- Bound the tree. Path traversal and symlinks that leave the root are skipped. Huge files hit
max_file_size. - Read as bytes.
version.phpand plugin headers are parsed as text with a size cap. Noinclude. - Hash and classify. SHA-256, optional MD5, class (core, plugin, theme, upload…).
- Score evidence. Integrity, YARA subset, heuristics, persistence, optional DB. False-positive verdicts can be marked; they stay in the report.
- Act only with Apply. Quarantine, replace, and harden are separate jobs. Connector cannot apply them.
sys / cleanr engine / 1.45
How Cleanr Engine scans WordPress
The site is an object, not a runtime. That decision is the product.
Five steps, then stop
Timeouts (15m scan, 30m job) and a cancelled context abort the whole scan. A single unreadable file does not.
- 01 Bound the tree Path jail. Symlinks that leave the root are skipped.
- 02 Read as bytes version.php and headers as text. No include or eval.
- 03 Hash and class SHA-256, optional MD5, core / plugin / theme / upload.
- 04 Score evidence Integrity, YARA, heuristics. A match does not delete.
- 05 Explicit Apply Quarantine, replace, and harden are separate jobs.
See the HTTP surface first
No account. No passwords. Not a filesystem malware scan.