Qartvelo Company
Qartvelo Guard Docs For system administrators
Real cron
Run scans on time with a server cron job instead of WP-Cron, per hosting panel.
WordPress runs scheduled tasks only when someone visits the site (WP-Cron). On a quiet site, a scheduled scan can start hours late, and long scans move forward only while visitors arrive. A cron job on the server makes scans run on time and lets long scans finish without a browser.
The recommended jobs
The plugin prints these lines with your PHP binary and paths filled in under Settings > Advanced > Real cron (and in step 6 of the wizard). Copy them from there. With /var/www/example.com as the WordPress folder they look like this:
# Qartvelo Guard: quick scan every hour, full malware scan every night.
17 * * * * php /var/www/example.com/wp-content/plugins/qartvelo-guard/bin/cron.php --quiet --wp=/var/www/example.com > /dev/null
30 3 * * * php /var/www/example.com/wp-content/plugins/qartvelo-guard/bin/cron.php --full --quiet --wp=/var/www/example.com > /dev/null
# The rest of WordPress cron every 5 minutes.
*/5 * * * * php /var/www/example.com/wp-cron.php > /dev/null 2>&1- A quick scan every hour, at minute 17.
- A full malware scan every night at 3:30.
- The rest of WordPress cron every 5 minutes, so you can switch off WP-Cron on page visits.
Add them to the crontab of the user that owns the site files (often www-data), with crontab -e. Only one scan runs at a time, so overlapping runs are harmless.
With WP-CLI
If WP-CLI is installed, this variant works too. Use the full path to wp if cron cannot find it:
17 * * * * wp wpcybersec scan --path=/var/www/example.com --quiet
30 3 * * * wp wpcybersec scan --full --path=/var/www/example.com --quiet
*/5 * * * * wp cron event run --due-now --path=/var/www/example.com --quietWhere to add them in your panel
| Panel | Where |
|---|---|
| cPanel | Advanced > Cron Jobs. Enter each job's schedule under "Add New Cron Job", paste the command and click "Add New Cron Job". If the page is missing, your host has switched it off: send them the jobs. |
| Plesk | Websites & Domains > Scheduled Tasks > Add Task. Use the task type "Run a PHP script" with the script path and arguments the plugin shows (the "Run a command" type uses a chrooted shell that may not find PHP). |
| CyberPanel | Websites > List Websites, Manage next to the site, then Cron Jobs. |
| aaPanel | Cron > Add Task, type "Shell Script". Set "Execute user" to the owner of the site files (www on aaPanel), not root. |
| DirectAdmin | User Level, Cronjobs. |
| HestiaCP, VestaCP | Log in as the site's user and open the Cron tab. |
| CloudPanel | The site's Cron Jobs tab. |
| Hostinger | hPanel, Advanced > Cron Jobs, type Custom. Times are in UTC. |
| Your own server | crontab -e as the user that owns the site files. |
The plugin names the menus of many more panels (Forge, Ploi, RunCloud, GridPane, SpinupWP, Cloudways, ISPConfig, Virtualmin, FASTPANEL, ISPmanager, CWP) when it detects them. WP Engine has no server cron jobs: switch on Alternate Cron in the User Portal instead.
Switch off WP-Cron on page visits
Once the jobs have run (the plugin notices the first run within an hour), page visits no longer need to trigger background work. Press Switch off visitor-triggered cron under Settings > Advanced > Real cron, or add this line to wp-config.php above "That's all, stop editing!":
define( 'DISABLE_WP_CRON', true );Multisite
On a network the plugin runs on the main site only, and the scan lines get a --url= with the network address. The other sites keep their own WP-Cron, so switch WP-Cron off only when cron runs for every site, for example with:
*/5 * * * * wp site list --field=url --path=/var/www/example.com | xargs -I{} wp cron event run --due-now --url={} --path=/var/www/example.com --quiet