WP Deep Scan

Version 1.0.0 — WordPress plugin documentation for site owners and Envato buyers.

1. What this plugin is

WP Deep Scan is a defensive anti-malware and security-testing plugin. It finds stealth redirect infections that file scanners miss, then helps you fix them with prebuilt playbooks.

It does not hide malware, attack other websites, or execute scanned files.

2. Installation

1. In WordPress go to Plugins → Add New → Upload Plugin.
2. Upload the wp-deep-scan.zip file (or copy the wp-deep-scan folder into wp-content/plugins/).
3. Activate WP Deep Scan.
4. Open the new WP Deep Scan menu.

Required: WordPress 6.0+, PHP 7.4+, administrator account. Optional: PHP ssh2 extension for the SSH inspector, and your own AI API key.

3. First hour checklist

1. Settings → enable Early Witness.
2. Scanner → leave all modules checked → Run selected modules.
3. Findings → review Critical and High items.
4. Apply a playbook only after you recognize the item (for example a WPCode snippet you did not create).
5. If visitors still redirect, open File Manager and compare wp-content/plugins folders with the Plugins screen.

4. Modules (what makes this different)

Ghost Inventory

WordPress builds the Plugins page from disk, then applies the all_plugins filter. Malware can hide a folder without deleting it. This module compares:

• folders on disk
• plugins before filters
• plugins after filters (the dashboard)
• the active_plugins option in the database

A count mismatch is one of the most reliable malware signals in WordPress. File scanners do not do this comparison.

Early Witness

An optional must-use plugin that snapshots plugin folders at muplugins_loaded, before most malware boots. Install it from Settings.

Snippet Intelligence

Scans WPCode (wpcode posts), Code Snippets table, Woody snippets, Header Footer Code Manager, and header/footer options. Official plugin files stay clean; the payload lives in the database.

Persona Redirect Lab

Requests your homepage as eight visitors: desktop first visit, mobile, Google, Bing, Facebook, a generic scanner bot, a WordPress-like user agent, and Android + Google. It compares Location headers, meta-refresh, JavaScript redirects, and HTML size. This catches malware that stays quiet for logged-in admins and bot scanners.

Hook Trap, Database Ghost, Hidden Users, MU/drop-ins, Cron, Checksums, Hardening

These inspect live hide/redirect hooks, high-entropy autoloaded options, administrators missing from the Users screen, must-use files, short cron hooks used to reinfect, official WordPress.org checksums, and common misconfigurations.

5. Playbooks

On Findings, choose a playbook and click Apply. Destructive actions create a quarantine copy under wp-content/uploads/wpais-quarantine/ when possible. You can restore from the same screen.

Playbooks will not delete the account you are logged in with, and they will not delete core options such as siteurl (except the dedicated repair playbook, which sets home/siteurl to the current site).

6. File Manager and SSH

The File Manager lists directories with PHP’s directory APIs, not get_plugins(). That is intentional: malware can filter WordPress APIs.

SSH uses WordPress core’s SSH2 filesystem. Your host must provide the PHP ssh2 extension. Save host, user, and password or key in Settings. Listing and reading are administrator-only and nonce-protected. The inspector does not run remote shell commands — it only lists and reads files.

7. AI Auditor

Ask AI is included with a connected Pro site. WP Deep Scan hosts the provider key on the Intel dashboard — customers never paste an API key in the plugin. Nothing is sent until you click Analyze. The model receives a digest of open findings, not your whole database. It can recommend built-in playbook IDs. You still click Apply.

8. Firewall

Open WP Deep Scan → Firewall. Start in Monitor mode so nothing is blocked. Install the Early Firewall MU-plugin so rules run before other plugins. After a disk scan, tripwires automatically deny HTTP access to extra or hidden files the scanner found. Switch to Block only after you confirm the log looks right. Add your office IP to the allow list first.

9. Nginx note for uploads hardening

The “Disable PHP in uploads” playbook writes Apache .htaccess rules. On Nginx add a location similar to:

location ~* ^/wp-content/uploads/.*\.(php|phtml|phar)$ { deny all; }

9. Credits

WordPress, jQuery (bundled with WordPress), Dashicons. No third-party premium libraries are bundled.

10. Support and license

GPL v2 or later. For Envato support, use the item’s support tab. Always keep a full backup before cleaning a live site.