[Daniel]

Sorry if this is not your focus, I’m looking into using CLI tools for checking if any malware infections and the only think I found is checksum tools for WP CLI and the Ubuntu packages are not very good for WordPress.

[Russell]

checksum tools, you mean like this?

How to Run a Quick Security Check Using WP-CLI

[Sarah]

For WordPress Core:

wp core verify-checksums --version=$(wp core version)

For Plugins:

wp plugin verify-checksums --all

[Linda]

I never knew about this, very useful 👍🏻

[Carl]

it would be nice to have something like the Wordfence malware library but only via CLI, the plugin is so bloated

[Scott]

tldr, not really… it’s more like just checking for file integrity.

[Maria]

I suggest any WordPress site owner have remote backups in place, and not from Updraft or random backups plugins (which can also get infected) but from an actual remote service over SSH/SFTP like CodeGuard:

CodeGuard

[Brittany]

Malware is way more complicated than most people realize. It is constantly changing and evolving, every single day. Therefore, detecting it must also be changing always, which is a nearly impossible task and never 100% possible. The best you can do especially for WordPress is often “best guess” when the file checksums are not correct, core files are missing or altered, things like that. Or calls to remote servers are detected within the code, but again that is very subjective.

tl;dr relying on malware detection or security plugins is a crapshoot.

[Author]

Posts