Security tab: score, malware scan and findings

Every site gets a security score that names the exact reasons it is not 100, a malware scan that looks for evidence — changed core files, code in uploads, known web shells — and a clear list of findings you can quarantine, delete or mark as safe. Bad bots, exceptions and the scan history live on the same tab.

Where to find it: Dashboard → click the site → Security tab.

Before you start

• The site is connected with the WPManager plugin (“Connected” on the site’s Settings → Connection tab — see Installing and connecting the WPManager plugin). The scan runs inside this plugin.

The overview

On the site page click “Security”. A direct link also works: /Home/Site/<site id>?tab=Security; add &sub=findings, firewall, bots, exceptions or history to open a sub-tab straight away. The header holds “Reputation”, a refresh button and “Run scan”.

Four tiles sum up the site; a click on a tile opens the matching sub-tab:

• Active findings — “Need review”, or “Nothing pending” when the list is empty;
• Protection — Cloudflare (blocking at the edge), WordPress (blocking inside WordPress) or None;
• Blocked addresses;
• Last scan — how long ago, and the number of scans.

The security score

The ring shows 0–100 and a grade: Excellent (90+), Good (75+), Fair (55+), Poor (35+) or Critical (below 35). Next to it, “What lowers the score” lists up to five problems, each with the points it costs, what to do, and a button that takes you there: “Open findings”, “Run scan”, “Cloudflare” or “Updates”. The green chips below are what is already fine, for example “HTTPS enabled” or “Recently scanned”.

What the score counts

The score starts at 100 and loses points for:

Run a scan

Press “Run scan”. A progress strip shows “Scanning the site…”, the file being checked, the files counted and the findings so far; a big site takes a few minutes. At the end you see “Scan complete: N findings, M files checked”, and — if earlier findings have gone — “N earlier finding(s) not found any more”.

What the scanner looks for

The scan runs inside the WPManager plugin and looks for evidence, not just for “dangerous functions”:

• WordPress core files compared with the official checksums from WordPress.org: a changed core file, or an unknown PHP file in wp-admin or wp-includes;
• plugins from WordPress.org compared with their official checksums (premium plugins have none and skip this check);
• executable files and a suspicious .htaccess in uploads, and PHP code hidden there in files of other types;
• signatures of known web shells, and code that executes data from the request;
• heavily obfuscated code — reported only on strong signals;
• configuration hygiene: the file editor switched on, a public debug log, wp-config.php permissions, open admin registration, a user called “admin”. These come as warnings, not threats.

Automatic nightly scan

Every night after 03:00 UTC the panel scans every active site that has the plugin key saved. The results appear in “Scan history” and “Findings” just like those of a manual scan.

Review the findings

1. Open the list

   “Findings” shows the active ones by default; the status list switches to any other status or to “All statuses”. Search with “Search by file or finding”, and filter with the type chips (Backdoor, Malware, Modified core file, Suspicious code…) and the severity chips (Critical, High, Medium, Low). Each row shows the severity, the type, the finding’s title, the file path with the line number, and when it was found.

   

2. Open a finding

   Click a row. The window shows the file, the finding, the details, when and by what it was detected, and the suspicious code itself.

   

3. Decide what to do

   • Quarantine — the file is moved to wp-content/wpmanager-quarantine on the site and stops working;
   • Delete the file — the file is gone for good;
   • Not a threat — marks a false positive and adds an exception for this file and finding;
   • Trust the whole folder — for files of a plugin or theme: all findings in that folder close, and later scans skip it.

What the statuses mean

“Clear the list” forgets every finding of the site in the panel. Files on the site are not touched, and the next scan lists again whatever it still finds.

Exceptions

“Exceptions” lists what the scanner no longer reports. Press “Add an exception” and fill in:

• File or folder — a folder path ends with /;
• Finding (optional) — text of the finding’s title; when a path is given too, both must match;
• Reason — for your own notes.

Remove an exception to have it reported again from the next scan on.

Scan history

“Scan history” lists every scan, manual and nightly: Result, Type, Files, Findings, Started and Time.

Bad bots

“Bad bots” shows what the plugin caught over 7, 14, 30 or 90 days:

• Bad bot requests — requests and addresses, split by threat level, with a bar per day;
• By type — SEO and AI crawlers, HTTP libraries, scanners, probes, spam bots, empty user agents and so on;
• Recent detections and Most active addresses — each row can block the address or ban the bot by name.

“Ban a bot by name” asks for the “Word in the user agent”, a “Name” and a “Reason”: any request whose user agent contains the word is refused. The bans are listed under “Banned by name”.

Reputation

“Reputation” checks the site with VirusTotal and Google Safe Browsing and shows “The site looks clean” or “Something was reported”, with the numbers from each service.

Alerts

Findings are not sent to Telegram or by email: check the Security tab and the score. Telegram alerts cover downtime, SSL and domain expiry, and update results.

Settings

Costs

Free: manual and nightly scans and the reputation check do not use your balance.

Troubleshooting

FAQ

Related

• Firewall, allowlist and one-click Cloudflare rules
• Updating WordPress, plugins and themes
• Connecting Cloudflare
• Site backups: create, download and restore
• Site audit: an SEO and security check

Updated October 7, 2026