ishacked: scan the WordPress sites on a server
One PHP file that runs wherever WordPress runs (PHP 7.4 or later, no other dependencies). It finds every WordPress install under the folders you give it and reports:
- Malware patterns in code: webshells, eval of decoded text, PHP hidden in images and uploads, injected
.htaccessredirects. - Core and wordpress.org plugin files that differ from the official releases, extra files and missing ones.
- Backups, database dumps and copies of
wp-config.phpleft in web folders. - Known vulnerabilities in WordPress, plugins and themes (
vuln-scan).
It only reads: it never changes a file and never loads WordPress, so a hacked site's code never runs. Only WordPress versions and plugin and theme names leave the server, to wordpress.org and wpvulnerability.net.
Download
Download ishacked.phar version 0.1.0, 140 KB · SHA-256
SHA-256: 76c45272d10aae1e068316affe4acd71ccd55a470e5fa1a1dce4cf3d0532f07c
Run it
curl -sSfLO https://ishacked.com/cli/ishacked.phar curl -sSfL https://ishacked.com/cli/ishacked.phar.sha256 | shasum -a 256 -c php ishacked.phar scan /var/www php ishacked.phar vuln-scan /var/www --output csv --output-file vulns.csv
Exit codes for scripts and cron: 0 nothing found, 1 findings at or above --fail-on (medium by default), 2 an error, 3 incomplete with --strict. Output as text, TSV, CSV or JSON. php ishacked.phar help lists every option.
Coming from Wordfence CLI?
wordfence malware-scan becomes ishacked scan, wordfence vuln-scan becomes ishacked vuln-scan, and ishacked find lists the installs it sees. The malware patterns are fewer than Wordfence's signature set; comparing every file with the official releases is what keeps false alarms down.
Connected to IsHacked
With an IsHacked account, ishacked connect and an hourly ishacked report send what it finds to your dashboard, with the database (administrators, settings) and the places outside WordPress malware uses to come back: crontab, temporary folders, processes and SSH keys. Servers has the connection code.