WPSniffer vs ISPProtect
Updated October 2026
ISPProtect, from the team behind the ISPConfig hosting panel, is a well-established commercial scanner for web servers that also flags outdated CMS installations. WPSniffer is free and open source and focuses on file-level malware detection with readable YARA rules. The right choice depends on budget, PHP version and whether you need CMS version checks.
At a glance
| WPSniffer | ISPProtect | |
|---|---|---|
| License | GPLv3, open source | Commercial, licensed per server or per scan |
| Cost | Free | Yearly license 82.68 € per server (6.89 €/month billed annually) with unlimited scans; or scan packs from 5 scans for 5 € to 100 scans for 60 €, excluding VAT. A trial key is available without registration. |
| License key | ✗ | ✓ Enter a key or TRIAL at each scan |
| Requirements | Python 3.8+ | Command-line PHP (versions 5.3 to 7.4 per its FAQ) and ClamAV |
| Detection | YARA Forge community rules plus your own YARA rules | Signature engine using ClamAV with ISPProtect signatures, plus a heuristic engine |
| Rules readable | ✓ | ✗ Signatures are proprietary |
| Custom rules | ✓ --rules | ✗ |
| Outdated CMS detection | ✗ | ✓ WordPress, Joomla, Drupal, Magento and others |
| Reports | CSV, TSV, delimited, human-readable, email summary | Scan output and report emails on a daily, weekly, monthly or custom interval |
| Scheduled scans | cron or systemd timer | Built-in scheduling for report emails |
| Add-ons | None | BanDaemon (brute-force protection) included with the yearly license |
| Telemetry | ✗ Only downloads rules from GitHub | License validation requires contacting ISPProtect's servers |
Requirements and installation
ISPProtect runs as a PHP command-line program and needs ClamAV installed for its first scan level. Its FAQ lists supported PHP versions from 5.3 to 7.4. On modern servers that ship PHP 8 as the only interpreter, you may need a second PHP build or the ISPProtect Docker image. WPSniffer needs only Python 3.8 or newer and installs into a user-level virtualenv in two minutes; it has no dependency on PHP, ClamAV or root access.
Detection and transparency
ISPProtect combines ClamAV with its own proprietary signatures and adds a heuristic engine for unknown malware. It also detects outdated CMS and shop installations, which WPSniffer does not do; that is the strongest reason to pick ISPProtect for a hosting business that wants to nudge customers to update.
WPSniffer scans with YARA rules you can read. Each report row names the rule, its author and a reference, and you can add rules for malware you see on your own servers. For a security team that wants to understand and tune detections rather than trust a black box, that transparency is the deciding factor.
Cost over a fleet
ISPProtect's yearly license is per server. Across ten servers that is roughly 827 € per year before VAT at the listed price, or a per-scan budget to manage. WPSniffer is free on any number of servers, so the cost is only the hour it takes to set up a nightly cron job and email summary. For a single server scanned occasionally, ISPProtect's scan packs are inexpensive, and the trial key lets you evaluate it without paying.
When to choose which
- You want outdated-CMS detection and a vendor to call: ISPProtect.
- You run many servers or want zero licensing overhead: WPSniffer.
- Your servers run PHP 8 only, or you cannot install ClamAV: WPSniffer.
- You want to read, tune and write detection rules: WPSniffer.
- You run ISPConfig and want brute-force protection bundled: ISPProtect with BanDaemon.
Running both is reasonable: ISPProtect for its CMS version checks and heuristics, WPSniffer for a free, readable second opinion on every file.