WordPress Security Plugin

AMWScan Antimalware Scanner lets WordPress administrators run and review AMWScan checks without leaving the dashboard. It stores reports, backups, quarantine, and scan state outside the scanned directory.

Choose an edition

Edition	Download	Browser file editor	Restore quarantined files
AMWScan Antimalware Scanner Lite	WordPress.org	WordPress plugin editor when permitted	No
AMWScan Antimalware Scanner	GitHub / amwscan-X.Y.Z.zip	Built-in editor	Yes

Lite is a separate Store-safe package: full-only code is absent from the archive, not merely disabled. Both editions use the amwscan directory, text domain, settings, and data, and therefore cannot be active together. Deactivate and remove the installed edition before switching.

Install and activate

1. Install Lite from the WordPress.org plugin page, or download the latest full WordPress plugin release from GitHub.
2. In WordPress, open Plugins > Add New to install Lite, or choose Upload Plugin to upload a release ZIP. You can also copy release contents to wp-content/plugins/amwscan.
3. Activate AMWScan Antimalware Scanner.
4. Open Antimalware > Settings to confirm the scan target and policy.

The plugin requires WordPress 5.3 or newer and PHP 7.4 or newer. It automatically uses self-contained administration assets when an older WordPress installation does not provide the required JavaScript packages. Enable the PHP zip extension to inspect archives and restore trusted WordPress core files.

Run your first scan

Open Antimalware and select Run scan now. Scans run in the background through WP-Cron; the dashboard refreshes the phase, file progress, throughput, checkpoint freshness, and estimated remaining time. Live status polls run five seconds after the previous request completes, without rereading retained reports. Dashboard summaries refresh on scan-state changes, after an explicit refresh, and otherwise once a minute; completion is displayed before the summaries finish loading. Use Pause to preserve resumable progress, Resume scan to continue it, or Cancel to stop and discard the checkpoint.

The dashboard summarizes daily manual and scheduled scan activity, detection totals, recent results, and the active scanner policy at a glance. Every detection remains visible in the activity chart: red segments need review, gray segments are whitelisted, and green segments were quarantined, deleted, or cleaned. Mixed outcomes split the same bar proportionally, while a dotted blue bar marks the next scheduled scan.

When the latest active report has unresolved security findings, administrators also see a shield and finding count in the WordPress toolbar. Select it to open the reports list directly; the indicator disappears when no findings need review.

The WordPress home dashboard also includes an Antimalware Scanner widget with scanner health, the latest scan result, stored traffic matches, and shortcuts to the scanner, Traffic console, and scan action.

When the scan completes, select Open report to inspect every detection. Select View code beside a local malware match to open a modal with three lines before and after the detection; the exact matched code is highlighted. Start with report-only mode, which is the default: it records findings without changing files.

caution

Review each finding and make a backup before using clean, delete, or quarantine actions. Automatic file-changing actions require an explicit setting, and every report action checks that the file still matches the scan snapshot.

Configure scans

Open Antimalware > Settings to set the scan target, detection mode, schedule, and storage locations. Scan policy remains visible, while advanced sections can be expanded individually or together. The browser remembers the sections you leave open.

The fully expanded settings view shows every advanced control available for scheduling, email notifications, upload and archive coverage, resumable scans, backups, and diagnostic logging.

• Scan policy controls the scan mode and default response. The sensitivity slider progresses from Signatures (the lowest alert volume) through Functions, Lite, and Exploits to Full (the broadest coverage). Lite is the default for new installations and omits the common `ls-la` signature to reduce false positives.
• Schedule can run hourly, twice daily, daily, or weekly. WP-Cron depends on site traffic; use a system scheduler to run wp cron event run --due-now for predictable timing. Background scans request a minimum memory_limit of 512 MB when permitted, preserve higher or unlimited limits, and continue with the host value when it cannot be changed. PHP and JavaScript file sizes are checked before their contents are loaded. Scripts over the safe automatic-analysis limit receive a memory-bounded raw-signature screening of their beginning and end instead of full analysis, avoiding memory exhaustion on constrained hosts, plus a non-critical warning requiring manual review. Archives and binary files do not receive this script-size warning. After long-running file work, the plugin verifies the WordPress database connection before saving final status and releasing the scan lock.
• Scope and limits lets you define filters, choose a parallel scan profile, and optionally enable bounded ZIP inspection. Automatic is the default for new installations and uses the detected CPU count capped at eight, Maximum uses every detected CPU core, and Custom accepts a fixed worker count. Eligible resumable report-only scans can use worker processes when the host provides PHP pcntl; hosts without it fall back safely to one process. Archive scanning is disabled for manual and scheduled scans by default because large archives can consume substantial resources.
• Detection definitions enables local Maltrail domain reputation checks. The default Script and web files scope avoids extracting domains from media and unrelated files; choose All eligible files for the broadest coverage, or disable domain analysis entirely. Definition updates happen once per scan rather than once per file.
• GenAI finding review optionally sends a bounded excerpt around each malware detection to an AI provider. It is disabled by default and verdicts are advisory. Install the canonical WordPress AI plugin to enable the recommended WordPress AI / configured connectors option. Configure providers under Settings → Connectors (wp-admin/options-connectors.php) and manage AI plugin features under Settings → AI (wp-admin/options-general.php?page=ai-wp-admin). AMWScan retrieves compatible text-generation models dynamically from the configured connector registry; Automatic uses WordPress AI's filterable preferred-model fallback list. This path uses connector credentials and approval without storing another key in AMWScan. Direct OpenAI, Anthropic, and Gemini API configuration remains available as an advanced fallback.
• WordPress Abilities API integration is capability-detected and optional. Administrators and approved REST/MCP clients can read scan status, list unresolved findings, and retrieve one finding summary. These abilities never include code excerpts and cannot start scans or perform remediation.
• Engine and storage manages private report, backup, quarantine, and definition-cache locations. Keep these locations outside the site files that you scan.

Review and remediate findings

Reports organize integrity, vulnerability, reputation, large-file, and WordPress database checks in a responsive bento grid, with Malwares kept at full width. HTML, CSV, JSON, text, and SARIF exports retain these finding categories when category data is available. Each table fits its grid cell without horizontal page scrolling; use the expand control beside a panel title to review that panel at full width, then restore it to the grid. Open panels and their tables fill the height of each desktop grid row; collapsed panels stay compact, and stacked panels retain their independent heights on smaller screens. Point to or focus a finding to reveal its row actions. Security findings provide Add exception, Reopen, trusted-file restoration, and confirmed database-item removal when available; malware detections provide Take action and Report finding when available. Database actions are restricted to reports for the current local WordPress installation. Suspicious-user removal reassigns authored posts to the administrator performing the action, while orphan cleanup removes related metadata, comments, and term relationships in bounded batches. Findings that need a new scan or are already handled keep a visible, disabled selection checkbox.

The translated Software versions DataTable lists detected WordPress core, plugins, and themes separately from findings, using the same native controls as other report tables: search, column sorting, update-status filters, and pagination. On narrow screens it switches to cards. Its panel starts expanded and can be collapsed using the heading, like the other report panels. Reports snapshot installed versions and available update information from existing WordPress transients, matched to the current installation, package path, and installed version. Missing, stale, or unsupported update data is Unknown, not Up to date. No update check is initiated, historical reports are not refreshed, and local update data is never applied to FTP scans or another installation. Available updates do not increase detection counts. Inventory is included in JSON, HTML, text, CSV, and SARIF exports; legacy reports without inventory remain readable.

The expanded report view keeps technical evidence and remediation controls together, making each finding easier to verify before acting.

Use Add to whitelist only after reviewing the reported matches. Whitelisting also works for files larger than the 2 MiB editor and automatic-cleaning limit, without modifying their contents. The plugin verifies the file hash during preflight and again inside the report lock, but skips a redundant third hash check to reduce work for large files. A file changed since the scan still requires a new scan before whitelisting.

When a detection’s source line is missing or outside the file, the details modal shows the file’s opening lines. A notice explains that these lines may not contain the detected code; unknown locations display Source line unknown, not Line 0. Exact matches in the excerpt retain their highlights. If a code request fails, select Retry loading code. Empty or unreadable files show a recovery message rather than a code excerpt. The new fallback messages, unknown-location label, and retry action have translations in all nine bundled languages. Hash verification and excerpt size limits still apply, so changed files require a new scan.

Full and Lite scans exclude binary data in PHP strings and comments from the non_printable heuristic and distinguish short path literals from long obfuscated strings. These checks reduce false positives in PDF and cryptography libraries without adding path-based exceptions. Run a new scan after updating; existing reports keep their original findings.

The report history supports row selection and bulk actions and provides an audit trail with scan duration, scanned-file totals, and detected-threat counts. Move older reports to Archived before permanently deleting them; archived reports can be restored at any time until deletion.

Automatic clean, quarantine, and delete actions require confirmation. For detected files inside an installed plugin, Lite opens the WordPress plugin editor when WordPress permits editing that file; other locations remain view-only. Quarantined files can only be permanently removed from Antimalware > Quarantine. Full adds a diff-based browser editor and quarantine restoration. It refuses an action when the file changed after the scan, so run another scan before acting on stale results.

Edit a detected file in the full edition

Select Edit on a malware finding to inspect the scanned file. The editor highlights each affected line and opens at the first match.

Change the file, then select Review changes. The plugin keeps the original file untouched while you review the edit.

The review dialog compares both versions and checks PHP syntax. Confirm and save stays unavailable when the content has not changed or the syntax check fails. On confirmation, the plugin checks the file against the scan snapshot, saves it through the configured backup policy, and scans it again. A stale file or a remaining detection returns you to the report with its status.

Quarantine and whitelist

Quarantine safely isolates suspicious files while retaining the metadata needed to review or permanently delete them. The full edition also permits restoration.

The whitelist lists explicitly trusted findings so reviewed false positives remain suppressed and can be removed when they need to be evaluated again. Successful whitelist actions mark matching report findings as ignored. Successful quarantine, delete, clean, and remove-lines actions mark them as resolved. Both manual and automatic actions update unresolved counts immediately.

Protect WordPress uploads

Scan and block malicious WordPress uploads is enabled by default in Settings > Scan policy. It checks media uploads and plugin or theme ZIPs before WordPress accepts them. Files with detections, or files without authoritative scan coverage, are blocked and recorded in a report for review.

JavaScript files are checked with scoped malware definitions, and script/web files receive dangerous-domain analysis by default. Choose the all-files scope for broader domain extraction, or disable domain analysis under Antimalware > Settings > Detection definitions when another control owns domain reputation scanning; JavaScript malware definitions remain active.

Disable this only when another upload security control is responsible for the same protection.

Monitor suspicious traffic

Enable Request monitoring under Antimalware > Settings > Traffic detection. The passive monitor uses conservative built-in heuristics for traversal, sensitive-file, exploit-path, scanner user-agent, and unexpected-method probes. You can add a curated local plain-text or CSV indicator file for IP addresses, CIDR ranges, domains, URLs, paths, and ua: fragments. Heuristics remain active when no indicator file is configured.

Open Antimalware > Traffic to review seven-day severity and category summaries, filter recent detections, and download a defanged CSV investigation export. The main Antimalware dashboard and WordPress home widget also show recent traffic status.

The Traffic console combines monitor health, loaded indicator totals, seven-day trends, and recent request evidence. Use its severity, category, date, and search filters to narrow an investigation before exporting the visible results.

Only requests that reach WordPress can be inspected. Monitoring does not block visitors or inspect DNS, TLS, arbitrary ports, static files, rejected connections, or outbound traffic. Query strings are discarded, addresses are reduced to network prefixes, and duplicate detections are suppressed for five minutes.

Help and diagnostics

The plugin's About page shows installed plugin and engine versions alongside links to documentation, support, contribution guidance, and licensing.

Use these shortcuts to verify the installed version or open the project documentation, issue tracker, contribution guide, and support resources.

For FTP or FTPS scans, configure a credential-free server URL in settings and provide the password through the AMWSCAN_FTP_PASSWORD environment variable; the plugin never saves FTP passwords in WordPress options.

See FTP and FTPS integration for prerequisites, limits, security guidance, and troubleshooting.

For development, test, and release procedures, see the plugin README.