I Built a WordPress Scanner That Finds Malware in 10 Seconds

The problem that started it all

A friend called me one afternoon, panicked. His client’s WooCommerce store was sending spam emails, rankings had tanked, and Google was showing a “This site may be hacked” warning. The culprit? A nulled theme downloaded from a sketchy forum — pre-loaded with a PHP backdoor.

He spent two days combing through thousands of PHP files manually, looking for the injected code. That’s when I thought: this should take 10 seconds, not two days.

So I built WP Scan — a WordPress-specific security scanner that checks themes, plugins, and raw PHP files against 40+ vulnerability patterns and returns a full report in under 10 seconds.

What it looks like in action

The interface is deliberately simple. Drag your ZIP in, hit scan, get results.

And here’s what the results look like. Every finding is tagged by severity (Critical → Low), includes the vulnerable file path, and a code snippet showing exactly what was found:

What WP Scan actually detects

I didn’t want a generic “PHP linter”. I focused on the exact patterns that appear in real-world WordPress malware, nulled themes, and poorly coded plugins. The scanner currently detects 40+ vulnerability patterns across these categories:

The patterns cover PHP, JavaScript, HTML, and template files — so it catches JS-based XSS in theme templates and PHP backdoors buried in plugin assets alike.

How it works under the hood

WP Scan is a pure PHP application — no Node, no Python, no external scanning engine. Here’s the flow:

1. Upload & extract — ZIP is uploaded, validated (bomb protection: 10k entries max, 10 MB/file, 300 MB total uncompressed), then extracted to a temp directory.
2. File walk — recursively walks the directory, skipping binaries and files over 2 MB. Scans PHP, JS, HTML, HTM, TPL, INC files.
3. Pattern matching — each file is regex-matched against the pattern library. Patterns are weighted by severity.
4. Report generation — findings are assembled into a severity-sorted HTML report with file paths, line numbers (premium), code snippets, and fix guides (premium).
5. Cleanup — extracted files are deleted immediately. Nothing is stored.

The tech stack is intentionally minimal:

No Composer, no npm, no framework. One PHP file + a pattern library. It deploys to any shared hosting plan in under 5 minutes.

Features I’m most proud of

Pricing

Free forever with 2 scans/month. Premium unlocks everything — and the lifetime plan is a steal if you audit code regularly.

What I learned building this

1. Shared hosting has real constraints

PHP’s mail() silently fails on Hostinger. I had to build a full SMTP client from scratch using PHP’s stream_socket_client() — supporting STARTTLS, SSL, and AUTH LOGIN with no external libraries. It works, and it’s ~150 lines of code.

2. ZIP bombs are a real attack vector

Before adding protection, a crafted ZIP with deeply nested directories could hang the server indefinitely. The fix: hard limits on entry count (10k), per-file uncompressed size (10 MB), total size (300 MB), and a 90-second deadline inside the file iterator.

3. Regex pattern libraries need testing on real malware

My first version of the backdoor patterns was catching too much legitimate code (e.g., WordPress core uses eval() in specific places). I ended up hand-testing patterns against a corpus of real nulled themes and malware samples I found on public security repos.

“The pattern that catches the most real-world malware is the combination of eval() + base64_decode() in the same expression. It appears in virtually every backdoor I’ve ever seen.”

4. Geo-based pricing matters for India

PayPal blocks many Indian cards for domestic merchant accounts. Integrating Razorpay with Cloudflare’s CF-IPCountry header for geo-detection solved this — Indian visitors automatically see INR prices and Razorpay as the only payment option. International visitors see USD + PayPal.

5. Drip emails convert

The day-3 “did you find anything?” email and day-7 coupon email run automatically via a cron job. The 10% coupon code is created on-the-fly if it doesn’t exist yet, and the whole drip sequence is logged per-user to avoid duplicates.

What’s next

A few things I’m planning:

• API access — so CI/CD pipelines can scan plugins before deployment
• WordPress plugin — scan your live installation from wp-admin directly
• Signature database updates — crowdsourced malware signatures from users
• Affiliate program improvements — better reporting, Stripe payouts