Sniff out malware in your WordPress sites.
WPSniffer is a free, open-source command-line scanner that checks WordPress and PHP files against thousands of community YARA rules. Runs on your server. No account, no license key.
- GPLv3
- YARA-X engine
- ~5,000 rules by default
- Python 3.8+
- No account needed
Install, scan, read the report.
Install
pip install from the repository into a virtualenv.
$ python3 -m venv ~/wpsniffer $ ~/wpsniffer/bin/pip install \ git+https://github.com/CommanderWaterford/wpbastion
Scan
Downloads and caches the YARA Forge core package (refreshed daily) and scans with multiple worker processes.
$ wpsniffer malware-scan /var/www/html
Report
Get a CSV, TSV or plain-text report, or an email summary with suspicious files, scanned files, bytes processed and elapsed time.
What it does.
Community YARA rules
Uses YARA Forge core, extended or full packages, cached and refreshed daily. Pin a release for reproducible scans.
Bring your own rules
Add .yar/.yara files or directories with --rules. Each file gets its own namespace, so names never collide.
Whole-file scanning
Files are scanned whole (up to 50 MiB by default), so filesize conditions work and nothing is missed at chunk boundaries.
Fast and parallel
Multi-process scanner, compiled-rule cache, per-file timeout and a live progress display.
Reports your way
CSV, TSV, line- or null-delimited, or human-readable; choose columns such as rule author, reference, score and matched text. Optional email reports.
Fits your pipeline
Reads paths from stdin (find … -print0 | wpsniffer malware-scan), filters by filename or regex, and runs cleanly from cron or CI.
Common commands.
Pick how wide to cast the net.
Detections come from YARA Forge, which collects and tests rules from many authors. WPSniffer downloads the package you choose and credits each rule's author in its reports.
| core default | extended | full | |
|---|---|---|---|
| Rules | About 5,000, including PHP webshell rules | More rules than core | Everything in YARA Forge |
| False positives | Fewest | More noise | Most noise |
| Flag | --yara-forge core | --yara-forge extended | --yara-forge full |
--yara-forge none with --rules to scan with your own rules and skip the download.
It doesn't phone home.
- No account, license key or telemetry.
- The only network request is downloading the YARA Forge rule package from GitHub (skippable with
--yara-forge noneand local rules). - Your files never leave your server.
Is it free?
Yes — GPLv3, no paid tier.
Does it remove malware?
No. It finds suspicious files and reports them; cleanup is up to you.
Will it have false positives?
Some rules are broad. Start with core, use -e to exclude noisy rules, and review matches before deleting anything.
Does it need WordPress to be running?
No — it scans files on disk.
Step-by-step, from the shell.
Copy-and-paste guides for the situations that bring people to a command-line scanner. Comparing tools? See WPSniffer vs Wordfence CLI, maldet, PHP Malware Finder and ISPProtect.
Scan a WordPress site over SSH
Connect, install, scan and read the report in ten minutes.
Find PHP webshells in wp-content/uploads
List, scan, quarantine and block PHP execution where it never belongs.
Find recently modified files on a hacked site
Use ctime, scan only what changed, verify core checksums.
Scan all WordPress sites on a server
Inventory, one run or one report per site, keep it fast.
Nightly scan with cron and an email report
A crontab line or systemd timer that emails you only when something is found.
What to do after a scan finds matches
Confirm, quarantine, find the entry point, restore, rotate secrets, re-scan.