# advision-development/wordpress-malware-quick-scan architecture

> Architecture diagram of the GitHub repository advision-development/wordpress-malware-quick-scan, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/advision-development/wordpress-malware-quick-scan
- Repository: https://github.com/advision-development/wordpress-malware-quick-scan

## Overview

WordPress Malware Quick Scan is a read-only malware and integrity scanner with carefully gated, person-triggered actions for reported targets. Its main workflow is an administrator starting a scan, reviewing findings and coverage, then optionally taking an explicitly offered action. The README documents the scan phases and campaign refresh; sampled excerpts show guarded AJAX handling, report construction concepts and plugin bootstrap hooks. Detailed wiring among unsampled scanner modules is not inferred.

Main entry points: [`wordpress-malware-quick-scan/includes/class-scan-runner.php`](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-scan-runner.php) (Scan runner), [`wordpress-malware-quick-scan/includes/class-actions.php`](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-actions.php) (Reported-target actions), [`wordpress-malware-quick-scan/includes/class-admin-page.php`](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-admin-page.php) (Admin screen), [`wordpress-malware-quick-scan/includes/class-ajax-controller.php`](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-ajax-controller.php) (AJAX controller)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_scan["Scanning and detection"]
  node_runner["Scan runner"]
  node_state["Scan state"]
  node_budget["Scan budget<br/>[class-budget.php]"]
  node_core_scan["Core integrity"]
  node_file_scan["File inspection"]
  node_walker["File traversal"]
  node_directory["Directory checks"]
  node_rules["Suspicious rules"]
  node_db_scan["Database audit"]
  node_options_scan["Options audit"]
  node_hijack["Hijack checks"]
  node_persistence["Persistence checks"]
end

subgraph group_report["Reports and administration"]
  node_admin_page["Admin screen"]
  node_ajax["AJAX controller"]
  node_finding["Finding catalog<br/>[class-finding.php]"]
  node_coverage["Coverage summary<br/>[class-coverage.php]"]
  node_report_data["Report builder<br/>[class-report.php]"]
end

subgraph group_actions["Manual response"]
  node_actions["Reported-target actions<br/>[class-actions.php]"]
  node_quarantine[("Quarantine store")]
  node_account_suspend["Account suspension"]
  node_archive["Plugin archive"]
end

subgraph group_operations["Scheduling and fleet"]
  node_cron["Scheduled scans<br/>[class-cron.php]"]
  node_settings["Scan settings<br/>[class-settings.php]"]
  node_mailer["Report email<br/>[class-mailer.php]"]
  node_fleet["Fleet coordination<br/>[class-fleet.php]"]
  node_fleet_panel["Fleet panel"]
  node_fleet_verify["Site verification"]
  node_updater["Plugin updater<br/>[class-updater.php]"]
end

subgraph group_intel["Campaign intelligence"]
  node_ioc["Indicator validation<br/>[class-ioc.php]"]
  node_csv_pack["Campaign pack<br/>[class-csv-pack.php]"]
  node_threat_intel["Campaign intelligence"]
  node_campaign_csv["Campaign indicators<br/>[campaigns.csv]"]
  node_ioc_prompt["Research prompt"]
end

node_admin(("Administrator"))

node_admin -->|"opens"| node_admin_page
node_admin_page -->|"starts scan"| node_ajax
node_ajax -->|"requests scan"| node_runner
node_runner -.->|"runs phase"| node_core_scan
node_runner -.->|"runs phase"| node_file_scan
node_runner -.->|"runs phase"| node_db_scan
node_file_scan -.->|"traverses files"| node_walker
node_file_scan -.->|"checks patterns"| node_rules
node_runner -.->|"builds report"| node_report_data
node_report_data -.->|"formats findings"| node_finding
node_report_data -.->|"records coverage"| node_coverage
node_admin_page -->|"presents report"| node_report_data
node_admin -->|"requests action"| node_ajax
node_ajax -->|"dispatches action"| node_actions
node_actions -.->|"uses quarantine"| node_quarantine
node_actions -.->|"suspends account"| node_account_suspend
node_actions -.->|"packages plugin"| node_archive
node_cron -.->|"schedules scan"| node_runner
node_settings -.->|"sets schedule"| node_cron
node_runner -.->|"emails report"| node_mailer
node_fleet_panel -.->|"manages fleet"| node_fleet
node_fleet -.->|"verifies site"| node_fleet_verify
node_ioc -->|"validates records"| node_csv_pack
node_campaign_csv -->|"supplies indicators"| node_threat_intel
node_threat_intel -->|"refreshes pack"| node_campaign_csv
node_ioc_prompt -.->|"offers research prompt"| node_admin_page

click node_admin_page "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-admin-page.php"
click node_ajax "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-ajax-controller.php"
click node_runner "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-scan-runner.php"
click node_state "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-scan-state.php"
click node_budget "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-budget.php"
click node_core_scan "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-core-scanner.php"
click node_file_scan "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-file-scanner.php"
click node_walker "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-file-walker.php"
click node_directory "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-directory-check.php"
click node_rules "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-suspicious-rules.php"
click node_db_scan "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-database-scanner.php"
click node_options_scan "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-options-scanner.php"
click node_hijack "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-hijack-check.php"
click node_persistence "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-persistence-check.php"
click node_finding "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-finding.php"
click node_coverage "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-coverage.php"
click node_report_data "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-report.php"
click node_actions "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-actions.php"
click node_quarantine "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-quarantine.php"
click node_account_suspend "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-account-suspend.php"
click node_archive "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-plugin-archive.php"
click node_cron "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-cron.php"
click node_settings "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-settings.php"
click node_mailer "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-mailer.php"
click node_fleet "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-fleet.php"
click node_fleet_panel "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-fleet-panel.php"
click node_fleet_verify "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-fleet-verify.php"
click node_updater "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-updater.php"
click node_ioc "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-ioc.php"
click node_csv_pack "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-csv-pack.php"
click node_threat_intel "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-threat-intel.php"
click node_campaign_csv "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/campaigns.csv"
click node_ioc_prompt "https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/tools/class-ioc-prompt.php"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_runner,node_state,node_budget,node_core_scan,node_file_scan,node_walker,node_directory,node_rules,node_db_scan,node_options_scan,node_hijack,node_persistence toneBlue
class node_admin_page,node_ajax,node_finding,node_coverage,node_report_data toneAmber
class node_actions,node_quarantine,node_account_suspend,node_archive toneMint
class node_cron,node_settings,node_mailer,node_fleet,node_fleet_panel,node_fleet_verify,node_updater toneRose
class node_ioc,node_csv_pack,node_threat_intel,node_campaign_csv,node_ioc_prompt,node_admin toneIndigo
```

## Components

### Scanning and detection

- [Scan runner](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-scan-runner.php): `wordpress-malware-quick-scan/includes/class-scan-runner.php`
- [Scan state](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-scan-state.php): `wordpress-malware-quick-scan/includes/class-scan-state.php`
- [Scan budget](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-budget.php): `wordpress-malware-quick-scan/includes/class-budget.php`
- [Core integrity](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-core-scanner.php): `wordpress-malware-quick-scan/includes/class-core-scanner.php`
- [File inspection](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-file-scanner.php): `wordpress-malware-quick-scan/includes/class-file-scanner.php`
- [File traversal](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-file-walker.php): `wordpress-malware-quick-scan/includes/class-file-walker.php`
- [Directory checks](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-directory-check.php): `wordpress-malware-quick-scan/includes/class-directory-check.php`
- [Suspicious rules](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-suspicious-rules.php): `wordpress-malware-quick-scan/includes/class-suspicious-rules.php`
- [Database audit](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-database-scanner.php): `wordpress-malware-quick-scan/includes/class-database-scanner.php`
- [Options audit](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-options-scanner.php): `wordpress-malware-quick-scan/includes/class-options-scanner.php`
- [Hijack checks](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-hijack-check.php): `wordpress-malware-quick-scan/includes/class-hijack-check.php`
- [Persistence checks](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-persistence-check.php): `wordpress-malware-quick-scan/includes/class-persistence-check.php`

### Reports and administration

- [Admin screen](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-admin-page.php): `wordpress-malware-quick-scan/includes/class-admin-page.php`
- [AJAX controller](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-ajax-controller.php): `wordpress-malware-quick-scan/includes/class-ajax-controller.php`
- [Finding catalog](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-finding.php): `wordpress-malware-quick-scan/includes/class-finding.php`
- [Coverage summary](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-coverage.php): `wordpress-malware-quick-scan/includes/class-coverage.php`
- [Report builder](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-report.php): `wordpress-malware-quick-scan/includes/class-report.php`

### Manual response

- [Reported-target actions](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-actions.php): `wordpress-malware-quick-scan/includes/class-actions.php`
- [Quarantine store](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-quarantine.php): `wordpress-malware-quick-scan/includes/class-quarantine.php`
- [Account suspension](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-account-suspend.php): `wordpress-malware-quick-scan/includes/class-account-suspend.php`
- [Plugin archive](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-plugin-archive.php): `wordpress-malware-quick-scan/includes/class-plugin-archive.php`

### Scheduling and fleet

- [Scheduled scans](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-cron.php): `wordpress-malware-quick-scan/includes/class-cron.php`
- [Scan settings](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-settings.php): `wordpress-malware-quick-scan/includes/class-settings.php`
- [Report email](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-mailer.php): `wordpress-malware-quick-scan/includes/class-mailer.php`
- [Fleet coordination](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-fleet.php): `wordpress-malware-quick-scan/includes/class-fleet.php`
- [Fleet panel](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-fleet-panel.php): `wordpress-malware-quick-scan/includes/class-fleet-panel.php`
- [Site verification](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-fleet-verify.php): `wordpress-malware-quick-scan/includes/class-fleet-verify.php`
- [Plugin updater](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-updater.php): `wordpress-malware-quick-scan/includes/class-updater.php`

### Campaign intelligence

- [Indicator validation](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-ioc.php): `wordpress-malware-quick-scan/includes/class-ioc.php`
- [Campaign pack](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-csv-pack.php): `wordpress-malware-quick-scan/includes/class-csv-pack.php`
- [Campaign intelligence](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/includes/class-threat-intel.php): `wordpress-malware-quick-scan/includes/class-threat-intel.php`
- [Campaign indicators](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/wordpress-malware-quick-scan/campaigns.csv): `wordpress-malware-quick-scan/campaigns.csv`
- [Research prompt](https://github.com/advision-development/wordpress-malware-quick-scan/blob/main/tools/class-ioc-prompt.php): `tools/class-ioc-prompt.php`

### Other components

- **Administrator**

## Connections

- Administrator → Admin screen: opens (evidence: `README.md`)
- Admin screen → AJAX controller: starts scan (evidence: `README.md`)
- AJAX controller → Scan runner: requests scan (evidence: `wordpress-malware-quick-scan/includes/class-ajax-controller.php`)
- Scan runner → Core integrity: runs phase
- Scan runner → File inspection: runs phase
- Scan runner → Database audit: runs phase
- File inspection → File traversal: traverses files
- File inspection → Suspicious rules: checks patterns
- Scan runner → Report builder: builds report
- Report builder → Finding catalog: formats findings
- Report builder → Coverage summary: records coverage
- Admin screen → Report builder: presents report (evidence: `README.md`)
- Administrator → AJAX controller: requests action (evidence: `README.md`)
- AJAX controller → Reported-target actions: dispatches action (evidence: `wordpress-malware-quick-scan/includes/class-ajax-controller.php`)
- Reported-target actions → Quarantine store: uses quarantine
- Reported-target actions → Account suspension: suspends account
- Reported-target actions → Plugin archive: packages plugin
- Scheduled scans → Scan runner: schedules scan
- Scan settings → Scheduled scans: sets schedule
- Scan runner → Report email: emails report
- Fleet panel → Fleet coordination: manages fleet
- Fleet coordination → Site verification: verifies site
- Indicator validation → Campaign pack: validates records
- Campaign indicators → Campaign intelligence: supplies indicators (evidence: `README.md`)
- Campaign intelligence → Campaign indicators: refreshes pack (evidence: `README.md`)
- Research prompt → Admin screen: offers research prompt