README

PHP Antimalware Scanner

Scan PHP projects and WordPress installations for suspicious code, integrity changes, and known malware patterns.

Documentation | Latest release | WordPress guide

Documentation is available in English, Italian, German, French, Spanish, Russian, Simplified Chinese, Japanese, Hindi, and Arabic. Use the language selector in the documentation navigation.

Start with a safe report

Download the standalone scanner, confirm its version, then inspect a project without changing files:

curl --fail --silent --show-error --location \
  --output scanner \
  https://raw.githubusercontent.com/marcocesarato/PHP-Antimalware-Scanner/master/dist/scanner

php scanner --version
php scanner /var/www/example --lite --report-only

The scanner writes scanner-report.html in the current directory. Review each finding in context before cleaning, quarantining, or deleting anything.

Caution

Create a current backup before using file actions. A detection identifies suspicious code. It does not prove that the entire file is malicious.

What it checks

Check	Purpose
Malware signatures	Finds known code fragments, regular expressions, hashes, and suspicious domains
Exploit patterns	Flags code structures that attackers often use
Dangerous functions	Identifies calls such as `system` and `shell_exec` for review
Platform integrity	Compares supported applications and packages with trusted release checksums
ZIP archives	Inspects bounded archive content when `--scan-archives` is enabled
WordPress database	Runs optional read only checks for triggers, administrators, and orphaned posts

Normal code scans work offline with embedded definitions. Platform checksums and Maltrail definition updates can require outbound HTTPS. Successful remote data is cached outside the scanned project.

Choose a mode

Mode	Option	Use it when
Full	No mode option	You need the broadest incident review
Lite	`--lite`, `-l`	You want a practical first scan with fewer noisy matches
Signatures	`--only-signatures`, `-s`	You want focused checks for known malware patterns
Exploits	`--only-exploits`, `-e`	You want to audit suspicious code structures
Functions	`--only-functions`, `-f`	You want to review dangerous PHP calls

Read Run your first scan for guidance on reviewing and acting on findings.

Install

Standalone release

Download scanner from the latest release, then run it with PHP:

php scanner /path/to/project --lite --report-only

Composer project dependency

composer require marcocesarato/amwscan
php vendor/marcocesarato/amwscan/src/index.php /path/to/project --lite --report-only

PHP 7.4 or newer is required. The required extensions are fileinfo, json, mbstring, and zlib. Read the installation guide for global Composer, source, Docker, Windows, and WordPress instructions.

Reports for people and tools

# Interactive review with a stored report
php scanner /path/to/project --lite --report --report-format=html

# Structured automation without prompts
php scanner /path/to/project --lite --report-only --report-format=json

# Code scanning tools without prompts
php scanner /path/to/project --lite --report-only --report-format=sarif

Available formats are HTML, text, JSON, and SARIF. Reports include coverage totals and skipped file reasons, so incomplete scans do not look clean.

WordPress administration

The WordPress plugin adds background scans, upload protection, reports, quarantine, whitelist management, and controlled remediation to the dashboard.

Two mutually exclusive packages are available:

Edition	Distribution	Browser file editing	Restore quarantined files
AMWScan Antimalware Scanner Lite	WordPress.org package	No	No
AMWScan Antimalware Scanner	GitHub release	Yes	Yes

Both editions share settings and data. Remove the installed edition before switching. Read the WordPress plugin guide for setup, schedules, upload scanning, and remediation.

Useful commands

# Exclude generated directories
php scanner /path/to/project --lite --report-only \
  --ignore-paths="*/cache/*,*/logs/*"

# Scan ZIP entries
php scanner /path/to/project --lite --report-only --scan-archives

# Save JSON progress and resume it
php scanner /path/to/project --report-format=json \
  --checkpoint=/private/amwscan-checkpoint.json --resume

# Scan a local WordPress database without modifying it
php scanner /path/to/wordpress --scan-wordpress-db --report-format=json

Browse the CLI reference for every option, default, conflict, and safety note.

Contributing

Bug reports, documentation fixes, tests, and reviewed detection improvements are welcome. Do not attach executable malware to a public issue. Submit detection metadata first so maintainers can arrange a private transfer when a sample is needed.

git clone https://github.com/marcocesarato/PHP-Antimalware-Scanner.git
cd PHP-Antimalware-Scanner
composer install
composer test

Read TESTING.md and the contribution guide before opening a pull request.

License

PHP Antimalware Scanner is available under the GNU General Public License 3.0 or later.

marcocesarato / amwscan

Maintainers

Package info

Statistics

Security