Automate Security Scan for your WordPress site

Schedule a regular site scan to avoid malware and hack attempts on your WordPress site

In the previous post Remove malicious code with WordPress CLI verify checksums we discussed how to remove malicious code using WP CLI

Though that is a common and simple way to get rid of hacked or malicious files, it gets tedious to check them regularly.

You should have automatic and regular scans of your website. You can achieve this by using plugins like WordFence or writing your own script.

This blog post is focusing on using WordFence.

WordFence Scan

WordFence makes things easy to scan and get alerts when something is wrong

1. Install WordFence plugin

2. You can leave the default settings as it is, you can change settings later.

3. Click on Scan menu and start new scan

4. You will get scan results like this

Note: Files changes – refers to files that doesn’t verify against checksums or malicious files.

5. WordFence will show a list of files that needs to be repaired (downloaded from WordPress core and replaced) or to be deleted.

6. Click on details link on each result, you can find more information about the file.

If the file type is core, which means the file location is wp-includes or wp-admin folder, then that file should be deleted.

If you see repair button, then you can click on it to repair the specific file(s) otherwise click on the delete file button to remove them.

Pro Tip: Set the scan settings as low resource scanning to avoid performance issues.

source: personal experience

WordFence will send you email notifications about scan results.

Further reading:
WordFence official documentation: The severity of scan results and alerts