WordPress security scanning

WP PerformanceShield checks every WordPress site on a PlusPanel server for three things: known vulnerabilities in the installed core, plugins and themes, files that differ from the official release, and malicious code. Each site gets a security score from 0 to 100 and a list of findings with a fix button.

What is checked

• Vulnerabilities. The installed versions of WordPress, every plugin and every theme are matched against a vulnerability database. A match shows the severity (CVSS), the CVE when there is one, and the first version that fixes it.
• Integrity. Core, plugin and theme files are compared with the official checksums published by wordpress.org. A modified official file, a missing one, or an extra PHP file inside wp-admin, wp-includes or a plugin folder is reported.
• Malware. PHP files are checked for the patterns backdoors use (evaluated encoded payloads, request data turned into code, heavy obfuscation), PHP hidden in wp-content/uploads or in images, suspicious .htaccess rules (prepended files, images executed as PHP, search-engine-only redirects), and a set of YARA rules for known web shells and injectors.
• The database. New administrator accounts since the previous scan, scheduled tasks (WP-Cron) that no installed component explains, and a site address changed to another host.

When it runs

Scan	What	When
Integrity	versions, vulnerabilities, official checksums, uploads, .htaccess, database checks	every day
Full	everything above + malware heuristics and YARA rules over every file	every week
On demand	full	from the panel (Free: once a day per site)
After a change	integrity	after an update or a fix, and as soon as a new vulnerability affects an installed version

Scans run with a CPU and disk-read limit, so a scan never slows the site down noticeably.

How it fixes things

• Update now. A vulnerable plugin, theme or WordPress core is updated after a snapshot of the site. If the site does not answer correctly after the update, it is rolled back automatically.
• Quarantine. A malicious or unexpected file is moved into a quarantine area of your account that the site can no longer read or run. It can be restored with one click. Nothing is ever deleted without going through quarantine first; emptying the quarantine is a separate, explicit action.
• Reinstall the official file. A modified core, plugin or theme file is replaced by its official copy from wordpress.org (the modified one goes to quarantine).
• Automatic fixes (optional, off by default). Per site you can let PerformanceShield update vulnerable components, reinstall modified official files and quarantine high-confidence malware on its own. Every automatic action is recorded in the audit log.

Administrators also see the whole fleet: the most vulnerable sites, the most widespread vulnerable plugins, and bulk updates in waves (one site first, then 10 %, 50 %, everyone) that stop by themselves if an update breaks a site.

Privacy and safety by design

• Your server never contacts a vulnerability service. The PlusPanel control plane downloads the vulnerability data and the official checksums and sends your server only what its sites need, inside signed commands.
• The scanner runs with your account’s rights, in your account’s container, with no network access while it reads files and your site mounted read-only. It never runs your site’s PHP code: versions are read from file headers and the database is read directly.
• No file content leaves your server. Reports contain paths, sizes, checksums and the rule that matched.

Data sources and attribution

Vulnerability data is provided by Wordfence Intelligence (© Defiant Inc., used under the Wordfence Intelligence Terms and Conditions). Records that come from the CVE program also carry the MITRE copyright notice, shown next to the record in the panel. Hosters can optionally add their own Patchstack or WPScan subscription. Official checksums come from wordpress.org. The malware rules are our own plus a public rule set used under its licence; the YARA engine is YARA-X (BSD-3-Clause).

Security scanning is included in every edition.