Each week our systems automatically run Malware Scans to ensure any security issues are picked up as soon as possible.
Our Security Scans are divided into three processes:
Automatic WordPress File Scanner
The WordPress Core File Scanner detects any files that do not belong on your WordPress site. To ensure the Core files are untouched, and original, this scanner also compares the contents of each file with the original files hosted by WordPress (via checksums).
The Unrecognized Core File Scan detects any files that do not come with regular installations within the wp-admin and wp-includes folder. Often configuration files, and not needed files can reside in the WordPress directories. You should be cautious with this, as these can be harmful or dangerous, as they can contain malware or other harmful contents.
The Plugin and Theme Guard Scanner is used to detect any changes to active plugins and themes. If you make any changes to plugins and themes outside of WordPress, the Guard will be alerted. This ensures you are notified once a plugin or theme file is adjusted, as this could indicate an intrusion on the website.
The Malware Scanner is the most important scanner in the process, as it indicates it attempts to discover all sorts of malware patterns embedded in your PHP files. The Malware Scanner scans all PHP and Javascript files under the root path of the WordPress installation, and all underlying directories (including wp-admin, wp-content, wp-includes).
Abandoned Plugin Scanner
The Abandoned Plugin Scanner scans all plugins to monitor if plugins have been abandoned by the plugin authors.
Abandoned plugins can lead to problems with breaking certain functionality by no longer being compatible with current WordPress implementations. This can result in either certain sections no longer working, or triggering a fatal error.
Another important impact of abandoned plugins can entail security issues, while both security issues and breaking functionality might not be the case now, you are running a risk with keeping them active on your site. It might be better to replace the plugin instead of waiting for it to impact your site.
We consider a plugin abandoned if it hasn't been updated in over 2 years, which includes no bug fixes, adjustment to the code to account for WordPress Core changes, no code enhancements and non-patched vulnerabilities.
Vulnerabilities Scanner
The Vulnerabilities Scanner regularly scans your plugin and compares their current versions against a list of known vulnerable plugins. Known vulnerable plugins are plugins that have been publicly identified as vulnerable using various online vulnerability databases.
Most likely you won't encounter them as we automatically update plugins for you, however plugins that have the updates paused can occur here.
