Title: ice Scanner Security Author: icecodero Published: November 2, 2026 Last modified: November 2, 2026 --- Search plugins ![](https://ps.w.org/icecodero-security-scanner/assets/banner-772x250.png?rev=3779680) ![](https://ps.w.org/icecodero-security-scanner/assets/icon-256x256.png?rev=3779680) # ice Scanner Security By [icecodero](https://profiles.wordpress.org/icecodero/) [Download](https://downloads.wordpress.org/plugin/icecodero-security-scanner.1.26.11.1.zip) * [Details](https://wordpress.org/plugins/icecodero-security-scanner/#description) * [Reviews](https://wordpress.org/plugins/icecodero-security-scanner/#reviews) * [Installation](https://wordpress.org/plugins/icecodero-security-scanner/#installation) * [Development](https://wordpress.org/plugins/icecodero-security-scanner/#developers) [Support](https://wordpress.org/support/plugin/icecodero-security-scanner/) ## Description ice Scanner Security checks your whole WordPress site and shows you, in plain words, what looks wrong and where. It **only reads**: it never changes, moves or deletes anything, so it is safe to run on a live site. **What it checks** * **WordPress core** – every core file is compared with the official WordPress. org checksums for your version and language. Modified files and unknown PHP files inside wp-admin and wp-includes are reported. * **Plugins** – plugins hosted on WordPress.org are compared with their official checksums. Premium or custom plugins are checked with code heuristics. * **Themes** – theme files are checked with code heuristics; inactive themes are listed so you can remove them. * **Hidden code** – code executed from encoded or user-supplied data, chained decoding, very long encoded strings, PHP code hidden in images or .ico files, code that creates administrators. * **Uploads folder** – PHP or other executable files, images containing PHP, SVG files with scripts, and whether running PHP from uploads is blocked. * **Outside WordPress** – unknown folders, public archives, database dumps and logs that anyone could download, leftover installers. * **Configuration** – .htaccess, .user.ini and php.ini rules that load PHP on every request, run images as PHP or redirect search engine visitors; drop-ins, must- use plugins, the file editor and WP_DEBUG. * **Database** – administrators (new ones are highlighted), open registration with a high default role, scripts or iframes saved in options and posts. * **Changes** – new or changed files since the previous scan. **Built for shared hosting** Large steps run in short slices, so a scan never hits the hosting time limit, even on big sites. You can set the time per slice, the largest file read and the folders to skip. **Easy to act on** * Results are grouped as Critical, Warning and Info. * Every finding shows the file and, for code, the line – click “View” to see the code around it. * “Ignore” findings you have checked; they stay ignored in future scans. * Download the report as a text file. * Optional automatic scan (twice a day, daily or weekly) with an email only when new problems appear. **Translations** The plugin is ready for translation through translate.wordpress.org. **Developed by** Poienariu Alin – [iceCode](https://icecode.ro). ### External services To check the integrity of your files, the plugin downloads the official checksums from WordPress.org: * `api.wordpress.org/core/checksums/` – checksums of the WordPress core files, for your WordPress version and language (through the WordPress function get_core_checksums()). * `downloads.wordpress.org/plugin-checksums/` – checksums of each installed plugin, for the installed version. Only the WordPress version, the site language and the plugin slugs and versions are sent – the same information WordPress itself sends when it checks for updates. No data about your site content, users or visitors is sent anywhere. These requests happen only when a scan runs (started by you or by the optional automatic scan). WordPress.org [Privacy Policy](https://wordpress.org/about/privacy/). ## Screenshots [⌊The report: findings grouped by level, with the file and line.⌉⌊The report: findings grouped by level, with the file and line.⌉[ The report: findings grouped by level, with the file and line. [⌊Viewing the code around a finding.⌉⌊Viewing the code around a finding.⌉[ Viewing the code around a finding. [⌊Settings: automatic scan, what is checked, skipped folders and limits.⌉⌊Settings: automatic scan, what is checked, skipped folders and limits.⌉[ Settings: automatic scan, what is checked, skipped folders and limits. ## Installation 1. Install the plugin from Plugins Add New (search for “ice Scanner Security”), or upload the folder to `/wp-content/plugins/`. 2. Activate it. 3. Go to **ice Scanner Security** in the dashboard menu and click **Start a full scan**. 4. Optional: enable the automatic scan in the settings below the report. ## FAQ ### Does the scanner change or delete files? No. Every check only reads files and the database. Fixing a problem is always your decision. ### What does “Critical”, “Warning” and “Info” mean? Critical: very likely a hack or a dangerous setting, check it now. Warning: suspicious, worth checking. Info: useful to know (for example, the list of administrators). ### A finding is a false positive. What can I do? Click “Ignore” next to it. It will stay ignored in future scans; you can restore it from the “Ignored” filter. ### My hosting antivirus removed the plugin files. Why? A security scanner contains the code patterns it searches for, so some hosting antivirus tools (for example Imunify360 or cPGuard) may flag it. Add the folder `wp-content/ plugins/icecodero-security-scanner` to the antivirus exceptions (allowlist) in your hosting control panel: * cPGuard: cPanel Security cPGuard Settings Virus Scanner Whitelist Files. * Imunify360: the detected files are listed in cPanel Imunify360; ask your hosting provider to add the folder to the Imunify360 ignore list. Then upload the plugin again. ### The scan stops on a large site. Lower “Work time per step” in the settings (for example to 10 seconds) if your hosting has a short time limit, and add large folders that do not need checking (backups, caches) to “Skipped folders”. ### Does it slow down my site? No. The scanner runs only when you start it or when the optional automatic scan runs. It adds nothing to the pages your visitors see. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “ice Scanner Security” is open source software. The following people have contributed to this plugin. Contributors * [ icecodero ](https://profiles.wordpress.org/icecodero/) [Translate “ice Scanner Security” into your language.](https://translate.wordpress.org/projects/wp-plugins/icecodero-security-scanner) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/icecodero-security-scanner/), check out the [SVN repository](https://plugins.svn.wordpress.org/icecodero-security-scanner/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/icecodero-security-scanner/) by [RSS](https://plugins.trac.wordpress.org/log/icecodero-security-scanner/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.26.11.1 * First public release on WordPress.org. * Versions use the format MAJOR.YY.MM.N (year, month and the number of the release in that month). ## Meta * Version **1.26.11.1** * Last updated **1 day ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [checksums](https://wordpress.org/plugins/tags/checksums/)[File Integrity](https://wordpress.org/plugins/tags/file-integrity/) [hack](https://wordpress.org/plugins/tags/hack/)[malware scanner](https://wordpress.org/plugins/tags/malware-scanner/) [security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/icecodero-security-scanner/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/icecodero-security-scanner/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/icecodero-security-scanner/reviews/) ## Contributors * [ icecodero ](https://profiles.wordpress.org/icecodero/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/icecodero-security-scanner/)