Detectant Malware Scanner

Description

Detectant checks WordPress file uploads and imported files with the Detectant malware-analysis service before WordPress accepts them. It can also scan the existing Media Library manually or every 24 hours, track scan results, and quarantine detected malware outside the public web directory.

The settings and Media Library scan are available under Tools > Detectant. Administrators can choose which upload sources to protect and whether WordPress should block or allow a file when a security check cannot be completed.

External Service

This plugin relies on Detectant, an external malware-analysis service. A Detectant account and API key are required.

The plugin sends a file, its original filename, and its detected MIME type to https://api.detectant.com when it checks a Media Library upload, a file imported by another plugin, an existing Media Library file during a manual or scheduled scan, or a file found by background reconciliation. The file is sent so Detectant can analyse it for malware. The saved API key is sent with each request solely to authenticate the site to the service. Connection tests send the API key but do not send a file.

The plugin does not send the website URL. Its request User-Agent contains only the plugin name and version.

Use of the service is subject to Detectant’s Terms of Service and Privacy Policy.

Security and operational notes

Files handled by WordPress upload and file-import APIs are scanned before their final move and verified again by SHA-256 afterward. Code that writes directly into the uploads directory cannot be blocked synchronously; reconciliation discovers it later and moves malware into a private directory outside the web document root. If that directory is temporarily unavailable, the original public URL is broken and the file is retained under an unpredictable, mode-000 containment name for a later retry.

The quarantine location can be set with DETECTANT_QUARANTINE_DIR in wp-config.php. It must resolve outside both the upload directory and the public document root. Scan state is stored in an indexed WordPress database table; directory traversal and Media Library scans retain bounded cursors between WP-Cron runs.

The API key never enters browser-side JavaScript and is never printed after saving. For the strongest configuration control, use the DETECTANT_API_KEY constant. Direct uploads are capped at 250 MB by the plugin; lower Detectant plan limits are reported by the API.

WP-Cron runs when the site receives traffic. Low-traffic sites may see delayed reconciliation, although synchronous normal upload protection remains active.

Administrators can mark a detected Media Library file as safe when they have confirmed a false positive. Detectant restores only the exact quarantined content that was reviewed; any content change invalidates that acknowledgement and requires another scan.

WP-CLI

wp detectant scan

wp detectant scan --unscanned

wp detectant scan attachment <id>