The malware scanner

The malware scanner reads every PHP file on the site without running it and scores it on what it contains: code assembled at runtime, request data reaching a shell, an executable file where uploads belong. A finding is a reason to look — shown with the rule that fired, the line and the code — not an accusation. Nothing is ever deleted behind your back.

Like the file check, it costs nothing until you start it. Run a scan from the Malware tab, or let the schedule run it.

It scores reasons, not verdicts

The scan works over the token stream of each file — the structure PHP itself sees — rather than a regular expression over the source text, which is fragile and trivially evaded by a comment inside a call or a name split across a concatenation. Nothing is executed or included.

Almost none of these constructs is malicious on its own. Honest plugins decode base64, minifiers write 100 KB lines, mailers build shell commands. What marks a webshell is several of these signals in one small file, so each rule carries a weight, the file is scored, and the total decides whether you are told at all. A file below the reporting threshold is never mentioned.

Two ideas do most of the work:

• A file that matches the official release is not analysed at all. If the integrity check says a file is exactly what WordPress.org shipped, it is the official file — so the scanner skips it. On a normal site that skips the whole of core, which removes the single largest source of false positives before the first rule runs.
• A name assembled at runtime counts for more than the function itself. $callback($data) in wp-admin is a plugin API doing its job; the same call where the name was built from chr(115).chr(121)… is someone keeping the word “system” out of the file. Only a name traced back to a decoder, chr(), or a run of single-character concatenation is treated as hidden.

Reading a finding

Each finding carries a severity:

Severity	What it says
Critical	Several strong signals in one file — the shape of a webshell
High	A strong signal, or a combination worth looking at now
Medium	Something unusual, often an honest library doing something clever

A finding shows you the rule that fired, the line and the code, so you can judge it yourself. A legitimate library that genuinely generates and evaluates code will score — a well-known cryptography library does exactly that for performance — which is why the scanner hands you the evidence instead of a verdict.

Clearing a finding

Because a finding is a reason to look and not a verdict, the scanner never deletes anything. What it offers instead:

• Mark as reviewed. This clears a finding you have judged to be fine. The decision is remembered against the file’s contents, not its path — so an honest library has to be cleared once, and if that file is ever replaced the finding comes back on its own. Reviewed findings drop out of the counts and move to their own section.
• Quarantine. This moves a file out of harm’s way, and takes a copy first, so releasing it again is one click. See Restore points & rollback.

See also

• File integrity — the check whose matches let the scanner skip core
• Restore points & rollback