WPSniffer vs PHP Malware Finder
Updated October 2026
PHP Malware Finder (PMF) proved that YARA rules are a good fit for PHP malware: it crawls a filesystem and tests files against rules for webshells and well-known obfuscators. Its GitHub repository was archived and made read-only on February 11, 2024. WPSniffer takes the same idea forward with a maintained engine and a much larger, continuously updated rule set.
At a glance
| WPSniffer | PHP Malware Finder | |
|---|---|---|
| License | GPLv3 | LGPL-3.0 |
| Status | Maintained | Archived (read-only) since February 11, 2024 |
| Written in | Python 3.8+ | Go 1.17+ with libyara 4.2+; rules also usable with the yara CLI |
| Engine | YARA-X | Classic YARA (libyara) |
| Rules | YARA Forge core, extended or full (about 5,000 in core), refreshed daily, plus your own | PMF's own php.yar rule set for webshells and about 20 named obfuscators; no longer updated |
| Rule attribution in output | ✓ Author, reference, score and description columns | ✗ Rule name only |
| Report formats | CSV, TSV, delimited, human-readable, email | Terminal output |
| Whole-file scanning | ✓ Up to 50 MiB by default | Depends on YARA defaults |
| Multi-process | ✓ -j | ✓ -w workers |
| Whitelist / exclusions | -e excludes rules by name; filename filters | whitelist.yar with hashes of known-good files |
| Docker image | Not provided; pip install | ✓ ghcr.io/jvoisin/php-malware-finder |
| WordPress-specific helpers | ✓ count-sites; reads paths from stdin for find pipelines | ✗ |
What PMF got right
PMF's rules are written as semantic patterns rather than file hashes, so they catch variants, and its list of detected obfuscators (Weevely3, P.A.S, Carbylamine, PHP Jiami and others) targets exactly the tooling used against WordPress. Its whitelist of hashes for known-good files is a clean answer to false positives on vendored libraries. Its own README was honest that bypassing it is "trivial", which is true of every pattern-based scanner and the reason rule sets must keep evolving.
With the repository archived, the rules stopped evolving in early 2024. New webshell generators and obfuscators since then are not covered, and the project will not receive fixes for newer YARA versions.
Where WPSniffer differs
- Rule supply. Instead of one project's rule file, WPSniffer downloads the YARA Forge package, which aggregates and tests rules from many maintained sources, including the webshell and obfuscator families PMF targeted, and refreshes daily.
- Attribution. Each hit carries the rule author, reference URL, score and description, so a report is reviewable by someone who has never seen the rule.
- Reporting. CSV, TSV and delimited output with selectable columns, and an email summary, instead of terminal text.
- Operations. Compiled-rule caching, per-file timeouts, whole-file scanning and stdin input make it practical for nightly scans across many sites.
What PMF has that WPSniffer lacks: a hash-based whitelist of known-good files and an official Docker image. WPSniffer's equivalent for noise is excluding rules by name and narrowing the scan with filename filters or a find list.
Migrating from PMF
If you still have PMF's php.yar, you can keep using its rules inside WPSniffer alongside YARA Forge. YARA-X is stricter about syntax than classic YARA, so some rules may need small fixes, which the compiler reports clearly:
$ wpsniffer malware-scan --rules /opt/php-malware-finder/data/php.yar --yara-forge core /var/www/htmlReplace a PMF invocation with the WPSniffer equivalent:
$ php-malware-finder -a -w 8 /var/www/html
$ wpsniffer malware-scan --match-all -j 8 /var/www/htmlFor files PMF whitelisted, confirm they are clean once and exclude the specific rule they trigger with -e.