Nova Scan Lite – Malware Scanner, Backdoor & File Integrity
| 开发者 | sephx |
|---|---|
| 更新时间 | 2026年8月23日 04:26 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPL-2.0-or-later |
| 版权网址: | 版权信息 |
详情介绍:
Nova Scan Lite is a free, lightweight malware scanner for WordPress. It checks your site for common PHP threats and verifies WordPress core file integrity — all running locally on your server during an admin session.
What it does
- Scans PHP files for backdoors, webshells, and RCE patterns
- Verifies WordPress core files against official checksums
- Flags modified or unexpected files in wp-admin/ and wp-includes/
- One-click quarantine to disable suspicious files without deleting
- Chunked scanning (handles thousands of files without timeouts)
- Full scan history with severity breakdowns
- Backdoors & webshells (C99, r57, FilesMan, custom shells)
- Remote code execution (eval + base64, preg_replace /e, create_function)
- System command execution (system, shell_exec, passthru with user input)
- Credential harvesting and wp_users dumps
- File system abuse (remote file writes, 0777 chmod, wget/curl droppers)
- Obfuscation patterns (long base64, chr/ord chains, hex encoding)
- Modified WordPress core files
安装:
- Upload the
novascan-litefolder to/wp-content/plugins/, or install via the WordPress plugin directory. - Activate through the Plugins menu.
- Go to Nova Scan Lite in the admin menu.
- Click Start Scan or Check Core Files.
屏幕截图:
常见问题:
Does this slow down my site?
No. Nova Scan Lite only runs in the WordPress admin, and only when you trigger a scan. It does nothing on the front end and adds no load to regular page requests.
What files does it scan?
PHP files only (.php, .php3, .php4, .php5, .php7, .phtml, .phar) up to 4 MB each.
What is quarantine?
Quarantining renames the file with a .quarantine extension so PHP cannot execute it. The file is not deleted — you can review it or restore it manually via SFTP.
Does Nova Scan Lite phone home or collect data?
No. Nova Scan Lite does not send any site content, file data, scan results, or user information to Nova Heaven or anywhere else. The only outbound request is to the official WordPress.org checksums API, used only to verify WordPress core files against known-good hashes when you click "Check Core Files". See the "External services" section above for full details.
What is Nova Scan Pro?
Nova Scan Pro is the full edition with a Web Application Firewall, database scanner, CVE intelligence and virtual patching, Frontend Shield cross-domain monitor, and 20+ more features. It is also free (included with a free Nova Heaven account). Nova Scan Pro replaces Lite — they are not designed to run side by side. See the "Nova Scan Pro" tab inside the plugin for a full feature comparison.
更新日志:
1.0.9
- Fixed — every scan reported a critical threat inside Nova Scan Lite itself. The file holding the detection signatures naturally contains the patterns it looks for, so the scanner matched its own rules and offered to quarantine them, which would have switched the scanner off. That one file is now skipped. Nothing else is: any other file in the plugin folder, and any copy of the signature file placed elsewhere, is still scanned normally.
- Tested against WordPress 7.1. Without this the plugin does not appear in directory searches at all.
- Scans no longer contact the WordPress.org checksums API. That request happens only when you press "Check Core Files", exactly as the External services section of this readme describes. Version 1.0.7 called it during scans as well, which made that description untrue. Scans now reuse the result of a core check you have already run, and if you have not run one, every file is scanned as before.
- Fixed a template variable that shadowed a WordPress global on the scan history screen.
- Fixed — a scan of a completely clean WordPress still reported dozens of threats in WordPress's own files, ten of them critical, each with a Quarantine button beside it. Acting on those would have damaged a healthy site. Core files are now verified against the official WordPress checksums and skipped only when they match byte for byte. Measured on an official WordPress 7.1 install: 84 findings before, none after.
- This cannot be used to hide anything. A core file with even one byte changed no longer matches its checksum, so it is scanned like any other file, and a file that is not part of WordPress is never skipped at all. If the checksums cannot be reached, every file is scanned exactly as before.
- Fixed — the scanner reported large numbers of threats in WordPress's own core files on a perfectly clean site. The backtick-execution rule was matching parameter names written inside code comments, which WordPress uses throughout its documentation. Measured against an official WordPress 7.1 download, this removes 249 of 258 critical false positives.
- Improved detection — added a rule for chained decoders, the pattern where two decode calls are nested inside one another. This catches a family of droppers the previous rules missed because they only looked for eval(). Detection on a 3,799-sample malware set rose from 50.4% to 51.2%.
- Fixed: the admin screen left a white band below the plugin content, because the dark background was painted on the content column only and not on the containers behind it or the WordPress footer.
- Fixed: the scan, integrity check, quarantine and clear-history buttons did nothing. The AJAX actions registered in PHP did not match the names the admin script requested, and the script's configuration object was published under a different name than the one it read.
- Renamed the remaining 3-character
nsl_AJAX action names to the plugin'snovascli_prefix. - Paths are now resolved and normalised before use, so the scanner works on installs reached through a symlinked document root and on Windows.
- Escaped all admin output and made the "already running the full NovaScan" notice translatable.
- Added .distignore so
wp dist-archiveexcludes development files, matching whatmake zipalready did. - Converted the two upgrade screenshots from WebP to PNG so the plugin ships only file types on the WordPress.org permitted list.
- Fixed: clicking a tab hid every panel, so the Nova Scan Pro page could not be opened. The tab strip read a data attribute the markup does not set.
- Scan results and scan history moved to their own Results tab, keeping the Scanner page to the controls and the summary. A finished scan now lands there, and the tab carries a count of open findings.
- Replaced the admin menu icon so it renders in the sidebar's own colour instead of a faded blue, and the page header now uses the full Nova Scan mark.
- Renamed internal identifiers from the 3-character
NSL_prefix to the 8-characterNOVASCLI_prefix to meet WordPress.org prefix-uniqueness guidelines. - Documented the WordPress.org core checksums API usage in the "External services" section of this readme.
- Corrected the readme Contributors field to list the plugin's WordPress.org owner account.
- New: dedicated "Nova Scan Pro" feature tab with screenshots and comparison table.
- Improved: full-bleed dark theme scoped to the plugin pages (no impact on the rest of wp-admin).
- Improved: tabbed navigation between the Scanner and Pro feature pages.
- Cleanup: removed duplicate upsell banners from the Scanner page.
- Initial release. Signature-based PHP scanner with 30+ rules, WordPress core integrity check, quarantine, and scan history.