Nova Scan Lite – Malware Scanner, Backdoor & File Integrity
Nova Scan Lite is a free, lightweight malware scanner for WordPress. It checks your site for common PHP threats and verifies WordPress core file integrity — all running locally on your server during an admin session. What it does Scans PHP files for backdoors, webshells, and RCE patterns Verifies Wo
Nova Scan Lite is a free, lightweight malware scanner for WordPress. It checks your site for common PHP threats and verifies WordPress core file integrity — all running locally on your server during an admin session.
What it does
- Scans PHP files for backdoors, webshells, and RCE patterns
- Verifies WordPress core files against official checksums
- Flags modified or unexpected files in wp-admin/ and wp-includes/
- One-click quarantine to disable suspicious files without deleting
- Chunked scanning (handles thousands of files without timeouts)
- Full scan history with severity breakdowns
What it detects
- Backdoors & webshells (C99, r57, FilesMan, custom shells)
- Remote code execution (eval + base64, preg_replace /e, create_function)
- System command execution (system, shell_exec, passthru with user input)
- Credential harvesting and wp_users dumps
- File system abuse (remote file writes, 0777 chmod, wget/curl droppers)
- Obfuscation patterns (long base64, chr/ord chains, hex encoding)
- Modified WordPress core files
Privacy
Nova Scan Lite does not transmit any of your site’s content, file data, or user information anywhere. Scans run locally on your server. The only outbound request the plugin makes is to the official WordPress.org checksums API for core file integrity verification (see the “External services” section below).
External services
Nova Scan Lite uses one external service, provided by WordPress.org.
WordPress.org Core Checksums API
- What it is and what it is used for: The official WordPress.org API that returns known-good MD5 checksums for every file in a given WordPress core release. Nova Scan Lite uses it to verify that the installed WordPress core files have not been modified by malware or unauthorized users.
