users can be deleted after their posts are reassigned to a valid account, and orphaned posts can be removed in bounded batches with their related metadata, comments, and term relationships. Non-interactive scans only report findings.
The option requires ext-mysqli. AMWScan reads literal database settings from wp-config.php without executing the file. Dynamic or ambiguous settings produce an incomplete coverage result. Administrator inspection and displayed evidence are bounded; reports explicitly mark coverage incomplete when the inspection limit is exceeded.
Exit and automation guidance
Use JSON when another program will process detailed findings. Use SARIF for tools that understand the standard format. Keep reports as build artifacts, protect any local paths or code excerpts they contain, and test the scanner's exit behavior in your own continuous integration job before making it a release gate.