Skip to main content

WordPress Plugin

The Antimalware Scanner plugin lets WordPress administrators run and review AMWScan checks without leaving the dashboard. It stores reports, backups, quarantine, and scan state outside the scanned directory.

Install and activate​

  1. Download the latest WordPress plugin release.
  2. In WordPress, open Plugins > Add New > Upload Plugin and upload the release ZIP, or copy the release contents to wp-content/plugins/amwscan.
  3. Activate Antimalware Scanner.
  4. Open Antimalware > Settings to confirm the scan target and policy.

The plugin requires PHP 7.4 or newer. Enable the PHP zip extension to inspect archives and restore trusted WordPress core files.

Run your first scan​

Open Antimalware and select Run scan now. Scans run in the background through WP-Cron; the dashboard refreshes status and progress while a scan is active.

Antimalware Scanner dashboard showing scan status, activity, security overview, and recent reports

When the scan completes, select Open report to inspect every detection. Start with report-only mode, which is the default: it records findings without changing files.

caution

Review each finding and make a backup before using clean, delete, or quarantine actions. Automatic file-changing actions require an explicit setting, and every report action checks that the file still matches the scan snapshot.

Configure scans​

Open Antimalware > Settings to set the scan target, detection mode, schedule, and storage locations. Scan policy remains visible, while advanced sections can be expanded individually or together. The browser remembers the sections you leave open.

Antimalware Scanner settings screen

  • Scan policy controls the scan mode and default response. Use Lite or Signatures only when you need fewer false positives on a typical WordPress installation.
  • Schedule can run hourly, twice daily, daily, or weekly. WP-Cron depends on site traffic; use a system scheduler to run wp cron event run --due-now for predictable timing.
  • Scope and limits lets you define filters and optionally enable bounded ZIP inspection. Archive scanning is disabled for manual and scheduled scans by default because large archives can consume substantial resources.
  • Engine and storage manages private report, backup, quarantine, and definition-cache locations. Keep these locations outside the site files that you scan.

Review and remediate findings​

Reports list integrity, vulnerability, and reputation checks under Security findings. Code and signature matches appear once under Malware detections, with every detection collapsed initially for easier scanning. Point to or focus a finding to reveal its row actions. Security findings provide Add exception, Reopen, and trusted-file restoration when available; malware detections provide Edit, Take action, and Report finding when available. Findings that need a new scan or are already handled keep a visible, disabled selection checkbox.

The report history supports row selection and bulk actions. Move older reports to Archived before permanently deleting them; archived reports can be restored at any time until deletion.

Use the editor to review source before saving changes. Quarantine and delete actions require confirmation; quarantined files can be restored or permanently removed from Antimalware > Quarantine. The plugin refuses an action when the file changed after the scan, so run another scan before acting on stale results.

Protect WordPress uploads​

Scan and block malicious WordPress uploads is enabled by default in Settings > Scan policy. It checks media uploads and plugin or theme ZIPs before WordPress accepts them. Files with detections, or files without authoritative scan coverage, are blocked and recorded in a report for review.

Disable this only when another upload security control is responsible for the same protection.

Help and diagnostics​

The plugin's About page shows installed plugin and engine versions alongside links to documentation, support, contribution guidance, and licensing. For FTP or FTPS scans, configure a credential-free server URL in settings and provide the password through the AMWSCAN_FTP_PASSWORD environment variable; the plugin never saves FTP passwords in WordPress options.

For development, test, and release procedures, see the plugin README.