Security Scanner

📊 Dashboard

The Dashboard is the main view of the Security Scanner. It provides a visual summary of your site's security status with key metric cards on malware, file integrity, and quarantine.

Summary Cards

🦠 Malware Scanner

The malware scanner analyzes PHP, JavaScript, HTML, and .htaccess files for malicious code, combining a signature database across several threat categories with advanced heuristic analysis. This is a PRO feature.

Scanner Controls

The scanner interface includes Start, Stop, and Clean buttons. The Clean button is for when a scan gets stuck: it discards that scan's record and resets the pending-threats list to zero, but it doesn't touch any file on disk — it doesn't remove or quarantine anything on its own. To act on an actual threat, use the individual actions on each row of the Threats Table. A progress bar shows the scan progress in real time.

Scan Log

Each scan generates a detailed log with timestamps, files analyzed, threats found, and actions taken. You can review the full history for auditing.

Threats Table

Detected threats are displayed in a table with the following columns: file, threat, severity, status, and available actions. For each file you can:

Whitelist Management

You can manage a whitelist of files and patterns that the scanner should ignore in future analyses. This is useful for legitimate plugins that use obfuscation or encoding techniques that could generate false positives.

Scheduling

Configure automatic scans with hourly, twice-daily, daily, weekly, or monthly frequency. Each scheduled scan runs the full analysis and can send email reports with the results.

Signature Database

The scanner uses a signature database distributed across several threat categories, which is maintained and updated periodically from SeenSecure's servers — you don't need to do anything manually to keep it up to date.

The Dashboard shows a "Signature Database" card with the number of active signatures and the date of the last update, plus an "Update signatures now" button if you want to force an immediate check without waiting for the next automatic update.

• Backdoors: Backdoors for unauthorized remote access.

• Web Shells: Web interfaces for remote server control.

• Code Obfuscation: Obfuscation techniques used to hide malicious code.

• Uploaders: File-upload forms or scripts lacking proper validation.

• Command Execution: Code that runs commands directly on the server.

• Cryptominers: Scripts that use your server to mine cryptocurrencies.

• Botnets: Code that connects your server to a remotely controlled bot network.

🔌 Plugins & Vulnerabilities

This module analyzes all components of your site (plugins, themes, and WordPress core) to identify outdated versions that need updating.

Outdated Components Table

The main table lists all plugins, themes, and the WordPress core with their current version, latest available version, and update status. Items are grouped by type: plugins, themes, and core.

Full Scan

The "Run Full Scan" button checks all your plugins, themes, and WordPress core and shows you at a glance what needs updating.

Scan Configuration

You can configure the frequency and time of automatic update scans. Available options:

• Frequency: Daily, weekly, or monthly.

• Time: Select the time of day to run the scan (server time).

• Notifications: Enable email alerts when outdated components are detected.

Scan History

The history stores a record of the latest scans performed (up to 5), including date, time, mode (manual or automatic), components analyzed, outdated components found, and overall site status at the time.

🔐 Integrity / File Integrity Monitoring (FIM)

The File Integrity Monitoring (FIM) system is like having a 24/7 security guard watching every file on your WordPress. It creates a unique "digital fingerprint" (SHA-256 hash) of each file and constantly compares it to detect any change, no matter how small. If someone modifies, adds, or deletes a file without permission, the system alerts you instantly. This is a PRO feature.

⚡ Ultra-fast scanning: The system analyzes over 100,000 files in 3-5 seconds with zero performance impact on your site. You can run scans as often as you want without slowing down your website or affecting visitors.

📊 Health Gauge

The main panel shows a visual indicator of your site's integrity status. Think of it as the "security thermostat" of your WordPress:

• 100% - 90%: 🟢 Excellent. Your files are intact and safe. Nothing to worry about.
• 89% - 70%: 🟡 Attention. Some files have changed. Could be a legitimate update or something suspicious. Review the changes.
• Below 70%: 🔴 Critical. Many files have been modified. Possible attack in progress. You must review and take immediate action.

📸 Baseline Creation

The baseline is like a photograph of the original state of your files. The system calculates a SHA-256 hash (a unique digital fingerprint) of each file and saves it as a reference. When the system scans, it compares current hashes with the baseline. If a hash doesn't match, it knows the file has changed.

✅ When to create a new baseline? After updating WordPress, plugins or themes; after installing new software; when you manually change site settings. This avoids false alarms from legitimate changes.

🔬 Quick and Full Scans

Two scan levels for different needs. Both are extremely fast:

• ⚡ Quick Scan: Checks the most critical files: WordPress core, active plugins, active theme, and wp-config.php. Ideal for a quick daily review. Takes 1-2 seconds.
• 🔍 Full Scan: Analyzes absolutely all site files: core, plugins, themes, uploads, configuration files, non-critical directories. Covers every corner of your installation. Takes 3-5 seconds even with over 100,000 files.

📄 Monitored Data Files

Scans (quick or full) exclusively check .php files, by design: they're the only ones that can execute on your server, which is why the engine is optimized for them. But the plugin itself also stores information in several internal non-PHP data files, including known malware signatures. If an attacker tampered with or emptied one of these files, they could silently affect part of your protections without touching a single .php file.

That's why these 3 files are monitored separately, with an independent and very lightweight check (they don't go through the recursive .php engine, so they don't affect its speed at all). When a change is detected, it appears in exactly the same Change Detection Panel below — same actions (approve, restore, view diff), nothing new to learn.

🔍 Change Detection Panel

When the system finds differences between the current state and the baseline, it displays them in the Change Detection Panel. Each change includes:

• 📄 File: Exact path of the modified file.
• 🔄 Change Type: Modified (content changed), Added (new file not in baseline), Deleted (file no longer exists).
• 🔑 SHA-256 Hashes: The previous hash (baseline) and current hash, to cryptographically verify that something changed.
• 📅 Date and Time: Exact moment when the change was detected.

Each row has an actions menu that lets you:

• ✅ Approve Change: The change is legitimate (e.g., you updated a plugin). The baseline is updated to accept the new file.
• 🔄 Restore Original: The change is not legitimate. The system restores the file to its original version from the baseline.
• 📋 Add to Whitelist: Excludes the file from monitoring. Useful for files that change frequently and legitimately (logs, caches).
• 🔍 View Details: Opens the code diff viewer to see exactly what changed inside the file.

📝 Code Diff Viewer

When selecting "View details" on a change, a modal opens showing the code side by side: the original version (baseline) on the left and the current version on the right. Added lines are highlighted in green and removed lines in red. This lets you see exactly what malicious code was injected or what change was made, without downloading files or using external tools.

📊 Real-time Log

The Real-time Log is the complete chronological history of everything that happens in the integrity system. Each entry records:

• 🕐 Exact time of the event
• 🏷️ Event description: important changes or alerts are highlighted with icons within the text itself (for example ⚠️ for warnings that need review or ✅ when everything is fine)
• 📝 Detailed description of the event: "Full scan executed - 124,503 files verified in 4.2s", "Change detected in /wp-content/plugins/plugin-x/index.php", "File restored: wp-config.php", etc.

You can Clear the Log to start fresh or Export it for external audits or to share with technical support.

⚙️ Integrity Monitoring Configuration

Customize the integrity system behavior to fit your needs. Available options:

Scan Modes

• ⚡ Real-Time: Continuous monitoring via WordPress hooks. Detects changes instantly as they happen. This is the safest mode but uses slightly more resources. Recommended for critical sites.
• 📅 Scheduled: Automatic scans at configurable intervals: from every 5 minutes to every 24 hours. Perfect balance between security and performance. Recommended frequency is every 2 hours.
• ✋ Manual: Only run scans when you explicitly request them. Useful for development environments where changes are constant and you don't want false alarms.

Advanced Options

• 🔑 Hash Algorithm: Select the cryptographic algorithm for calculating hashes. SHA-256 is recommended for its balance of security and speed. Available alternatives: SHA-1 and MD5 (both faster but cryptographically weaker than SHA-256).
• 📧 Email Notifications: Enable immediate alerts when changes are detected. Ideal for knowing instantly if something happens, even if you're not watching the panel.

🛡️ Activate Monitoring System

The "Activate Monitoring System" switch is the master on/off for the entire integrity system. When active:

• ✅ The system monitors all selected files 24/7
• ✅ Scans run according to the configured mode (real-time, scheduled, or manual)
• ✅ You receive immediate alerts for any unauthorized changes
• ✅ The changes panel and real-time log update constantly

When deactivated:

• ❌ No scans run, neither automatic nor manual
• ❌ No file changes are detected
• ❌ No integrity alerts are received
• ❌ The site is left unprotected against unauthorized modifications

📋 Whitelist Management

The whitelist lets you exclude specific files from integrity monitoring. This is useful for files that change legitimately and frequently and don't pose a security risk:

• 📝 Log files that update constantly
• 💾 Cache files generated by optimization plugins
• 📂 Temporary or session files
• 📊 Third-party generated files that change without your intervention

Files on the whitelist are listed with their full path and you can remove them from the whitelist at any time so they are monitored again. The system also allows refreshing the whitelist to reflect the latest changes.

📦 Quarantine System

Quarantine is a secure area where suspicious or infected files are isolated, protected with restrictive permissions and renamed with unique hashes. It allows manual review before deciding their final fate. This is a PRO feature.

Summary Cards

Search and Filters

You can search files by name, type, quarantine date, or associated threat. Available filters: by file type (PHP, JS, HTML, image), by date range, and by status (pending, reviewed, scheduled for deletion).

Files Table and Bulk Actions

The main table lists each quarantined file with: original name, type, size, quarantine date, detected threat, and individual actions. You can select multiple files and execute bulk actions:

Detail Modal

When clicking on a file, a modal opens with complete information: original name, original path, file hash, quarantine date, threat type, signature that detected it, partial content (first lines), and action recommendations.

AJAX Data Loading

The quarantine table loads data via AJAX requests, meaning the page renders quickly and files are displayed as they load. Pagination, search, and filters also work via AJAX without page reload.

🔧 Troubleshooting

Quick Scan says "0 changes" but a new-changes alert shows up later

This isn't a bug: Quick Scan and Full Scan don't compare the same thing. Quick Scan only checks the most critical files, and only by size, so it can finish in 1-2 seconds; Full Scan (and the periodic automatic one) compares the full SHA-256 hash of every file, which is far more precise. A file whose content changes without its size changing can slip past Quick Scan and still show up later in a full scan. If you need 100% certainty that nothing's pending, run a Full Scan instead of Quick Scan.

I approved a change and it still shows as pending

Use "View Details" on that file to confirm the current hash matches what was saved as the new baseline. If the problem persists after approving again, try regenerating the full baseline for that file from scratch instead of approving the individual change — it forces a clean comparison instead of relying on the previous state.

I turned on WebFreeze and I'm still getting FIM alerts

That's expected if the alert corresponds to changes detected before you froze the site: WebFreeze pauses FIM monitoring as soon as it's activated, but it doesn't clear out changes that were already pending review at that moment. Check the Change Detection Panel and approve or restore anything pending before freezing, so it doesn't pile up.

Frequently Asked Questions

What's the real difference between Quick Scan and Full Scan? Quick Scan prioritizes speed by checking a reduced set of files by size; Full Scan checks the SHA-256 hash of absolutely every file. Use Quick Scan for a daily check and Full Scan when you need total certainty.

Do I need to create a new baseline every time I update a plugin? Yes, if you don't want the update to show up as a "suspicious change". Alternatively, use "Approve All" after confirming the changes match the update — it has the same effect without recreating the whole baseline.

What should I do if I don't recognize a file flagged as "Added"? Don't approve it. Use "View Details" to inspect the content and, if you confirm it's malicious, delete it or send it to quarantine instead of approving it as a legitimate change.

Does quarantine delete the file from the server? Not immediately: it moves it to an isolated folder (it's no longer accessible/executable at its original location) without deleting it, so you can review it calmly before deciding. If you confirm it's malware, delete it permanently from there; if it was a false positive, restoring it returns it to its original location.