Title: Nova Scan Lite Author: SephX Published: August 21, 2026 Last modified: August 22, 2026 --- Search plugins ![](https://ps.w.org/novascan-lite/assets/banner-772x250.png?rev=3659306) ![](https://ps.w.org/novascan-lite/assets/icon-256x256.png?rev=3659306) # Nova Scan Lite By [SephX](https://profiles.wordpress.org/sephx/) [Download](https://downloads.wordpress.org/plugin/novascan-lite.1.0.8.zip) * [Details](https://test.wordpress.org/plugins/novascan-lite/#description) * [Reviews](https://test.wordpress.org/plugins/novascan-lite/#reviews) * [Installation](https://test.wordpress.org/plugins/novascan-lite/#installation) * [Development](https://test.wordpress.org/plugins/novascan-lite/#developers) [Support](https://wordpress.org/support/plugin/novascan-lite/) ## Description Nova Scan Lite is a free, lightweight malware scanner for WordPress. It checks your site for common PHP threats and verifies WordPress core file integrity — all running locally on your server during an admin session. **What it does** * Scans PHP files for backdoors, webshells, and RCE patterns * Verifies WordPress core files against official checksums * Flags modified or unexpected files in wp-admin/ and wp-includes/ * One-click quarantine to disable suspicious files without deleting * Chunked scanning (handles thousands of files without timeouts) * Full scan history with severity breakdowns **What it detects** * Backdoors & webshells (C99, r57, FilesMan, custom shells) * Remote code execution (eval + base64, preg_replace /e, create_function) * System command execution (system, shell_exec, passthru with user input) * Credential harvesting and wp_users dumps * File system abuse (remote file writes, 0777 chmod, wget/curl droppers) * Obfuscation patterns (long base64, chr/ord chains, hex encoding) * Modified WordPress core files **Privacy** Nova Scan Lite does not transmit any of your site’s content, file data, or user information anywhere. Scans run locally on your server. The only outbound request the plugin makes is to the official WordPress.org checksums API for core file integrity verification (see the “External services” section below). ### External services Nova Scan Lite uses one external service, provided by WordPress.org. **WordPress.org Core Checksums API** * What it is and what it is used for: The official WordPress.org API that returns known-good MD5 checksums for every file in a given WordPress core release. Nova Scan Lite uses it to verify that the installed WordPress core files have not been modified by malware or unauthorized users. * What data is sent and when: The request is triggered only when the site administrator clicks the “Check Core Files” button in the admin. The request sends only the currently-installed WordPress version string and the site’s locale (for example` version=7.0&locale=en_US`). No site URL, no user data, no file contents, and no database information is transmitted. * Terms and privacy: The API is operated by the WordPress Foundation. Its use is governed by the WordPress.org privacy policy (https://wordpress.org/about/privacy/). * Endpoint: https://api.wordpress.org/core/checksums/1.0/ No other outbound requests are made. No tracking, no telemetry, no phone home, no remote assets loaded. ### Upgrade to Nova Scan Pro Nova Scan Pro is also free (included with a free Nova Heaven account). It replaces Lite and adds: * Web Application Firewall with brute-force and XML-RPC protection * Database payload scanner * Vulnerability (CVE) intelligence and virtual patching * Repository integrity check, file modification monitoring, tamper-proof canaries * Mass-reinfection velocity alerts, cron job scanner, rogue admin detection * Obfuscation / encoding detection and behavioral pattern analysis * Security score, threat dashboard, one-click hardening, security headers * Allowlist management, scheduled scans, email alerts * Frontend Shield monitor (cross-domain, catches skimmers and injected scripts) * 12-provider cascading email engine so alerts never get stuck on one quota * Signed automatic updates * Multilingual (21 languages) Learn more at [novaheaven.io/novascan](https://novaheaven.io/novascan). ## Installation 1. Upload the `novascan-lite` folder to `/wp-content/plugins/`, or install via the WordPress plugin directory. 2. Activate through the Plugins menu. 3. Go to **Nova Scan Lite** in the admin menu. 4. Click **Start Scan** or **Check Core Files**. ## FAQ ### Does this slow down my site? No. Nova Scan Lite only runs in the WordPress admin, and only when you trigger a scan. It does nothing on the front end and adds no load to regular page requests. ### What files does it scan? PHP files only (.php, .php3, .php4, .php5, .php7, .phtml, .phar) up to 4 MB each. ### What is quarantine? Quarantining renames the file with a `.quarantine` extension so PHP cannot execute it. The file is not deleted — you can review it or restore it manually via SFTP. ### Does Nova Scan Lite phone home or collect data? No. Nova Scan Lite does not send any site content, file data, scan results, or user information to Nova Heaven or anywhere else. The only outbound request is to the official WordPress.org checksums API, used only to verify WordPress core files against known-good hashes when you click “Check Core Files”. See the “External services” section above for full details. ### What is Nova Scan Pro? Nova Scan Pro is the full edition with a Web Application Firewall, database scanner, CVE intelligence and virtual patching, Frontend Shield cross-domain monitor, and 20+ more features. It is also free (included with a free Nova Heaven account). Nova Scan Pro replaces Lite — they are not designed to run side by side. See the “Nova Scan Pro” tab inside the plugin for a full feature comparison. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Nova Scan Lite” is open source software. The following people have contributed to this plugin. Contributors * [ SephX ](https://profiles.wordpress.org/sephx/) “Nova Scan Lite” has been translated into 1 locale. Thank you to [the translators](https://translate.wordpress.org/projects/wp-plugins/novascan-lite/contributors) for their contributions. [Translate “Nova Scan Lite” into your language.](https://translate.wordpress.org/projects/wp-plugins/novascan-lite) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/novascan-lite/), check out the [SVN repository](https://plugins.svn.wordpress.org/novascan-lite/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/novascan-lite/) by [RSS](https://plugins.trac.wordpress.org/log/novascan-lite/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.8 * Tested against WordPress 7.1. Without this the plugin does not appear in directory searches at all. * Scans no longer contact the WordPress.org checksums API. That request happens only when you press “Check Core Files”, exactly as the External services section of this readme describes. Version 1.0.7 called it during scans as well, which made that description untrue. Scans now reuse the result of a core check you have already run, and if you have not run one, every file is scanned as before. * Fixed a template variable that shadowed a WordPress global on the scan history screen. #### 1.0.7 * Fixed — a scan of a completely clean WordPress still reported dozens of threats in WordPress’s own files, ten of them critical, each with a Quarantine button beside it. Acting on those would have damaged a healthy site. Core files are now verified against the official WordPress checksums and skipped only when they match byte for byte. Measured on an official WordPress 7.1 install: 84 findings before, none after. * This cannot be used to hide anything. A core file with even one byte changed no longer matches its checksum, so it is scanned like any other file, and a file that is not part of WordPress is never skipped at all. If the checksums cannot be reached, every file is scanned exactly as before. #### 1.0.6 * Fixed — the scanner reported large numbers of threats in WordPress’s own core files on a perfectly clean site. The backtick-execution rule was matching parameter names written inside code comments, which WordPress uses throughout its documentation. Measured against an official WordPress 7.1 download, this removes 249 of 258 critical false positives. * Improved detection — added a rule for chained decoders, the pattern where two decode calls are nested inside one another. This catches a family of droppers the previous rules missed because they only looked for eval(). Detection on a 3,799-sample malware set rose from 50.4% to 51.2%. #### 1.0.5 * Fixed: the admin screen left a white band below the plugin content, because the dark background was painted on the content column only and not on the containers behind it or the WordPress footer. #### 1.0.4 * Fixed: the scan, integrity check, quarantine and clear-history buttons did nothing. The AJAX actions registered in PHP did not match the names the admin script requested, and the script’s configuration object was published under a different name than the one it read. * Renamed the remaining 3-character `nsl_` AJAX action names to the plugin’s `novascli_` prefix. * Paths are now resolved and normalised before use, so the scanner works on installs reached through a symlinked document root and on Windows. * Escaped all admin output and made the “already running the full NovaScan” notice translatable. * Added .distignore so `wp dist-archive` excludes development files, matching what` make zip` already did. * Converted the two upgrade screenshots from WebP to PNG so the plugin ships only file types on the WordPress.org permitted list. * Fixed: clicking a tab hid every panel, so the Nova Scan Pro page could not be opened. The tab strip read a data attribute the markup does not set. * Scan results and scan history moved to their own Results tab, keeping the Scanner page to the controls and the summary. A finished scan now lands there, and the tab carries a count of open findings. * Replaced the admin menu icon so it renders in the sidebar’s own colour instead of a faded blue, and the page header now uses the full Nova Scan mark. #### 1.0.2 * Renamed internal identifiers from the 3-character `NSL_` prefix to the 8-character` NOVASCLI_` prefix to meet WordPress.org prefix-uniqueness guidelines. * Documented the WordPress.org core checksums API usage in the “External services” section of this readme. * Corrected the readme Contributors field to list the plugin’s WordPress.org owner account. #### 1.0.1 * New: dedicated “Nova Scan Pro” feature tab with screenshots and comparison table. * Improved: full-bleed dark theme scoped to the plugin pages (no impact on the rest of wp-admin). * Improved: tabbed navigation between the Scanner and Pro feature pages. * Cleanup: removed duplicate upsell banners from the Scanner page. #### 1.0.0 * Initial release. Signature-based PHP scanner with 30+ rules, WordPress core integrity check, quarantine, and scan history. ## Meta * Version **1.0.8** * Last updated **7 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.1** * PHP version ** 7.4 or higher ** * Languages * [English (UK)](https://en-gb.wordpress.org/plugins/novascan-lite/) and [English (US)](https://wordpress.org/plugins/novascan-lite/). * [Translate into your language](https://translate.wordpress.org/projects/wp-plugins/novascan-lite) * Tags * [backdoor](https://test.wordpress.org/plugins/tags/backdoor/)[File Integrity](https://test.wordpress.org/plugins/tags/file-integrity/) [malware scanner](https://test.wordpress.org/plugins/tags/malware-scanner/)[security](https://test.wordpress.org/plugins/tags/security/) * [Advanced View](https://test.wordpress.org/plugins/novascan-lite/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/novascan-lite/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/novascan-lite/reviews/) ## Contributors * [ SephX ](https://profiles.wordpress.org/sephx/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/novascan-lite/)