{"id":299562,"date":"2026-08-21T15:43:17","date_gmt":"2026-08-21T15:43:17","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/nova-scan-lite\/"},"modified":"2026-08-22T06:30:47","modified_gmt":"2026-08-22T06:30:47","slug":"novascan-lite","status":"publish","type":"plugin","link":"https:\/\/en-gb.wordpress.org\/plugins\/novascan-lite\/","author":23469539,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.8","stable_tag":"1.0.8","tested":"7.1","requires":"6.2","requires_php":"7.4","requires_plugins":null,"header_name":"Nova Scan Lite","header_author":"Nova Heaven","header_description":"Lightweight malware scanner for WordPress. Detects PHP backdoors, webshells, and injections with signature-based detection and WordPress core file integrity checks. Runs locally \u2014 no phone home, no telemetry.","assets_banners_color":"5e6ca7","last_updated":"2026-08-22 06:30:47","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/novaheaven.io\/novascan","header_author_uri":"https:\/\/novaheaven.io","rating":0,"author_block_rating":0,"active_installs":0,"downloads":72,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.5":{"tag":"1.0.5","author":"sephx","date":"2026-08-21 15:42:43"},"1.0.6":{"tag":"1.0.6","author":"sephx","date":"2026-08-22 04:53:59"},"1.0.7":{"tag":"1.0.7","author":"sephx","date":"2026-08-22 05:25:18"},"1.0.8":{"tag":"1.0.8","author":"sephx","date":"2026-08-22 06:30:47"}},"upgrade_notice":{"1.0.2":"<p>Internal refactor to meet WordPress.org code guidelines. No user-facing changes.<\/p>","1.0.1":"<p>Improved admin UI with a new dedicated Nova Scan Pro tab and cleaner scanner view.<\/p>","1.0.0":"<p>Initial release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3659306,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3659306,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3659306,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3659306,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.5","1.0.6","1.0.7","1.0.8"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[8646,168808,55021,600,276846],"plugin_category":[54],"plugin_contributors":[276847],"plugin_business_model":[],"class_list":["post-299562","plugin","type-plugin","status-publish","hentry","plugin_tags-backdoor","plugin_tags-file-integrity","plugin_tags-malware-scanner","plugin_tags-security","plugin_tags-virus-scanner","plugin_category-security-and-spam-protection","plugin_contributors-sephx","plugin_committers-sephx"],"banners":{"banner":"https:\/\/ps.w.org\/novascan-lite\/assets\/banner-772x250.png?rev=3659306","banner_2x":"https:\/\/ps.w.org\/novascan-lite\/assets\/banner-1544x500.png?rev=3659306","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/novascan-lite\/assets\/icon-128x128.png?rev=3659306","icon_2x":"https:\/\/ps.w.org\/novascan-lite\/assets\/icon-256x256.png?rev=3659306","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Nova Scan Lite is a free, lightweight malware scanner for WordPress. It checks your site for common PHP threats and verifies WordPress core file integrity \u2014 all running locally on your server during an admin session.<\/p>\n\n<p><strong>What it does<\/strong><\/p>\n\n<ul>\n<li>Scans PHP files for backdoors, webshells, and RCE patterns<\/li>\n<li>Verifies WordPress core files against official checksums<\/li>\n<li>Flags modified or unexpected files in wp-admin\/ and wp-includes\/<\/li>\n<li>One-click quarantine to disable suspicious files without deleting<\/li>\n<li>Chunked scanning (handles thousands of files without timeouts)<\/li>\n<li>Full scan history with severity breakdowns<\/li>\n<\/ul>\n\n<p><strong>What it detects<\/strong><\/p>\n\n<ul>\n<li>Backdoors &amp; webshells (C99, r57, FilesMan, custom shells)<\/li>\n<li>Remote code execution (eval + base64, preg_replace \/e, create_function)<\/li>\n<li>System command execution (system, shell_exec, passthru with user input)<\/li>\n<li>Credential harvesting and wp_users dumps<\/li>\n<li>File system abuse (remote file writes, 0777 chmod, wget\/curl droppers)<\/li>\n<li>Obfuscation patterns (long base64, chr\/ord chains, hex encoding)<\/li>\n<li>Modified WordPress core files<\/li>\n<\/ul>\n\n<p><strong>Privacy<\/strong><\/p>\n\n<p>Nova Scan Lite does not transmit any of your site's content, file data, or user information anywhere. Scans run locally on your server. The only outbound request the plugin makes is to the official WordPress.org checksums API for core file integrity verification (see the \"External services\" section below).<\/p>\n\n<h3>External services<\/h3>\n\n<p>Nova Scan Lite uses one external service, provided by WordPress.org.<\/p>\n\n<p><strong>WordPress.org Core Checksums API<\/strong><\/p>\n\n<ul>\n<li>What it is and what it is used for: The official WordPress.org API that returns known-good MD5 checksums for every file in a given WordPress core release. Nova Scan Lite uses it to verify that the installed WordPress core files have not been modified by malware or unauthorized users.<\/li>\n<li>What data is sent and when: The request is triggered only when the site administrator clicks the \"Check Core Files\" button in the admin. The request sends only the currently-installed WordPress version string and the site's locale (for example <code>version=7.0&amp;locale=en_US<\/code>). No site URL, no user data, no file contents, and no database information is transmitted.<\/li>\n<li>Terms and privacy: The API is operated by the WordPress Foundation. Its use is governed by the WordPress.org privacy policy (https:\/\/wordpress.org\/about\/privacy\/).<\/li>\n<li>Endpoint: https:\/\/api.wordpress.org\/core\/checksums\/1.0\/<\/li>\n<\/ul>\n\n<p>No other outbound requests are made. No tracking, no telemetry, no phone home, no remote assets loaded.<\/p>\n\n<h3>Upgrade to Nova Scan Pro<\/h3>\n\n<p>Nova Scan Pro is also free (included with a free Nova Heaven account). It replaces Lite and adds:<\/p>\n\n<ul>\n<li>Web Application Firewall with brute-force and XML-RPC protection<\/li>\n<li>Database payload scanner<\/li>\n<li>Vulnerability (CVE) intelligence and virtual patching<\/li>\n<li>Repository integrity check, file modification monitoring, tamper-proof canaries<\/li>\n<li>Mass-reinfection velocity alerts, cron job scanner, rogue admin detection<\/li>\n<li>Obfuscation \/ encoding detection and behavioral pattern analysis<\/li>\n<li>Security score, threat dashboard, one-click hardening, security headers<\/li>\n<li>Allowlist management, scheduled scans, email alerts<\/li>\n<li>Frontend Shield monitor (cross-domain, catches skimmers and injected scripts)<\/li>\n<li>12-provider cascading email engine so alerts never get stuck on one quota<\/li>\n<li>Signed automatic updates<\/li>\n<li>Multilingual (21 languages)<\/li>\n<\/ul>\n\n<p>Learn more at <a href=\"https:\/\/novaheaven.io\/novascan\">novaheaven.io\/novascan<\/a>.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>novascan-lite<\/code> folder to <code>\/wp-content\/plugins\/<\/code>, or install via the WordPress plugin directory.<\/li>\n<li>Activate through the Plugins menu.<\/li>\n<li>Go to <strong>Nova Scan Lite<\/strong> in the admin menu.<\/li>\n<li>Click <strong>Start Scan<\/strong> or <strong>Check Core Files<\/strong>.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20slow%20down%20my%20site%3F\"><h3>Does this slow down my site?<\/h3><\/dt>\n<dd><p>No. Nova Scan Lite only runs in the WordPress admin, and only when you trigger a scan. It does nothing on the front end and adds no load to regular page requests.<\/p><\/dd>\n<dt id=\"what%20files%20does%20it%20scan%3F\"><h3>What files does it scan?<\/h3><\/dt>\n<dd><p>PHP files only (.php, .php3, .php4, .php5, .php7, .phtml, .phar) up to 4 MB each.<\/p><\/dd>\n<dt id=\"what%20is%20quarantine%3F\"><h3>What is quarantine?<\/h3><\/dt>\n<dd><p>Quarantining renames the file with a <code>.quarantine<\/code> extension so PHP cannot execute it. The file is not deleted \u2014 you can review it or restore it manually via SFTP.<\/p><\/dd>\n<dt id=\"does%20nova%20scan%20lite%20phone%20home%20or%20collect%20data%3F\"><h3>Does Nova Scan Lite phone home or collect data?<\/h3><\/dt>\n<dd><p>No. Nova Scan Lite does not send any site content, file data, scan results, or user information to Nova Heaven or anywhere else. The only outbound request is to the official WordPress.org checksums API, used only to verify WordPress core files against known-good hashes when you click \"Check Core Files\". See the \"External services\" section above for full details.<\/p><\/dd>\n<dt id=\"what%20is%20nova%20scan%20pro%3F\"><h3>What is Nova Scan Pro?<\/h3><\/dt>\n<dd><p>Nova Scan Pro is the full edition with a Web Application Firewall, database scanner, CVE intelligence and virtual patching, Frontend Shield cross-domain monitor, and 20+ more features. It is also free (included with a free Nova Heaven account). Nova Scan Pro replaces Lite \u2014 they are not designed to run side by side. See the \"Nova Scan Pro\" tab inside the plugin for a full feature comparison.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.8<\/h4>\n\n<ul>\n<li>Tested against WordPress 7.1. Without this the plugin does not appear in\ndirectory searches at all.<\/li>\n<li>Scans no longer contact the WordPress.org checksums API. That request happens\nonly when you press \"Check Core Files\", exactly as the External services\nsection of this readme describes. Version 1.0.7 called it during scans as\nwell, which made that description untrue. Scans now reuse the result of a\ncore check you have already run, and if you have not run one, every file is\nscanned as before.<\/li>\n<li>Fixed a template variable that shadowed a WordPress global on the scan history\nscreen.<\/li>\n<\/ul>\n\n<h4>1.0.7<\/h4>\n\n<ul>\n<li>Fixed \u2014 a scan of a completely clean WordPress still reported dozens of\nthreats in WordPress's own files, ten of them critical, each with a Quarantine\nbutton beside it. Acting on those would have damaged a healthy site. Core\nfiles are now verified against the official WordPress checksums and skipped\nonly when they match byte for byte. Measured on an official WordPress 7.1\ninstall: 84 findings before, none after.<\/li>\n<li>This cannot be used to hide anything. A core file with even one byte changed\nno longer matches its checksum, so it is scanned like any other file, and a\nfile that is not part of WordPress is never skipped at all. If the checksums\ncannot be reached, every file is scanned exactly as before.<\/li>\n<\/ul>\n\n<h4>1.0.6<\/h4>\n\n<ul>\n<li>Fixed \u2014 the scanner reported large numbers of threats in WordPress's own core\nfiles on a perfectly clean site. The backtick-execution rule was matching\nparameter names written inside code comments, which WordPress uses throughout\nits documentation. Measured against an official WordPress 7.1 download, this\nremoves 249 of 258 critical false positives.<\/li>\n<li>Improved detection \u2014 added a rule for chained decoders, the pattern where two\ndecode calls are nested inside one another. This catches a family of droppers\nthe previous rules missed because they only looked for eval(). Detection on a\n3,799-sample malware set rose from 50.4% to 51.2%.<\/li>\n<\/ul>\n\n<h4>1.0.5<\/h4>\n\n<ul>\n<li>Fixed: the admin screen left a white band below the plugin content, because the dark background was painted on the content column only and not on the containers behind it or the WordPress footer.<\/li>\n<\/ul>\n\n<h4>1.0.4<\/h4>\n\n<ul>\n<li>Fixed: the scan, integrity check, quarantine and clear-history buttons did nothing. The AJAX actions registered in PHP did not match the names the admin script requested, and the script's configuration object was published under a different name than the one it read.<\/li>\n<li>Renamed the remaining 3-character <code>nsl_<\/code> AJAX action names to the plugin's <code>novascli_<\/code> prefix.<\/li>\n<li>Paths are now resolved and normalised before use, so the scanner works on installs reached through a symlinked document root and on Windows.<\/li>\n<li>Escaped all admin output and made the \"already running the full NovaScan\" notice translatable.<\/li>\n<li>Added .distignore so <code>wp dist-archive<\/code> excludes development files, matching what <code>make zip<\/code> already did.<\/li>\n<li>Converted the two upgrade screenshots from WebP to PNG so the plugin ships only file types on the WordPress.org permitted list.<\/li>\n<li>Fixed: clicking a tab hid every panel, so the Nova Scan Pro page could not be opened. The tab strip read a data attribute the markup does not set.<\/li>\n<li>Scan results and scan history moved to their own Results tab, keeping the Scanner page to the controls and the summary. A finished scan now lands there, and the tab carries a count of open findings.<\/li>\n<li>Replaced the admin menu icon so it renders in the sidebar's own colour instead of a faded blue, and the page header now uses the full Nova Scan mark.<\/li>\n<\/ul>\n\n<h4>1.0.2<\/h4>\n\n<ul>\n<li>Renamed internal identifiers from the 3-character <code>NSL_<\/code> prefix to the 8-character <code>NOVASCLI_<\/code> prefix to meet WordPress.org prefix-uniqueness guidelines.<\/li>\n<li>Documented the WordPress.org core checksums API usage in the \"External services\" section of this readme.<\/li>\n<li>Corrected the readme Contributors field to list the plugin's WordPress.org owner account.<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>New: dedicated \"Nova Scan Pro\" feature tab with screenshots and comparison table.<\/li>\n<li>Improved: full-bleed dark theme scoped to the plugin pages (no impact on the rest of wp-admin).<\/li>\n<li>Improved: tabbed navigation between the Scanner and Pro feature pages.<\/li>\n<li>Cleanup: removed duplicate upsell banners from the Scanner page.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release. Signature-based PHP scanner with 30+ rules, WordPress core integrity check, quarantine, and scan history.<\/li>\n<\/ul>","raw_excerpt":"Lightweight WordPress malware scanner. Detects PHP backdoors, webshells, and injections with signature-based detection and core file integrity checks.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/299562","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=299562"}],"author":[{"embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/sephx"}],"wp:attachment":[{"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=299562"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=299562"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=299562"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=299562"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=299562"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=299562"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}