Cleanr Engine 1.45 SHA-256 YARA site PHP: never read-only until Apply

11 Sep 2026

Why WP Cleanr never executes PHP from the site it scans

The WordPress tree on disk is hostile input. If the scanner includes version.php, it has become the target.

Plugins, uploads, and even “core” can contain whatever an attacker wrote. Cleanr Engine therefore reads files as bytes. Version and plugin headers are parsed as text with a size cap. The walk cannot leave the site root. Symlinks are not followed. A YARA or heuristic match is a row in the report, not a delete.

That is slower than “just run WordPress and see”. It is also the only way the product stays a scanner instead of a second infection path. Related: how it works, deep scan.

Ready to scan

Scan a public WordPress site in seconds

No account. No passwords. HTTP surface only. The engine never executes site PHP.