Happy Security Scanner

=== Happy Security Scanner === Contributors: sazzad Tags: security, malware scanner, webshell, backdoor, security Requires at least: 6.0 Requires PHP: 7.4 Stable tag: 3.3.7 License: GPLv2 or later

Professional WordPress security scanner with an adaptive background batch engine, live progress, heuristic malware detection, core checksum verification, persistence review, reports, logs and explicit remediation.

== Modules ==

• Dashboard
• Full Scan
• Findings
• Quarantine
• Scan History
• Logs
• Settings

== Detection ==

Detects web shells, backdoors and spam injections. PHP comments are stripped before analysis (commented-out attack examples cannot cause a finding), and a file is only reported as suspicious when it carries a high-confidence malware/spam indicator — lone generic primitives such as base64_decode(), unlink() or file_put_contents(), which appear constantly in legitimate code, are never reported on their own.

Known "Advanced File Manager", "D7net", "Kerang", "Mumei Mini / IndoXploit Mini", "WordPress Site Health Extended (WPHE)" backdoor, "Fazes" file-manager and standalone "Adminer" database-shell families are fingerprinted directly.

Obfuscated payload loaders are detected too: base64 fragments concatenated into a variable and decoded, base64_decode called through a variable function name, and PHP source that is tokenized and rebuilt before eval() (token recompiler backdoors).

Malicious behavior combinations are reported decisively: execution function names assembled from chr() codes and invoked dynamically, and files that read wp-config.php, echo an extracted secret, then delete themselves (credential stealers).

PHP-like files inside WordPress uploads are elevated for review.

== Integrity ==

WordPress core is checked against official WordPress checksums when available.

Plugin and theme inventories are provided for trusted-source verification. Universal checksums are not assumed for arbitrary third-party plugins/themes.

== Persistence ==

The scanner inventories:

• Must-use plugins
• WP-Cron events
• Administrator accounts

These are review findings, not automatic removal targets.

== Remediation ==

Scanning is read-only. The administrator explicitly chooses Quarantine or Delete.

Protected remediation targets include:

• wp-config.php
• .htaccess
• wp-admin
• wp-includes
• the scanner itself

== Important ==

This is a heuristic security tool, not a guarantee of compromise detection. False positives are possible. Always create a backup/snapshot and review findings before deletion.

For a confirmed compromise, rotate credentials and rebuild affected WordPress components from trusted packages where appropriate.

== v3 scanning engine ==

The v3 engine does not use a maximum-file-size exclusion. It walks the filesystem in short server-side batches and the admin UI polls for the next batch until the scan completes. Candidate files are read through bounded memory windows, while the scan continues across the whole file.

The scan continues to run in the background (WP-Cron with an admin-page shutdown fallback) even when you navigate to other admin menus. Returning to the Scan page resumes the live progress and shows the finished results when the scan has completed.

The browser remains responsive and no single AJAX request is responsible for the complete scan. Completion produces a notification when browser notification permission is available, and the final report is saved automatically.

== Results & history ==

Suspicious file results are paginated (10/20/30/40/50/60/70/80/90/100 per page, default 20) with the chosen page size remembered in the browser.

Each file can be selected with a checkbox (select all on the page via the header checkbox) and multiple files can be quarantined or deleted in one action. Every Quarantine/Delete is confirmed with a custom dialog, and processed files are removed from the list immediately. Quarantine/Delete actions use icon buttons with tooltips.

Findings from the latest completed scan are restored automatically on the Findings page. The persistence review is collapsible and paginated (same per-page options as the Suspicious Files list) so long records stay readable.

Saved scan history and security logs can be cleared from the "Scan History" and "Logs" pages (Clear Scan History / Clear Logs buttons).

== Automatic scanning ==

Optional scheduled scanning can be enabled in Settings. Choose a frequency from every 1 to every 24 hours (default 24 hours). The frequency options are shown once automatic scanning is enabled. When enabled, the next automatic scan time is shown on the Scan and Settings pages, and the scanner runs a full scan automatically at the chosen interval.

Author: Sazzad Author Email: sazzadtbd@gmail.com