=== AMWScan Antimalware Scanner Lite ===
Contributors: marcocesarato1
Tags: antimalware, antivirus, malware, security, scanner
Requires at least: 5.3
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.2.5
License: GPLv3 or later
License URI: https://www.gnu.org/licenses/gpl-3.0.html

Run, schedule, and review antimalware scans powered by AMWScan from the WordPress dashboard.

== Description ==

AMWScan Antimalware Scanner Lite is the WordPress.org distribution of the free AMWScan PHP antimalware engine for WordPress administration. It is packaged independently from the Full GitHub edition and contains no browser file editor or quarantined-file restoration code. Install only one edition at a time.

Features include default-on upload protection, manual and precisely scheduled background scans with live checked-file progress and scan-rate remaining time, security finding alerts, resumable progress, canonical malware, integrity, and reputation findings, lifecycle exceptions, opt-in bounded ZIP scanning, a WordPress admin dashboard widget, local folder browsing, read-only FTP/FTPS sources, responsive reports, whitelist and quarantine management, backups, automatic fixes, and an About page with documentation and project credits.

Report-only scanning is enabled by default. Reports list integrity, vulnerability, and reputation checks under Security findings, while code and signature matches appear once under Malware detections and remain collapsed until opened. File-changing remediation actions require explicit confirmation. Responsibility and backup warnings appear when automatic actions are enabled or saved and before report remediation and quarantine deletion. Quarantined files cannot be restored through the plugin. Access is limited to administrators with the `manage_options` capability.

Bounded ZIP content scanning is disabled by default for manual and scheduled scans. It requires the PHP ZIP extension and can be enabled under Antimalware > Settings > Scope and limits. Large or highly compressed archives can increase scan time and resource usage, and entries beyond the safety limits are reported as incomplete coverage.

Upload protection scans media and plugin or theme ZIP files before WordPress accepts them. Detected files and uploads that cannot be scanned completely are blocked, and the scan report is retained for review. ZIP inspection requires the PHP ZIP extension. Administrators can disable upload protection under Antimalware > Settings > Scan policy.

Open Antimalware > About for installed plugin and engine versions, documentation, support, contribution guidance, licensing, and contributor credits.

English is the source and fallback language. The plugin includes a translation template for Italian, German, French, Spanish, Russian, Chinese, Japanese, Hindi, and Arabic. Arabic and other right-to-left locales use a dedicated mirrored admin layout while keeping technical values such as file paths and hashes left-to-right.

The plugin always follows the WordPress site language. WordPress loads a matching language pack when available; otherwise, untranslated English source strings remain visible.

== Installation ==

1. For a source checkout, run `composer install --no-dev --optimize-autoloader` in the plugin directory.
2. Upload the complete plugin directory, including `vendor`, to `/wp-content/plugins/amwscan`.
3. Activate AMWScan Antimalware Scanner Lite in WordPress.
4. Open Antimalware > Settings, verify the scan and storage paths, then run a report-only scan.

== Frequently Asked Questions ==

= Why is a queued scan not starting immediately? =

WordPress cron runs when the site receives requests. Configure a system cron that runs `wp cron event run --due-now` when exact timing is required.

= How does upload protection work? =

Scan and block malicious WordPress uploads is enabled by default under Antimalware > Settings > Scan policy. The plugin scans temporary media, plugin, and theme uploads in report-only mode before WordPress stores or installs them. Malware detections and incomplete scans block the upload. Plugin and theme ZIP inspection requires the PHP ZIP extension.

= How do email alerts work? =

Enable Email alerts under Antimalware > Settings. The plugin uses `wp_mail` to notify the WordPress administrator when a completed scan contains unresolved security findings. You can add up to 20 optional recipients. Messages include scan counts and a protected report link, but no local paths or matched code.

= Where are reports, definitions, and quarantined files stored? =

By default in an `amwscan-data` directory beside the web document root and outside the scanned tree. Reports, lifecycle state, checkpoints, backups, downloaded Maltrail definitions, and quarantine data are protected and excluded from scans. Each scan checks the Maltrail release digest and downloads definitions only when changed; a failed update keeps the last verified cache. Enable Use cached Maltrail definitions without updating under Antimalware > Settings > Engine and storage to prevent update requests and use only the last verified cache.

= Does the plugin scan its own files? =

No. The active AMWScan plugin directory and its private data directory are always excluded from scans.

= How do I scan an FTP server? =

Enable the PHP FTP extension, select FTP server under Antimalware > Settings, and enter a credential-free `ftps://host/path` URL. Set `AMWSCAN_FTP_PASSWORD` in the WordPress PHP process environment when authentication requires a password. Use FTPS for authenticated scans because plain FTP is unencrypted. Remote scans are read-only, and passwords are never stored in WordPress.

= Does uninstall delete security data? =

No. Reports, logs, backups, quarantined files, and the whitelist are preserved. WordPress options and scheduled events are removed.

= How can I contribute a detection? =

Open a report finding and select Report finding. The plugin opens a public GitHub issue draft from legacy matches or canonical malware file signatures, containing signature names, detection types, scanner versions, and the file SHA-256 only. It excludes local paths and matched code. Do not attach executable malware to a public issue; maintainers can arrange a private transfer if they need the sample.

= How can I contribute a translation? =

Use the WordPress.org translation project for reviewed locale packs. The source template is `languages/amwscan.pot`.

== Screenshots ==

1. Advanced scan report with severity filters, security and malware findings, exception controls, bulk remediation, and expanded evidence.
2. Dashboard overview with daily manual and scheduled scan activity, live policy status, security metrics, and recent reports.

== Changelog ==

= 0.2.5 =
* See the GitHub release notes for this version.

= 0.2.4 =
* See the GitHub release notes for this version.

= 0.2.3 =
* See the GitHub release notes for this version.

= 0.2.2 =
* Rename the plugin to AMWScan Antimalware Scanner.
* Remove browser code editing and quarantined-file restoration for WordPress.org directory compliance.
* Pass all WordPress Plugin Check categories without errors or warnings.

= 0.2.1 =
* Follow the WordPress site language and remove the plugin-specific language override.
* Improve the WordPress admin experience with clearer navigation, responsive reports, collapsible settings, and initially collapsed malware detections.

= 0.2.0 =
* See the GitHub release notes for this version.

= 0.1.1 =
* Add upload scanning and configurable archive scanning safeguards.

= 0.1.0 =
* Initial free plugin with scheduled background scans, live scan status, CLI-equivalent settings, report exploration, browser editing, automatic fixes, whitelist management, and protected remediation actions.