Yuga AntiMalware is an admin-focused plugin built to detect suspicious malware indicators and support remediation workflows on WordPress sites.<\/p>\n\n
Main capabilities:\n- Tabbed admin interface with left sidebar sections and right helper column.\n- Scan modes:\n - Quick scan (files in wp-content)\n - Targeted scan (plugins\/themes\/mu-plugins\/uploads\/root files)\n - Database scan\n - Frontend scan\n - Full scan (files + database + frontend)\n- Optional PHP max_execution_time override for scan execution.\n- Background scans in saved blocks, with automatic continuation and manual resume when needed.\n- Real scan progress: analyzed files, database rows, checked pages and completed modules, without a simulated percentage.\n- Automatic quick scans through WP-Cron (hourly, daily, or weekly).\n- Findings table with sorting, grouping, and file preview.\n- Findings actions: ignore, exclude path, quarantine, delete, copy path.\n- Reinfection Trace with database hot spots and writer candidates.\n- Writer Hunt for file-level suspect correlation.\n- Safe options cleanup workflow: backup + cleanup + restore rollback.\n- Content Cleanup for suspicious post\/page\/revision rows with filters by author, category, type, language\/script, and keyword.\n- Content cleanup actions with rollback backups, batch-based filtered trashing, and previous revision restore for posts\/pages.\n- Trash Cleanup for permanently removing WordPress trash items in backed-up batches.\n- Cache cleanup tools (targeted suspicious cache cleanup and full transient flush).\n- Post-hack plugin\/theme inventory with version checks and maintenance actions where supported.\n- Quarantine inventory viewer in admin.\n- Retention policy for quarantined files, applied from quarantine timestamp.\n- Email notifications via default WordPress mail settings.\n- Comment protection: optionally send new comments with explicit spam signals to the WordPress Spam folder before publication.\n- Comment Cleanup: review comments, trackbacks and pingbacks in batches of up to 1,000, then trash or permanently delete selected items.\n- Dedicated manual-review filters for all pending comments, external links and non-Latin letters in names or text.\n- Administrator-only JSON export of all comments, preserving original HTML links and moderation context.<\/p>\n\n
Root scans and the root module of Full Scan compare directly contained files\nwith the official checksums for the installed WordPress version and package\nlocale. Additional files are review findings, not proof of malware. Modified\ncore files are flagged separately. This does not verify all of wp-admin or\nwp-includes, detect missing files, or inspect extra directories.<\/p>\n\n
Local wp-config.php, .htaccess, .user.ini, robots.txt, web.config, php.ini and\n.maintenance are exempt from additional-file warnings, but remain subject to\napplicable content rules. Inventory includes all extensions; explicit path\nexclusions still apply. Unavailable manifests, excluded\/unreadable\/oversized\ncore files or interruption leave the verification incomplete.<\/p>\n\n
Configuration files .htaccess, .user.ini and php.ini are included in content\nscans within the selected scope, subject to configured exclusions and limits.\nChecks flag active automatic PHP loading directives, Apache Substitute script\nor iframe markup, and crawler-conditioned rewrites to PHP or external URLs.\nComments, empty\/none PHP loader settings, ordinary WordPress rewrites and\ncrawler blocking with an unchanged target are not flagged by these checks.\nLegitimate firewalls can use automatic loading: review before changing files.\nConfiguration findings are advisory; no directives are executed by the scanner.\nUse the pencil action on .htaccess or .user.ini findings for Configuration\nCleanup. Review the complete before\/after proposal and all removed lines;\nconfirming applies the whole proposal. Containers emptied by the proposal and\ntheir marker comments are removed. Unused rewrite-engine and substitution-filter\nlines are removed only when no remaining rule may depend on them. Independent\nsettings and the WordPress marker block are retained. Ambiguous sections, continued lines\nand chained\/skipping rewrite rules require manual review. The tool does not\nvalidate the configuration against your hosting server's active modules.<\/p>\n\n
Before applying, download the current file for recovery outside WordPress.\nEvery write, including a restore, requires a verified backup in the WordPress\ndatabase (not autoloaded), preserves file permissions, rechecks the preview\nhash, verifies written bytes and attempts rollback if writing fails. Backups\nare listed with download and restore-preview actions; they are removed on\nplugin uninstall. Failed rollback requires restoring through the hosting file\nmanager. Previews expire after 15 minutes. Successful file deletion and quarantine remove that target's stored findings.\nConfiguration cleanup and restore recheck the changed file, retain residual\nfindings and adjust counters. Failed verification leaves findings in place and\nshows a pending-verification message. A short history records successful file\nactions and verification outcomes. If the previous preview was truncated,\ncounters are marked approximate until a new scan provides exact totals.\nA full scan remains useful for reviewing the rest of the site.\nAn interrupted operation can leave its safety lock in place; an administrator\nmust verify that no operation is running before clearing that lock.<\/p>\n\n
Root integrity verification contacts the WordPress.org checksum API over HTTPS\nwhen a root scan runs, sending the installed WordPress version and package\nlocale. No file contents or local paths are uploaded. Successful manifests\nare cached locally for 24 hours. See https:\/\/wordpress.org\/about\/privacy\/\nand https:\/\/wordpress.org\/about\/terms-of-service\/.<\/p>\n\n
This plugin optionally integrates with PayPal Donate to facilitate donations. No PayPal resource is loaded until an administrator explicitly clicks the \"Donate with PayPal\" button on the plugin settings page.<\/p>\n\n
Payment transactions are handled by PayPal under its own terms and privacy policy.<\/p>\n\n
A pharmaceutical keyword alone does not trigger the pharmaceutical promotion\nrule. A listed term must occur near buying, discount, shipping or prescription-free\nsales wording in the same text segment (up to 100 intervening characters).\nThe rule recognizes selected English and Italian wording. It does not combine\nsignals across HTML tags, serialized\/JSON field delimiters, lines or sentences.\nResults are potential promotions for manual review, not proof of infection.\nNo links are opened and no stored values are deserialized or modified.<\/p>\n\n
Run a new scan after updating to replace older keyword-only findings. The\npreview explains when an old finding no longer matches the contextual rule.<\/p>\n\n
Open Yuga AntiMalware > Comment Cleanup to manage existing comments, configure\nprotection for new submissions, or download a review export. The tools support\nordinary comments, trackbacks and pingbacks. Product reviews and other custom\ncomment types are excluded from detection and cleanup.<\/p>\n\n
Dashboard > Overview shows the saved Comment protection status (Enabled or\nDisabled), with links to its settings and the WordPress Spam folder.<\/p>\n\n
Saving protection records before\/after counts for Pending, Approved, Spam and\nTrash, displayed with a UTC timestamp in Comment Cleanup for troubleshooting.\nThe counts describe that save, not current totals; concurrent moderation can\nalso affect them. No comment content is stored in this diagnostic record.<\/p>\n\n
Protection is optional and disabled by default. Enable \"Automatically mark new\ncomments with explicit spam signals as spam\" and save the setting.<\/p>\n\n
When enabled, strong medicine-purchase promotions, linked affiliate invitations,\nrepeated adult keywords with links, or combined opaque alphanumeric names,\nemails and long unbroken alphanumeric text receive WordPress Spam status.\nConsonant-heavy names with relay emails alone remain manual-review hints.<\/p>\n\n
After a new submission is successfully stored, protection can also move\nrelated pending comments with matching spam signals to Spam. Approved comments\nare left unchanged. Saving the setting itself does not move comments.\nDisabling stops automatic moderation without restoring previously moved\ncomments. No automatic Trash or deletion.<\/p>\n\n
Existing rejection, Spam or Trash decisions are preserved. Imports bypassing\nWordPress submission hooks do not trigger the automatic review. No external\nanti-spam service is contacted. Review WordPress > Comments > Spam for false\npositives and restore legitimate messages. Other tools may purge Spam.\nLanguage or external links alone never trigger automatic Spam.<\/p>\n\n
Choose one of the following views and select \"Analyze from the beginning\":<\/p>\n\n
Approved comments require explicit opt-in for potential-spam analysis. The\nthree manual-review filters show pending comments only, even if that opt-in is\nselected. Comments without a spam classification are identified as such.<\/p>\n\n
Each preview examines up to 1,000 comments, not 1,000 spam matches. Select\nindividual comments or all items in the preview, review the selection and\nconfirm the chosen action. Continue with \"Analyze next batch\" to examine the\nremaining comments. Start again to revisit skipped or unselected items.\nPreviews expire after 30 minutes; changed or unavailable comments are skipped.<\/p>\n\n
Manual cleanup offers two actions:<\/p>\n\n
Automatic protection and manual cleanup therefore have different destinations:\nautomatic detections go to Spam; manually trashed comments go to Trash.\nManual cleanup currently has no \"Mark as spam\" action. Use the WordPress\nComments screen to mark existing comments as Spam instead of trashing them.<\/p>\n\n
Review hints include linked-text-only comments, BBCode links (including unclosed\ntags), multiple links, executable HTML, explicit commercial pitches, repeated\nadult keywords, medicine promotions, contact-only comments and generic greetings\nor compliments accompanied by links. URLs with a domain and path are recognized\nwithout an HTTP scheme. HTML anchors retain their destination during analysis.<\/p>\n\n
Manual review also flags combinations of consonant-heavy names and long opaque\nemail identifiers. Combined alphanumeric names\/emails and long unbroken\nalphanumeric text also qualify for automatic protection when enabled. Relay addresses, long emails or pseudonyms\nalone are not sufficient. Display names advertising online medicines are\nalso flagged for review. Relay-email and advertising-name hints alone do not\ntrigger automatic Spam.<\/p>\n\n
Review also considers patterns across comments in the current preview batch.\nRelated evidence is rechecked before cleanup.<\/p>\n\n
Review hints can include legitimate references, advertising, quotations and\nshared networks. They do not prove an infection or guarantee spam detection.\nThe first 64 KB of each comment body are inspected; whole-body rules apply\nonly when the complete body is within that limit.<\/p>\n\n
The non-Latin filter checks visible names and text, excluding links and HTML\nattributes. It includes Cyrillic, Greek, Arabic and Asian scripts, but does not\nidentify language or nationality. Accented Latin letters and emoji alone do\nnot match. The external-links filter compares destinations in comment bodies\nand author websites with the public site's hostname, treating www as the same\nhostname. Other subdomains count as external; relative links and email addresses\nalone do not match. Destinations are never visited. Neither filter is a spam\nverdict, and no items are selected or removed automatically by these filters.<\/p>\n\n
\"Export all comments (JSON)\" downloads readable JSON with original HTML, text,\nauthor website, email, IP, date, status, article title, edit links and individual\nreview reasons. Cross-comment correlation and comment metadata are not included.\nThe export includes every status and type, including approved comments, Spam,\nTrash and custom types, independently of preview filters.<\/p>\n\n
The export requires administrator and moderation permissions. No public file\nis created. It contains personal data: store and share the download carefully.\nData is read in batches of 200 up to the highest ID at export start; concurrent\nedits or deletions can affect it, so it is not a database snapshot. Only valid\nJSON ending with complete=true represents a finished export. Retry interrupted\ndownloads.<\/p>\n\n
Dashboard and scheduled scans continue in blocks aiming for eight seconds or\nat most 100 work items per request. Each file, batch of ten database rows, or\nfrontend URL finishes before yielding. A slow individual operation can exceed\nthat target and hosting limits still apply. Results and pending work are saved\ntogether after each successful block.<\/p>\n\n
Progress shows confirmed file, database-row and page counts, the current area,\nand completed modules for Full scan. The activity bar is not an estimated\npercentage; counters update after each saved block without a preliminary file census.<\/p>\n\n
Keep the dashboard open for prompt continuation. With the page closed,\ncontinuation uses WP-Cron and depends on site traffic or an external cron\ntrigger. Interrupted requests retry from the last confirmed block. After three\nunsuccessful attempts, use Resume saved scan. Stop retains the checkpoint too.\nStarting a new scan replaces the previous saved scan.<\/p>\n\n
Cron wakeups are reused, with a separate watchdog for interrupted requests.\nPending one-shot events for completed or replaced jobs expire without scanning.\nIf scheduling fails, the progress display advises keeping the page open for\nAJAX continuation. Persistent database or WordPress cron problems still need\ninvestigation. The summary distinguishes recorded processing milliseconds\nfrom total elapsed time, including waits and manual pauses. Total time remains\nunavailable for older completed scans that have no recorded finish timestamp.<\/p>\n\n
The legacy scan time budget does not limit the total duration of these jobs.\nThe PHP execution-time override applies to individual requests, subject to\nhosting policy. A resumed scan uses its original settings; changes apply to a\nnew scan. Directory names are snapshotted when visited, so files added later\nmay require another scan. Directories with more than 20,000 entries stop with\nan explicit checkpoint-size error to prevent excessive checkpoint storage.<\/p>\n\n\n
\/wp-content\/plugins\/yuga-antimalware\/<\/code>.<\/li>\n- Activate the plugin in WordPress Plugins.<\/li>\n
- Open Yuga AntiMalware<\/strong> from the left admin menu.<\/li>\n<\/ol>\n\n\n
1.2.0<\/h4>\n\n\n- Added saved scan blocks with automatic continuation, interrupted-request recovery and manual resume when automatic attempts fail.<\/li>\n
- Replaced simulated scan percentages with confirmed counters, current module, elapsed time and time since the last saved progress.<\/li>\n
- Improved scan cron wakeup handling and distinguished processing duration from total elapsed scan time.<\/li>\n
- Added the saved comment-protection status and management links to Dashboard > Overview.<\/li>\n
- Added optional protection that marks new submissions with explicit spam signals as Spam before publication; disabled by default, with no automatic deletion.<\/li>\n
- Improved comment-protection performance with batched reads and fewer repeated queries, retaining checks for comments changed during processing.<\/li>\n
- Added combined opaque-name, email and alphanumeric-text detection to standard comment protection; relay-email and advertising-name hints remain available for manual review.<\/li>\n
- Expanded comment review rules for promotional messages, linked text, BBCode and repeated submissions, including trackbacks and pingbacks.<\/li>\n
- Added separate manual-review views for pending comments, external links and non-Latin text, without treating those filters as automatic spam verdicts.<\/li>\n
- Added a protected JSON export of all comments with original HTML links, author information, moderation state and individual review reasons.<\/li>\n
- Improved Comment Cleanup preview layout with proportional columns and wrapping for long text and URLs.<\/li>\n
- Updated stored findings after successful file actions and configuration rechecks, with action history and counter limitations.<\/li>\n
- Added guided configuration cleanup with before\/after review, mandatory backups, downloads and restore previews.<\/li>\n
- Added content checks for .htaccess, .user.ini and php.ini: automatic PHP loading, Apache script substitution and crawler-conditioned rewrites.<\/li>\n
- Fixed Unicode word boundaries for database pharma detection and stale preview highlighting; truly disabled unavailable file actions.<\/li>\n
- Reduced pharmaceutical false positives by requiring nearby purchase or promotional wording instead of a medicine keyword alone.<\/li>\n
- Added official package comparison for root files, including additional files and modified core files.<\/li>\n
- Added a review rule for LinkPool remote HTML PHP snippets, including renamed files, and self-deleting WordPress environment probes.<\/li>\n
- Added Ignored Findings with individual restore actions, including saved references absent from the latest scan.<\/li>\n
- Prevented file deletion, quarantine and path exclusions for database\/frontend findings, including mixed bulk selections.<\/li>\n
- Added Comment Cleanup with a preview of marked spam and potentially suspicious comments, trackbacks and pingbacks.<\/li>\n
- Added opt-in scanning of approved comments, per-comment reasons, selection of up to 1,000 comments and a choice between trash and confirmed permanent deletion.<\/li>\n
- Protected changed comments and expired previews; blocked the trash action when WordPress trash is disabled.<\/li>\n<\/ul>\n\n
1.1.2<\/h4>\n\n\n- Updated the plugin header with the new Yuga AntiMalware logo for dark backgrounds.<\/li>\n
- Added screenshot descriptions and refreshed the WordPress.org artwork.<\/li>\n<\/ul>\n\n
1.1.1<\/h4>\n\n\n- Lowered the minimum PHP requirement to 7.2 after compatibility regression testing.<\/li>\n
- Prevented file deletion when a required backup fails.<\/li>\n
- Verified quarantine copies and recovery metadata before removing originals; added checksum validation for new backups and explicit partial-failure notices.<\/li>\n
- Added WordPress 7.1 and PHP 7.4 compatibility fixes.<\/li>\n
- Changed PayPal integration so external resources load only after explicit administrator interaction.<\/li>\n
- Hardened backup and quarantine storage and made quarantined payloads non-executable by extension.<\/li>\n
- Added working WP-Cron scheduling for automatic quick scans.<\/li>\n
- Preserved modern WordPress option autoload values during backup restore.<\/li>\n
- Improved cleanup of plugin-owned data during uninstall.<\/li>\n
- Removed inactive signature-update and custom scan-path controls; scans continue to use the documented fixed scopes.<\/li>\n<\/ul>\n\n
1.1.0<\/h4>\n\n\n- Improved quarantine UX and lifecycle:<\/li>\n
- Added Quarantine > Stored Files inventory table.<\/li>\n
- Added event-driven retention purge scheduling based on quarantine insertion date.<\/li>\n
- Added writer-candidate quarantine action in Reinfection Trace with consistent icon-based actions.<\/li>\n
- UI refinements for Quarantine settings naming and table consistency.<\/li>\n
- Added Content Cleanup with filtered post\/page\/revision review, rollback backups, batch trash actions, previous revision restore, and Trash Cleanup.<\/li>\n<\/ul>\n\n
1.0.0<\/h4>\n\n\n- Introduced full security workflow:<\/li>\n
- Multi-mode scans (quick, targeted, database, frontend, full).<\/li>\n
- Background scan execution with runtime polling.<\/li>\n
- Reinfection Trace and Writer Hunt correlation.<\/li>\n
- Safe options maintenance (backup + cleanup + restore).<\/li>\n
- Cache cleanup tools (targeted + full transient flush).<\/li>\n
- Post-hack plugin\/theme inventory and recovery actions.<\/li>\n
- Email notifications via WordPress mail settings.<\/li>\n<\/ul>\n\n
0.8.0<\/h4>\n\n\n- Added targeted scope scanning for plugins, themes, mu-plugins, uploads, and WordPress root files.<\/li>\n
- Added frontend and database detection modules and integrated full scan aggregation.<\/li>\n
- Added scan findings table with actions and preview foundation.<\/li>\n<\/ul>\n\n
0.5.0<\/h4>\n\n\n- Added scan rules, exclusions, heuristic controls, scheduler and notification settings.<\/li>\n
- Added initial quick file scan engine on wp-content.<\/li>\n
- Added quarantine policy and file isolation hooks.<\/li>\n<\/ul>\n\n
0.1.0<\/h4>\n\n\n- Introduced anti-malware admin structure and plugin foundation.<\/li>\n<\/ul>","raw_excerpt":"WordPress anti-malware plugin with tabbed admin panel, multi-mode scanning, quarantine, cleanup tooling, and post-hack recovery checks.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/366104","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=366104"}],"author":[{"embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/yugaweb"}],"wp:attachment":[{"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=366104"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=366104"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=366104"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=366104"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=366104"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=366104"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}