Qartvelo Guard Docs For system administrators

WP-CLI and cron.php

Every wp wpcybersec command, the options of bin/cron.php and how to run them with the site's PHP and user.

Everything you do on the Reports page can also be done from the command line: with WP-CLI through wp wpcybersec, or without WP-CLI through the plugin's own bin/cron.php script.

Run both as the user that owns the site files, with the site's own PHP; see Run as the site user and CyberPanel and OpenLiteSpeed.

wp wpcybersec

Run wp help wpcybersec for the built-in help.

status

Shows the protection settings, what waits for a decision, the last scan and the early guard.

Shell

wp wpcybersec status
wp wpcybersec status --format=json

--format: table (default), json, csv or yaml.

scan

Runs a scan to completion. Without options it is a quick scan (new and changed files). If a scan is already running, the command waits for it and reports its result.

Shell

wp wpcybersec scan
wp wpcybersec scan --full
wp wpcybersec scan --baseline
wp wpcybersec scan --database
wp wpcybersec scan --no-malware

Option	What it does
`--full`	Also re-checks unchanged files for malware.
`--baseline`	Trusts every current file (rebuilds the baseline). Files with malware are still reported as threats. Cannot be combined with `--full`.
`--malware` / `--no-malware`	Malware signatures are on by default; `--no-malware` only detects new and changed files.
`--database` / `--no-database`	The database scan is on by default for `--full` and `--baseline`. Add `--database` to a quick scan, or skip it with `--no-database`.

--isolated is not available here, because WP-CLI has already loaded every plugin; the command prints the bin/cron.php line to use instead.

pending

Lists items waiting for a decision.

Shell

wp wpcybersec pending
wp wpcybersec pending --type=threat
wp wpcybersec pending --type=upload --format=ids

--type: all (default), upload, install, file, threat or user. --format: table, json, csv, yaml, ids or count.

approve and deny

Shell

wp wpcybersec approve 12 15
wp wpcybersec deny 13
wp wpcybersec deny 14 --delete

approve <id>... allows the items and remembers each file's SHA-256, so the same file is never held again. For threats this marks the file as safe.
deny <id>... rejects held uploads and installs and deletes their held copy. Unknown files and threats that are still in place are moved to quarantine.
--delete permanently deletes file and threat items instead, including files already in quarantine.

allowlist

Shell

wp wpcybersec allowlist list
wp wpcybersec allowlist add 3f7a...e91c --label="Logo from the designer"
wp wpcybersec allowlist add 3f7a...e91c --exec
wp wpcybersec allowlist remove 42

add <sha256> takes a 64-character SHA-256 (get one with sha256sum file). Without --exec it only passes under non-executable names, such as images, PDFs and ZIP files. --exec also allows those bytes as a .php or other executable file.
remove <id> takes the entry ID from list.
--label adds a note; --format changes the list output.

guard

Shell

wp wpcybersec guard status
wp wpcybersec guard install
wp wpcybersec guard uninstall

Installs, removes or shows the early upload guard. install writes the guard files and prints the auto_prepend_file lines to add. WP-CLI itself never loads the guard, so status relies on the last live test.

unlock and lock

Shell

wp wpcybersec unlock --minutes=30
wp wpcybersec lock

With freeze mode on, unlock allows plugin, theme and core changes for a while (default: the "Unlock for" setting, at most 1440 minutes); lock ends it early.

report

Shell

wp wpcybersec report --file=/tmp/security-report.html

Creates the security report: one HTML file with the scan results, open items with their code, settings, environment checks and recent activity, with secrets hidden. Without --file the HTML is printed. The file is readable by its owner only.

core-reinstall

Shell

wp wpcybersec core-reinstall

Replaces wp-admin, wp-includes and the core files in the WordPress folder with the verified official files of the installed version, then runs a quick scan. It asks before the swap; --yes skips the question. The old core is kept for 7 days. See Clean core reinstall.

bin/cron.php

A scan runner for cron jobs and servers without WP-CLI. It runs only from the command line (over the web it answers 403).

Shell

php wp-content/plugins/qartvelo-guard/bin/cron.php
php wp-content/plugins/qartvelo-guard/bin/cron.php --full
php wp-content/plugins/qartvelo-guard/bin/cron.php --isolated --full
php /var/www/example.com/wp-content/plugins/qartvelo-guard/bin/cron.php --quiet --wp=/var/www/example.com
php bin/cron.php --full --url=https://example.com/ --wp=/var/www/example.com

Option	What it does
`--full`	Full malware scan: re-scans unchanged files too. Includes the database scan.
`--baseline`	Rebuilds the trusted baseline. Includes the database scan.
`--no-malware`	Skips malware signatures; only detects file changes.
`--isolated`	Clean-room scan: no other plugin and no theme is loaded for this run, so a compromised one cannot hide files from the scanner. Nothing is deactivated. Must-use plugins and drop-ins still load and are listed so you can check them.
`--wp=PATH`	The WordPress folder (where wp-load.php lives). Without it, the script looks upwards from its own folder and then from the current folder, including `wp/` and `web/wp/` subfolders (WordPress in a subfolder, Bedrock).
`--url=URL`	The site address WordPress loads as. Needed on multisite when wp-config.php does not define DOMAIN_CURRENT_SITE in a plain define() line.
`--quiet`, `-q`	No progress lines; the final summary is still printed.
`--help`, `-h`	Shows the usage.

If a scan is already running, the script continues it. It ends with a summary such as "Qartvelo Guard full scan done: 18234 files checked, 3 new, 1 modified, 0 deleted, 0 threats, 0 quarantined, 0 skipped."

Exit code	Meaning
0	The scan finished (or `--help`).
1	WordPress or the plugin could not be loaded, an option was invalid, or the scan failed. The reason is printed.
2	Isolation failed: code of another plugin or theme was loaded anyway, usually through a must-use plugin or drop-in. No scan was run.

Run as the site user, not root

Commands that load WordPress (wp, bin/cron.php and similar tools) create cache, log and data files. Run as root, those files belong to root and PHP can no longer change them. Run them as the owner of the site files with sudo -u:

Shell

stat -c %U /var/www/example.com
sudo -u siteuser wp wpcybersec status --path=/var/www/example.com

If root already created files, Troubleshooting shows how to give them back.

CyberPanel and OpenLiteSpeed

The server's default php, and so wp, can be another PHP version than the site's lsphp. Other plugins' Composer platform check then stops WP-CLI with "Your Composer dependencies require a PHP version ...". Find the site's PHP version in its vHost file:

Shell

grep lsphp /usr/local/lsws/conf/vhosts/example.com/vhost.conf

Then run WP-CLI with that PHP, as the site user (lsphp83 is PHP 8.3; command -v wp shows where wp lives):

Shell

sudo -u siteuser /usr/local/lsws/lsphp83/bin/php /usr/bin/wp --path=/home/example.com/public_html wpcybersec status

The same works for bin/cron.php: start it with /usr/local/lsws/lsphp83/bin/php instead of php.

All docs Qartvelo Guard home Ask a question