=== ice Scanner Security ===
Contributors: icecodero
Tags: security, malware scanner, file integrity, checksums, hack
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.26.11.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Read-only security scanner: checks core and plugins against the official checksums and finds hidden code, risky settings and new admins.

== Description ==

ice Scanner Security checks your whole WordPress site and shows you, in plain words, what looks wrong and where. It **only reads**: it never changes, moves or deletes anything, so it is safe to run on a live site.

**What it checks**

* **WordPress core** – every core file is compared with the official WordPress.org checksums for your version and language. Modified files and unknown PHP files inside wp-admin and wp-includes are reported.
* **Plugins** – plugins hosted on WordPress.org are compared with their official checksums. Premium or custom plugins are checked with code heuristics.
* **Themes** – theme files are checked with code heuristics; inactive themes are listed so you can remove them.
* **Hidden code** – code executed from encoded or user-supplied data, chained decoding, very long encoded strings, PHP code hidden in images or .ico files, code that creates administrators.
* **Uploads folder** – PHP or other executable files, images containing PHP, SVG files with scripts, and whether running PHP from uploads is blocked.
* **Outside WordPress** – unknown folders, public archives, database dumps and logs that anyone could download, leftover installers.
* **Configuration** – .htaccess, .user.ini and php.ini rules that load PHP on every request, run images as PHP or redirect search engine visitors; drop-ins, must-use plugins, the file editor and WP_DEBUG.
* **Database** – administrators (new ones are highlighted), open registration with a high default role, scripts or iframes saved in options and posts.
* **Changes** – new or changed files since the previous scan.

**Built for shared hosting**

Large steps run in short slices, so a scan never hits the hosting time limit, even on big sites. You can set the time per slice, the largest file read and the folders to skip.

**Easy to act on**

* Results are grouped as Critical, Warning and Info.
* Every finding shows the file and, for code, the line – click "View" to see the code around it.
* "Ignore" findings you have checked; they stay ignored in future scans.
* Download the report as a text file.
* Optional automatic scan (twice a day, daily or weekly) with an email only when new problems appear.

**Translations**

The plugin is ready for translation through translate.wordpress.org.

**Developed by** Poienariu Alin – [iceCode](https://icecode.ro).

== External services ==

To check the integrity of your files, the plugin downloads the official checksums from WordPress.org:

* `api.wordpress.org/core/checksums/` – checksums of the WordPress core files, for your WordPress version and language (through the WordPress function get_core_checksums()).
* `downloads.wordpress.org/plugin-checksums/` – checksums of each installed plugin, for the installed version.

Only the WordPress version, the site language and the plugin slugs and versions are sent – the same information WordPress itself sends when it checks for updates. No data about your site content, users or visitors is sent anywhere. These requests happen only when a scan runs (started by you or by the optional automatic scan).

WordPress.org [Privacy Policy](https://wordpress.org/about/privacy/).

== Installation ==

1. Install the plugin from Plugins → Add New (search for "ice Scanner Security"), or upload the folder to `/wp-content/plugins/`.
2. Activate it.
3. Go to **ice Scanner Security** in the dashboard menu and click **Start a full scan**.
4. Optional: enable the automatic scan in the settings below the report.

== Frequently Asked Questions ==

= Does the scanner change or delete files? =

No. Every check only reads files and the database. Fixing a problem is always your decision.

= What does "Critical", "Warning" and "Info" mean? =

Critical: very likely a hack or a dangerous setting, check it now. Warning: suspicious, worth checking. Info: useful to know (for example, the list of administrators).

= A finding is a false positive. What can I do? =

Click "Ignore" next to it. It will stay ignored in future scans; you can restore it from the "Ignored" filter.

= My hosting antivirus removed the plugin files. Why? =

A security scanner contains the code patterns it searches for, so some hosting antivirus tools (for example Imunify360 or cPGuard) may flag it. Add the folder `wp-content/plugins/icecodero-security-scanner` to the antivirus exceptions (allowlist) in your hosting control panel:

* cPGuard: cPanel → Security → cPGuard → Settings → Virus Scanner → Whitelist Files.
* Imunify360: the detected files are listed in cPanel → Imunify360; ask your hosting provider to add the folder to the Imunify360 ignore list.

Then upload the plugin again.

= The scan stops on a large site. =

Lower "Work time per step" in the settings (for example to 10 seconds) if your hosting has a short time limit, and add large folders that do not need checking (backups, caches) to "Skipped folders".

= Does it slow down my site? =

No. The scanner runs only when you start it or when the optional automatic scan runs. It adds nothing to the pages your visitors see.

== Screenshots ==

1. The report: findings grouped by level, with the file and line.
2. Viewing the code around a finding.
3. Settings: automatic scan, what is checked, skipped folders and limits.

== Changelog ==

= 1.26.11.1 =
* First public release on WordPress.org.
* Versions use the format MAJOR.YY.MM.N (year, month and the number of the release in that month).

== Upgrade Notice ==

= 1.26.11.1 =
First public release.
