Install PHP Antimalware Scanner
Choose a release file for a standalone scanner. Choose Composer when you want dependency management or programmatic use.
PHP 7.4 or newer is required. Review the required extensions before installation.
Standalone release
Download the latest scanner file from the GitHub releases page or fetch the current build:
curl --fail --silent --show-error --location \
--output scanner \
https://raw.githubusercontent.com/marcocesarato/PHP-Antimalware-Scanner/master/dist/scanner
Check the scanner version, then run a report only scan:
php scanner --version
php scanner /var/www/example --lite --report
Keep the scanner outside the directory you scan. This prevents the release file and generated reports from appearing in the scan scope.
Do not use --no-check-certificate or an equivalent option. A failed certificate check can indicate a network or trust store problem that needs attention.
Composer
The package is published as marcocesarato/amwscan.
Install for one project
composer require marcocesarato/amwscan
php vendor/marcocesarato/amwscan/src/index.php /var/www/example --lite --report
A project installation pins the scanner version in composer.lock, which helps teams and continuous integration use the same release.
Install for the current user
composer global require marcocesarato/amwscan
php "$(composer global config home)/vendor/marcocesarato/amwscan/src/index.php" /var/www/example --lite --report
On Windows PowerShell:
$composerHome = composer global config home
php "$composerHome\vendor\marcocesarato\amwscan\src\index.php" "C:\Sites\example" --lite --report
Source checkout
Use a source checkout when contributing or testing unreleased changes:
git clone https://github.com/marcocesarato/PHP-Antimalware-Scanner.git
cd PHP-Antimalware-Scanner
composer install
php src/index.php /var/www/example --lite --report
Do not use the development branch as a silent replacement for a pinned production release.
Docker
Build the included image from a source checkout:
docker build --tag amwscan .
Mount the target as read only for an initial report scan. Mount a separate output directory for reports:
docker run --rm \
--volume "/var/www/example:/scan:ro" \
--volume "$PWD/amwscan-output:/output" \
amwscan scanner /scan --lite --report --path-report=/output/report.html
WordPress plugin
The WordPress plugin adds scheduled scans, report review, upload protection, quarantine, and controlled file actions to the administration area.
Verify the installation
A healthy installation should return a version and show help without PHP startup errors:
php scanner --version
php scanner --help
Continue with Run your first scan.