WordPress Progressive Scanner: Integrity, Server Limits, False Positives and Allowlist

Purpose of the article

This guide explains in detail the progressive scan performed by the Securantis agent on WordPress/WooCommerce sites: which checks are performed (core integrity, plugins, themes, suspicious files), how the engine adapts to server limits, how to interpret and handle false positives, and how to use the allowlist securely.

Audience and prerequisites

• Intended for WordPress administrators and technical teams using the Securantis agent.
• WordPress administrator access to start, resume or cancel a progressive scan.
• Basic hosting knowledge (access to PHP/server logs) is useful for troubleshooting.

Overview of how it works

• Progressive scan: the agent splits the analysis into tasks (jobs) and runs incremental workers. This reduces per-request load and allows a scan to resume after an interruption (e.g. WP‑Cron failure, browser closed).
• Checks performed: hardening checks (HTTPS, PHP versions, WordPress/plugins/themes updates, debug mode, file editor), WooCommerce-specific security, security header checks, presence of a default administrator account, sensitive files, search for PHP in uploads (if enabled), and WordPress core integrity (if enabled).
• Signal detection: the engine flags common patterns (file names frequently used by backdoors, potentially dangerous functions combined with HTTP inputs, executable content in uploads, etc.). Each signal is accompanied by a severity level.

Important settings and cautious configuration

• Configurable activations: analysis of uploads and core integrity verification can be enabled or disabled. Enable them if you have sufficiently permissive hosting and appropriate PHP execution time.
• Execution time and granularity: the progressive scan reduces load by limiting work per iteration. If your workers timeout, increase PHP execution limits or reduce batch size via hosting settings rather than disabling critical checks.
• Large files and paths: protections prevent analysis of abnormal paths (very long or non-normalized paths). Respect the standard WordPress structure and avoid extreme paths (> 1500 characters) that prevent normalization.

Integrity detection

• Core integrity: when enabled, the scan compares sensitive files and flags potential alterations. An integrity check must be followed by a manual review; do not restore or delete a file automatically without human decision.
• Exclusions and agent safety: the agent avoids analyzing its own code and certain known system files to reduce false positives.

False positives: why they occur and how to handle them

Why they occur

• Generic patterns: some PHP functions (account creation, authentication modification) are legitimate in custom plugins and can trigger alerts if used together with HTTP inputs.
• Common file names: historically abused names can also exist for legitimate reasons (migration, compatibility).
• Custom plugin/theme files: obfuscated code or code generated automatically by theme builders can resemble malicious code.

Recommended steps for each alert

1. Read the description and severity provided by the scan.
2. Identify the component involved (core, plugin, theme, uploads).
3. Back up the reported file before making any changes.
4. Inspect the content locally: look for malicious patterns (dynamic evaluations, injections, eval/base64_decode functions associated with external inputs).
5. If the alert comes from a known plugin/theme, check official updates or vendor support.
6. If you confirm it is a false positive: add the item to the allowlist via the secure Securantis mechanism (see next section).
7. If you suspect an infection: isolate (maintenance mode, restrict access), perform a full backup, manually quarantine and, if necessary, restore from a clean backup. Do not let the agent delete files automatically.

Allowlist — principles and best practices

• Purpose: explicitly allow known and verified files or patterns to avoid repeated alerts.
• Access and security: add to the allowlist only files whose content and origin you have verified. Every allowed entry should be documented (who, why, date).
• Scope: prefer precise allowances (exact path, file signature) rather than global rules. Avoid allowing entire directories unless necessary.
• Revocation: implement periodic review of allowlist entries, especially after plugin/theme updates.

Behavior regarding server limits (timeouts, memory)

• Automatic resume: the progressive scan is designed to resume after interruptions (for example if WP‑Cron is interrupted or the browser is closed).
• If workers regularly fail: 1) check PHP/server logs for timeouts and memory errors; 2) increase PHP execution time and memory if possible; 3) reduce per-worker load (hosting configuration); 4) run a scan during off-peak hours.
• Skipped files: some files may be ignored if their real path falls outside the expected perimeter (protection against directory traversal). These files are counted and reported.

Common errors and troubleshooting

• Scan not progressing: verify that the job exists and is in status "running". If the job is interrupted, use the option to continue or restart a new scan. Check WP‑Cron or scheduled hooks configuration.
• Worker returning a critical error: consult PHP error logs and agent logs, increase resources or run workers via CLI if possible.
• Recurring false positives: check if the file is generated dynamically by a plugin/theme; if so, add a targeted rule in the allowlist after verification.
• Non-normalized or too-long paths: rename or move the files out of the site if possible, or fix their generation by the plugin that creates them.

Precautions and responsibilities

• No automatic deletion: Securantis does not automatically delete or restore suspicious files. Quarantine, deletion and restoration require human action after verification.
• Backups: always perform a full backup before any corrective operation.
• Sharing access: never share passwords by email or chat. Access for a paid intervention is provided only via the secure client area after payment.

When to contact Securantis support

Contact support if:

• you observe a high-severity alert whose legitimacy you cannot confirm;
• the scan consistently fails with server errors despite resource adjustments;
• you suspect an active compromise and need help with analysis and quarantine;
• you need assistance configuring a safe and limited allowlist rule.

In your request, provide: job status, alert description, copy of the server error message (without passwords), actions already attempted and, if possible, a backup of the reported file. Support will indicate next steps and, if necessary, terms for a paid intervention.

Summary and quick best practices

• Use the progressive scan to limit server impact; do not disable critical default checks.
• Manually verify any significant signal and keep a backup before making changes.
• Add to the allowlist only verified and documented items; review these entries regularly.
• Adjust PHP resources (execution time, memory) if workers reach limits.
• Contact Securantis support for any unresolved critical alert or for investigative assistance.

This article helps you interpret progressive scan results and respond safely without destructive automation. If you need assistance analyzing a specific file, follow the contact procedure described below.