Description
Nova Scan Lite is a free, lightweight malware scanner for WordPress. It checks your site for common PHP threats and verifies WordPress core file integrity — all running locally on your server during an admin session.
What it does
- Scans PHP files for backdoors, webshells, and RCE patterns
- Verifies WordPress core files against official checksums
- Flags modified or unexpected files in wp-admin/ and wp-includes/
- One-click quarantine to disable suspicious files without deleting
- Chunked scanning (handles thousands of files without timeouts)
- Full scan history with severity breakdowns
What it detects
- Backdoors & webshells (C99, r57, FilesMan, custom shells)
- Remote code execution (eval + base64, preg_replace /e, create_function)
- System command execution (system, shell_exec, passthru with user input)
- Credential harvesting and wp_users dumps
- File system abuse (remote file writes, 0777 chmod, wget/curl droppers)
- Obfuscation patterns (long base64, chr/ord chains, hex encoding)
- Modified WordPress core files
Privacy
Nova Scan Lite does not transmit any of your site’s content, file data, or user information anywhere. Scans run locally on your server. The only outbound request the plugin makes is to the official WordPress.org checksums API for core file integrity verification (see the “External services” section below).
External services
Nova Scan Lite uses one external service, provided by WordPress.org.
WordPress.org Core Checksums API
- What it is and what it is used for: The official WordPress.org API that returns known-good MD5 checksums for every file in a given WordPress core release. Nova Scan Lite uses it to verify that the installed WordPress core files have not been modified by malware or unauthorized users.
- What data is sent and when: The request is triggered only when the site administrator clicks the “Check Core Files” button in the admin. The request sends only the currently-installed WordPress version string and the site’s locale (for example
version=7.0&locale=en_US). No site URL, no user data, no file contents, and no database information is transmitted. - Terms and privacy: The API is operated by the WordPress Foundation. Its use is governed by the WordPress.org privacy policy (https://wordpress.org/about/privacy/).
- Endpoint: https://api.wordpress.org/core/checksums/1.0/
No other outbound requests are made. No tracking, no telemetry, no phone home, no remote assets loaded.
Upgrade to Nova Scan Pro
Nova Scan Pro is also free (included with a free Nova Heaven account). It replaces Lite and adds:
- Web Application Firewall with brute-force and XML-RPC protection
- Database payload scanner
- Vulnerability (CVE) intelligence and virtual patching
- Repository integrity check, file modification monitoring, tamper-proof canaries
- Mass-reinfection velocity alerts, cron job scanner, rogue admin detection
- Obfuscation / encoding detection and behavioral pattern analysis
- Security score, threat dashboard, one-click hardening, security headers
- Allowlist management, scheduled scans, email alerts
- Frontend Shield monitor (cross-domain, catches skimmers and injected scripts)
- 12-provider cascading email engine so alerts never get stuck on one quota
- Signed automatic updates
- Multilingual (21 languages)
Learn more at novaheaven.io/novascan.
Screenshots
Installation
- Upload the
novascan-litefolder to/wp-content/plugins/, or install via the WordPress plugin directory. - Activate through the Plugins menu.
- Go to Nova Scan Lite in the admin menu.
- Click Start Scan or Check Core Files.
FAQ
-
Does this slow down my site?
-
No. Nova Scan Lite only runs in the WordPress admin, and only when you trigger a scan. It does nothing on the front end and adds no load to regular page requests.
-
What files does it scan?
-
PHP files only (.php, .php3, .php4, .php5, .php7, .phtml, .phar) up to 4 MB each.
-
What is quarantine?
-
Quarantining renames the file with a
.quarantineextension so PHP cannot execute it. The file is not deleted — you can review it or restore it manually via SFTP. -
Does Nova Scan Lite phone home or collect data?
-
No. Nova Scan Lite does not send any site content, file data, scan results, or user information to Nova Heaven or anywhere else. The only outbound request is to the official WordPress.org checksums API, used only to verify WordPress core files against known-good hashes when you click “Check Core Files”. See the “External services” section above for full details.
-
What is Nova Scan Pro?
-
Nova Scan Pro is the full edition with a Web Application Firewall, database scanner, CVE intelligence and virtual patching, Frontend Shield cross-domain monitor, and 20+ more features. It is also free (included with a free Nova Heaven account). Nova Scan Pro replaces Lite — they are not designed to run side by side. See the “Nova Scan Pro” tab inside the plugin for a full feature comparison.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Nova Scan Lite – Malware Scanner, Backdoor & File Integrity” is open source software. The following people have contributed to this plugin.
Contributors
“Nova Scan Lite – Malware Scanner, Backdoor & File Integrity” has been translated into 1 locale. Thank you to the translators for their contributions.
Translate “Nova Scan Lite – Malware Scanner, Backdoor & File Integrity” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.9
- Fixed — every scan reported a critical threat inside Nova Scan Lite itself.
The file holding the detection signatures naturally contains the patterns it
looks for, so the scanner matched its own rules and offered to quarantine
them, which would have switched the scanner off. That one file is now skipped.
Nothing else is: any other file in the plugin folder, and any copy of the
signature file placed elsewhere, is still scanned normally.
1.0.8
- Tested against WordPress 7.1. Without this the plugin does not appear in
directory searches at all. - Scans no longer contact the WordPress.org checksums API. That request happens
only when you press “Check Core Files”, exactly as the External services
section of this readme describes. Version 1.0.7 called it during scans as
well, which made that description untrue. Scans now reuse the result of a
core check you have already run, and if you have not run one, every file is
scanned as before. - Fixed a template variable that shadowed a WordPress global on the scan history
screen.
1.0.7
- Fixed — a scan of a completely clean WordPress still reported dozens of
threats in WordPress’s own files, ten of them critical, each with a Quarantine
button beside it. Acting on those would have damaged a healthy site. Core
files are now verified against the official WordPress checksums and skipped
only when they match byte for byte. Measured on an official WordPress 7.1
install: 84 findings before, none after. - This cannot be used to hide anything. A core file with even one byte changed
no longer matches its checksum, so it is scanned like any other file, and a
file that is not part of WordPress is never skipped at all. If the checksums
cannot be reached, every file is scanned exactly as before.
1.0.6
- Fixed — the scanner reported large numbers of threats in WordPress’s own core
files on a perfectly clean site. The backtick-execution rule was matching
parameter names written inside code comments, which WordPress uses throughout
its documentation. Measured against an official WordPress 7.1 download, this
removes 249 of 258 critical false positives. - Improved detection — added a rule for chained decoders, the pattern where two
decode calls are nested inside one another. This catches a family of droppers
the previous rules missed because they only looked for eval(). Detection on a
3,799-sample malware set rose from 50.4% to 51.2%.
1.0.5
- Fixed: the admin screen left a white band below the plugin content, because the dark background was painted on the content column only and not on the containers behind it or the WordPress footer.
1.0.4
- Fixed: the scan, integrity check, quarantine and clear-history buttons did nothing. The AJAX actions registered in PHP did not match the names the admin script requested, and the script’s configuration object was published under a different name than the one it read.
- Renamed the remaining 3-character
nsl_AJAX action names to the plugin’snovascli_prefix. - Paths are now resolved and normalised before use, so the scanner works on installs reached through a symlinked document root and on Windows.
- Escaped all admin output and made the “already running the full NovaScan” notice translatable.
- Added .distignore so
wp dist-archiveexcludes development files, matching whatmake zipalready did. - Converted the two upgrade screenshots from WebP to PNG so the plugin ships only file types on the WordPress.org permitted list.
- Fixed: clicking a tab hid every panel, so the Nova Scan Pro page could not be opened. The tab strip read a data attribute the markup does not set.
- Scan results and scan history moved to their own Results tab, keeping the Scanner page to the controls and the summary. A finished scan now lands there, and the tab carries a count of open findings.
- Replaced the admin menu icon so it renders in the sidebar’s own colour instead of a faded blue, and the page header now uses the full Nova Scan mark.
1.0.2
- Renamed internal identifiers from the 3-character
NSL_prefix to the 8-characterNOVASCLI_prefix to meet WordPress.org prefix-uniqueness guidelines. - Documented the WordPress.org core checksums API usage in the “External services” section of this readme.
- Corrected the readme Contributors field to list the plugin’s WordPress.org owner account.
1.0.1
- New: dedicated “Nova Scan Pro” feature tab with screenshots and comparison table.
- Improved: full-bleed dark theme scoped to the plugin pages (no impact on the rest of wp-admin).
- Improved: tabbed navigation between the Scanner and Pro feature pages.
- Cleanup: removed duplicate upsell banners from the Scanner page.
1.0.0
- Initial release. Signature-based PHP scanner with 30+ rules, WordPress core integrity check, quarantine, and scan history.