Japanese Spam & Malware Cleaner
Japanese Spam & Malware Cleaner is a lightweight security scanner for WordPress. It helps you spot and quarantine common database and file‑based infections used in “Japanese keyword hacks” and similar compromises.
by Your Name · github.com/wpguard/japanese-spam-malware-cleaner · website
Install
No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:
wp plugin install https://github.com/wpguard/japanese-spam-malware-cleaner/archive/refs/heads/main.zipDetect and quarantine Japanese spam, hidden links, injected scripts, and common malware in WordPress. Scan database and files, then export quarantine reports to CSV.
Description
Japanese Spam & Malware Cleaner is a lightweight security scanner for WordPress. It helps you spot and quarantine common database and file‑based infections used in “Japanese keyword hacks” and similar compromises.
What it scans
- Database: posts, pages, excerpts, comments, options (including autoloaded), postmeta/commentmeta/termmeta/usermeta, terms, term_taxonomy, links
- Files: wp-content (themes, plugins, uploads), plus other site files you choose
What it detects
- Japanese spam patterns (when site language isn’t Japanese)
- Hidden/off‑screen links (display:none, opacity:0, text-indent:-9999px, etc.)
- External iframes to non‑allowlisted hosts
- Suspicious TLD links (e.g., .ru, .cn, .xyz, .top, .icu, .info, .biz)
- Encoded/obfuscated payloads (base64, gzinflate, str_rot13, strrev)
- Dangerous PHP/JS function usage (eval, assert, preg_replace with /e, atob, Function)
- Zero‑width characters used for cloaking
- Large autoloaded options, suspicious transient names
- Serialized and JSON payloads (safely parsed and scanned)
- Optional file heuristics: PHP in non‑PHP files (e.g., uploads), script tags in SVG files
- File signature/hashes (local signature DB with built‑in patterns)
- Core integrity check helper (compare WordPress core files to official checksums)
How it works
- Scans run in small batches to avoid timeouts and memory issues
- Findings are summarized with a short snippet and reason
- Files over a risk threshold are quarantined to wp-content/uploads/jsmc-quarantine
- Database findings can be exported to CSV for offline analysis
What it does NOT do
- It does not auto‑clean your live content. You decide what to restore or remove.
- It does not modify WordPress core files (integrity issues are reported; you can reinstall core via WordPress).
False positives minimized
- Host allowlist for common services (Google, Cloudflare, YouTube, etc.)
- Japanese spam heuristics are disabled automatically if your site locale is Japanese (ja_*)
Privacy
- No telemetry, tracking, or external API calls by default.
- Optional remote signature updates are disabled unless explicitly enabled by developers (constant).
Installation
- Upload the japanese-spam-malware-cleaner folder to /wp-content/plugins/.
- Activate the plugin via Plugins in wp-admin.
- Go to Tools → Japanese Spam & Malware Cleaner.
- Run a Database Scan and/or File Scan.
- Review findings and quarantine items. Export reports to CSV if needed.
Multisite
- Network activate, then run scans per site from each site’s Tools menu.
Screenshots
- Admin dashboard with scan controls
- Database scan in progress with findings
- File scan results with quarantine status
- Quarantine list with restore/delete actions
- CSV export options for quarantine records
Frequently Asked Questions
Does this delete my content automatically?
No. The plugin detects and optionally quarantines suspicious files. Database findings are reported; removal is up to you.
Will this work on Japanese‑language sites?
Yes. The plugin detects your locale (ja_*) and reduces Japanese‑spam heuristics to avoid false positives.
What is quarantined and where?
Files that exceed a risk score are moved to wp-content/uploads/jsmc-quarantine/malware/. You can restore or permanently delete from the Quarantine section.
Can it break my site?
Quarantine avoids critical core paths (wp-admin, wp-includes, wp-config.php). Still, always keep a recent backup before taking action on findings.
Does it phone home or send my data anywhere?
No. The plugin does not transmit data. An optional remote signature update is disabled by default and intended for developers.
Can I customize detection rules?
Yes. Developers can filter rules and signatures:
- Database rules: jsmc_rules
- File rules: jsmc_file_rules
- Signature patterns: jsmc_file_patterns
- Signature hashes: jsmc_file_hashes
Does it scan serialized/JSON data in the database?
Yes. The scanner safely parses and inspects serialized and JSON values without loading classes (no object injection).
Initial public release
1.1.0
- Added aligned file and database detection rules (obfuscation, hidden links, suspicious TLDs, JP spam, zero‑width)
- Added quarantine index and restore/delete actions for files
- Added CSV export for database quarantine and improved snippets
- Added core integrity check helper
- Improved performance with batched scans and dynamic batch sizing
- Reduced false positives with host allowlist and locale‑aware JP heuristics
- Hardened permissions and nonce checks
Privacy Policy
This plugin does not collect, store, or transmit personal data. Scan results remain on your server. Optional remote signature updates are disabled by default.