WPSniffer

WPSniffer is a command-line malware scanner for WordPress and PHP sites that uses free, community-maintained YARA rules, scanned with a YARA-X engine.

It has a multi-process scanner, file filters, several report formats (CSV, TSV, line-delimited, null-delimited and human-readable), email reports and a progress display. It needs no license key or account.

Website: https://wpsniffer.com

See NOTICE for the project's origin and licensing details.

Installation

Requires Python 3.8 or later. Install from PyPI into a virtual environment:

python3 -m venv ~/wpsniffer
~/wpsniffer/bin/pip install wpsniffer
~/wpsniffer/bin/wpsniffer version

Every release is also published as a wheel and source archive on the GitHub releases page. Bug reports and feature requests go to the issue tracker there.

From a checkout of this repository:

python3 -m venv .venv
.venv/bin/pip install .
.venv/bin/wpsniffer version

Rules

By default, WPSniffer downloads the YARA Forge core package (about 5,000 rules, including the signature-base PHP webshell rules), caches it in ~/.cache/wpsniffer, and checks for a new release once a day. If the download fails, the cached copy is used.

Rules from --rules files are compiled in a namespace named after the file, so they are reported as filename:RULE_NAME. Rules that fail to compile are skipped with a warning (--debug shows the errors); the rest are still used.

Compiled rules are cached, so later scans skip compilation. Use --pre-compile to download and compile rules without scanning, for example right after an update in a cron job.

Usage

Scan a WordPress install:

wpsniffer malware-scan /var/www/html

Report every matching rule, with rule metadata, to a CSV file:

wpsniffer malware-scan --match-all --output-path results.csv \
    --output-columns filename,signature_id,signature_description,rule_score,rule_author,rule_reference,matched_text \
    /var/www/html

Use your own rules together with YARA Forge:

wpsniffer malware-scan --rules /etc/wpsniffer/rules --yara-forge core /var/www/html

Scan files changed in the last hour:

find /var/www -cmin -60 -type f -print0 | wpsniffer malware-scan

Run wpsniffer malware-scan --help for all options.

Report columns

filename, signature_id (rule name), signature_name, signature_description, matched_text (first matched string, up to 256 bytes), rule_author, rule_reference, rule_score, rule_tags.

Scheduled scans

malware-scan reads extra paths from standard input when it is not a terminal. Under schedulers or CI systems that leave standard input open, pass --no-read-stdin (or redirect < /dev/null) so the scan does not wait for input.

Scanning behavior

• Rules come from YARA Forge and/or local files.
• Each file is scanned as a whole (up to --scanned-content-limit, 50 MiB by default), so YARA conditions such as filesize work and matches are not missed at chunk boundaries.
• --scan-timeout limits the time per file (default 10 seconds).
• Available subcommands: malware-scan, count-sites, configure, help and version.
• Configuration lives in ~/.config/wpsniffer/wpsniffer.ini (or /etc/wpsniffer/wpsniffer.ini) and the cache in ~/.cache/wpsniffer.

Development

.venv/bin/pip install -e . pytest flake8
.venv/bin/python -m pytest wpsniffer
.venv/bin/python -m flake8 wpsniffer

License

GPLv3. See LICENSE and NOTICE.