Scanning

Quick, full and baseline scans, what is scanned, scheduled scans, the database scan and Recent changes.

The plugin keeps a fingerprint (SHA-256) of every file. Scans compare the site with those fingerprints and with official WordPress.org checksums, so they report only what is new or different, and they never report an original WordPress or WordPress.org plugin file.

Quick, full and baseline

The Dashboard has three buttons:

Scan	What it does
Run quick scan	Checks new and changed files since the last scan. Usually takes seconds. Scheduled scans are quick scans.
Run full scan	Also checks unchanged files again against the malware signatures (files that match an official checksum or that you approved are skipped). Includes the database scan.
Rebuild baseline	Trusts every current file as the new known-good state. Files with malware are still reported as threats. Do this only when you know the site is clean, for example right after a fresh install or a cleanup.

The first whole-site scan always becomes a baseline. The same happens when you change the scan folder: the old fingerprints no longer fit, so the next scan rebuilds them.

What a scan does with a new or changed file:

A file you approved, or that matches its official checksum, is trusted.
A file with high or critical malware findings becomes a threat.
A WordPress core or WordPress.org plugin file that differs from the official one is reported.
A new code file (PHP and similar) is reported, or moved to quarantine if you chose that under File monitor.
Other new files, such as images, are fingerprinted and trusted.

What is scanned

The WordPress folder: core, plugins, themes, must-use plugins and uploads, with every file fingerprinted.
wp-content, the plugins folder and the uploads folder even when they live outside the WordPress folder.
The files next to index.php when WordPress is in a subfolder, a wp-config.php one folder up, and every file wp-config.php loads.
Bedrock: the web/ folder and the project's config/ folder, when the site uses Bedrock's config/application.php.
Optionally the parent folder of WordPress, to find forgotten backups or other apps next to it (Settings > Advanced > Scan scope > Scan folder).

PHP, JavaScript, HTML, SVG and server configuration files are searched for malware. Images are checked for hidden PHP at their start and end. Archives, PDFs, media and fonts are fingerprinted but not searched. Files larger than 10 MB (setting "Largest file to check") are fingerprinted but not searched.

Symlinks: a linked folder is never followed through the link. If its real location is part of the scan it is scanned there; otherwise the scan summary says how many linked folders were not scanned.

Exclusions (Settings > Advanced > Scan scope) are one per line, relative to the scan folder. Folders end with /, and * and ? work. The defaults:

Exclusions

.git/
node_modules/
wp-content/upgrade/
wp-content/upgrade-temp-backup/
wp-content/wflogs/
*.log
error_log

The plugin's own data folder is always excluded. Code files in wp-admin and wp-includes that WordPress does not ship, and stray PHP files in the WordPress root, are checked on every scan.

Scheduled scans

Under Settings > General > Scanning, "Scheduled scans" runs a quick scan every hour, twice a day (default), once a day or once a week, or never. The first one starts about 5 minutes after you save. Scans run in the background in short steps, so no page waits for them.

WordPress runs scheduled tasks only when someone visits the site, so on quiet sites a scan can start late. A real cron job fixes that and adds a nightly full scan.

The database scan

Injected scripts often hide in the database rather than in files. Full and baseline scans (and a scheduled scan once a day) also check:

Options with code payloads such as eval with a decoder, and widgets, theme settings and custom HTML with scripts or iframes.
Posts of every type (published, draft, private, pending and scheduled) with scripts, iframes, eval or document.write.
The places header and footer plugins keep code: WPCode (Insert Headers and Footers), Head, Footer and Post Injections, Header Footer Code Manager and Code Snippets.

It reports scripts loaded from other sites (well-known embeds such as YouTube are not reported), eval in scripts, hidden iframes and escaped scripts written into the page. Code you added yourself through a header and footer plugin is reported for review once; use Mark safe to trust it. On multisite every site is checked.

Recent changes

If a site was already infected when the baseline was recorded, the infected files look normal to later scans. Reports > Recent changes helps in that case: it lists every PHP, script and configuration file modified in the last 7, 14 or 30 days, newest first, and says what explains each change:

A WordPress, plugin or theme update or install at that time.
A match with the official checksum.
Allowed by an administrator.
Written by this plugin.
An empty placeholder file.
Already reported.
Unexplained: none of the above.

Read an unexplained file on screen with View code, and press Report for review to put it on the Pending tab. The times are those the last scan saw, so run a quick scan first.

A clean-room scan

A compromised plugin can hook into WordPress and hide files from any scanner that runs inside it. The isolated scan loads no other plugin and no theme for that one run, without deactivating anything:

Shell

php wp-content/plugins/qartvelo-guard/bin/cron.php --isolated --full

Must-use plugins and drop-ins (db.php, object-cache.php, advanced-cache.php) always load and cannot be switched off; the scan lists them so you can check them yourself. See WP-CLI and cron.php.

Speed

Your visitors' pages cost the plugin no database queries, and a normal admin page on a single site costs none either. Scan work happens in steps of about 15 seconds (Settings > Advanced > Scan scope > "Work per scan step"), and a file that crashes the scanner twice is skipped and reported instead of stopping the scan.

All docs Qartvelo Guard home Ask a question