From version 2.0.0, the free WordPress plugin, now called Arva SEO – Speed Booster & Security Scanner, checks your website for signs of trouble. Arva SEO also checks the versions of WordPress, plugins and themes you have installed against known vulnerabilities. Both are included on every plan, Free too.
The security scan
In WordPress, open Arva SEO → Health. The Security scan comes first: choose Scan now to run one. After that it runs every week; to stop that, untick Scan for security problems every week in Arva SEO → Settings.
The scan:
- compares WordPress’s own files, and plugins from WordPress.org, with their official copies
- looks for code where WordPress never puts it, such as PHP files in the uploads folder
- looks for patterns found in hacked websites, in every file that isn’t a verified official copy (themes, premium plugins and anything else)
- checks whether anyone on the internet can download private files (a .git folder, .env, debug.log, database backups), whether folders list their files, and settings that make an attack easier, such as file editing in the dashboard or an administrator called “admin”
- checks that the server’s PHP has its latest security fixes, and still gets them
- from version 2.7.0, records a fingerprint of every theme, must-use plugin and premium plugin file, and reports the ones that are new or changed since
- from version 2.7.0, lists the scripts your pages load from other websites, so Arva SEO can check the ones that aren’t well-known services
It runs on your own server, in small batches in the background, so visitors don’t notice it. It never changes a file by itself: you choose each repair (below).
Read the results
Findings are grouped into Known vulnerabilities, Found by the deep scan, Suspicious code, Changed since the last scan, Changed files, Files that shouldn’t be there, Exposed files and Settings, and each is marked Critical, High, Medium or Low. Each one says what it means and what to do. For suspicious code, See the code it matched shows the line.
If a finding is something you know about, such as a premium plugin that hides its code or a file your host added, choose This is expected. Later scans leave it out until the file changes, and Show again brings it back.
A few things that look like a hack aren’t reported, because well-known plugins add them on purpose: the firewall of Wordfence, All In One WP Security, MalCare or NinjaFirewall, which loads before WordPress, and plugin logs that stop on their first line so they can’t run.
A scan finds known signs of trouble; it can’t prove a site is clean. It isn’t a firewall and doesn’t remove malware, so keep WordPress, plugins and themes updated, and keep backups.
Changed since the last scan
WordPress.org can vouch for WordPress’s own files and for its plugins, but not for themes, child themes, premium plugins or must-use plugins. From version 2.7.0, the scan records a fingerprint of each of their PHP and JavaScript files the first time it sees them, and from then on reports any file that’s new or changed under Changed since the last scan.
- A change to a theme’s functions.php, header.php or footer.php, or to a must-use plugin, is High, and so is a change that adds code that loads a script, prints into every page or names another website. Other changes are Medium.
- For those riskiest files the scan keeps the last copy it saw, in your site’s own database, so the finding can show the lines that were added. Only the finding, with up to 10 added lines, is shared with Arva SEO, never the file.
- Updates don’t count: when WordPress updates a theme or plugin, or its version number changes, its files are recorded again quietly.
- A change stays reported until someone chooses This is expected. The file as it is then becomes the recorded copy.
A risky file that changes between weekly scans starts a scan the next day.
Changes in the dashboard’s file editor
From version 2.7.0, when someone saves a theme or plugin file with WordPress’s file editor (Appearance → Theme File Editor, or Plugins → Plugin File Editor), the plugin records who saved it, when, from which address and the lines added, and tells Arva SEO at once. Arva SEO emails the workspace’s owners and admins straight away. It’s part of the Security emails in your notification settings, on by default.
A stolen administrator password and the file editor is a common way in. If you don’t use the editor, choose Turn off the file editor under Settings in Arva SEO → Health.
Scripts from other websites
From version 2.7.0, the scan reads your homepage, latest post and latest page as a phone visitor would, and lists the scripts they load from other websites. For a host that isn’t a well-known service (Google, Meta, Cloudflare, HubSpot, Mailchimp and the like), Arva SEO checks once a week:
- how long ago its domain was registered: under 90 days is reported as A script from a domain registered N days ago
- whether it hides what it does: a script that sends visitors elsewhere or answers empty is reported as A script that hides what it does
- whether Google lists it as unsafe, reported as Critical
Hosts that pass all three aren’t reported. For an unfamiliar host, the scan also looks for where the script is added (a theme or plugin file and line, a setting, or a code snippet), so the finding can say what to remove. These checks are free on every plan.
Repairs
From version 2.2.0, some findings can be fixed from the plugin, by an administrator:
- Restore the official copy puts back a changed or missing WordPress file, or a changed file of a plugin from WordPress.org. The copy comes from WordPress.org for your version, and is used only when it matches WordPress.org’s checksum.
- Move to quarantine moves PHP in the uploads folder, code disguised as an image, or a PHP file WordPress doesn’t ship into wp-content/arvaseo-quarantine, where it can’t run.
- Turn off the file editor (2.7.0) adds
define( 'DISALLOW_FILE_EDIT', true );to wp-config.php, so nobody can change theme or plugin files from the dashboard, even with an administrator’s password.
Each repair can be undone for 30 days under Changes made here, unless the file changed again since. Your theme’s files are never moved (the site needs them): restore the theme from a fresh copy instead. Repairs aren’t offered where WordPress doesn’t allow file changes, or needs FTP details to make them.
Known vulnerabilities
Every day, Arva SEO reads Wordfence Intelligence’s database of vulnerabilities in WordPress, plugins and themes, and compares it with the versions your connected site has installed. When a version you use has a published security hole, it becomes a finding on the website’s WordPress page and in Website Health, and shows under Known vulnerabilities in the plugin. Each one says which version fixes it, when there is one, and links to the vulnerability’s record.
This uses the plugin list your site already shares, so it works as soon as the site is connected. After you update, the finding closes at the next health check: daily, or straight away with Check again now in Arva SEO → Health.
Share the scan’s results with Arva SEO
The scan’s own results stay in WordPress unless an administrator chooses to share them: tick Also share the security scan’s results when connecting, choose Share the results under the Security scan, or use Arva SEO → Diagnostics and data sharing. Arva SEO receives what each problem is, the file’s path inside the site and its fingerprint (SHA-256), never the files themselves. Shared results show in Website Health with what to do, and can go into tasks and client reports.
Deep scan
A file that isn’t an official copy, such as your theme or a premium plugin, can only be checked by pattern on your server. A deep scan checks those files further on Arva SEO’s servers, with ClamAV’s database of known malware and Arva SEO’s own rules.
- In WordPress, open Arva SEO → Health. Under Deep scan, choose Allow deep scans (the scan’s results need to be shared first).
- Choose Run a deep scan. If the last security scan is more than a day old, it runs first. The files are sent in the background, and the result shows a few minutes later.
- What it finds is listed under Found by the deep scan, with what it means and what to do, and appears in Website Health like the scan’s other results.
Only code files the security scan couldn’t match to an official copy are sent, 2 MB each and 50 MB in all at most. wp-config.php, .env files, logs, database exports, backups and media are never sent. The files are deleted as soon as the scan finishes; only each file’s fingerprint and what was found are kept, and files checked in the last few days aren’t sent again.
Each website gets 2 deep scans a month on Starter, 8 on Professional and 16 on Business. A top-up adds 10 on any plan, Free included, in Plan & billing, and they never expire. A deep scan that doesn’t finish isn’t counted. The website’s WordPress page shows how many are left.
It learns from other websites
From version 2.5.0, the plugin downloads Arva SEO’s security feed once a day, so the scan knows about new threats between plugin updates:
- Malware found on other websites. When a deep scan on any connected website finds known malware, every website’s security scan recognizes the same file from then on, without a deep scan of its own. It shows as Known malware under Suspicious code.
- Files checked by Arva SEO. When the same file is flagged on several websites, Arva SEO’s team checks it. A file that turns out to be safe, such as a premium plugin that hides its code, stops being reported on every website.
- PHP security releases. When PHP publishes security fixes, the scan says under Settings if your server’s PHP doesn’t have them yet, with the version to update to. Your host updates PHP; in most hosting panels you can choose a newer version yourself.
- New patterns that Arva SEO adds between plugin releases.
- Lines added to changed files (2.7.0). Lines that load a script, print into every page or hide code go to Arva SEO’s team. Ones that turn out to be malicious are looked for on every website from then on; ones that are safe, such as a line your host adds everywhere, stop being reported.
- What many websites mark as expected (2.7.0). When the same file is marked as expected on several websites, Arva SEO’s team checks it, so it can stop being reported everywhere.
- Script hosts (2.7.0). Hosts that many websites load scripts from, registered years ago and clean, become known by themselves. Hosts Arva SEO’s team confirms as bad are flagged on every website that loads them.
Files are recognized by their fingerprint (SHA-256). Shared scan results include the fingerprint of each flagged file, never the file, and Arva SEO keeps how many websites had a file, not which. Without a connection to Arva SEO, the scan uses what comes with the plugin.
In website audits
Every website audit also looks for signs of a hacked website, on any platform:
- Hidden links to spam: links to pills, casinos, loans or adult sites that visitors can’t see.
- Pages in Japanese your website didn’t make: the “Japanese keyword hack”, which fills Google with spam pages under your address.
- Visitors from Google are sent to another website: the audit opens your home page as if arriving from a Google search, and checks it isn’t redirected away.
- robots.txt contains website code: HTML or scripts inside robots.txt, which should hold only crawler rules. Hackers add them to hide links on your website’s address.
Each one says what to do on your website’s platform. On WordPress, start with the plugin’s security scan and a deep scan.
Alerts
When a known vulnerability or a shared scan result is Critical or High, the workspace owner and the person who connected the site get a notification, in Arva SEO and by email. Choose which notifications are emailed in Account → Email notifications (Security).
If something is found
- Start with Critical and High. Update anything with a known vulnerability; if there’s no fixed version yet, deactivate it until there is.
- For changed WordPress files, use Dashboard → Updates → Re-install version. For a changed plugin, reinstall the same version from WordPress.org.
- For suspicious code or files that shouldn’t be there, check where the file comes from. If nobody on your team put it there, delete it, restore from a clean backup if more files are affected, and change your WordPress, hosting and database passwords.
- Choose Scan again to check.
If you’re not sure, ask your developer or host before you delete anything.