Scanning for compromise: what a scan can and cannot find
A scanner finds what it has seen before. The interesting compromises are the ones it has not.
What a scanner actually does
A scanner compares what it finds against patterns it already knows: known malicious code, known suspicious functions, known bad file locations. It is genuinely useful, and its limits follow directly from that description.
A clean result means the scanner did not recognise anything. It does not mean nothing is there.
What scanning finds and misses
| Category | Typically found | Typically missed |
|---|---|---|
| Known malicious files | Yes | — |
| Injected code in themes or plugins | Often | Heavily obfuscated variants |
| Backdoor in a legitimate file | Sometimes | Small, subtle edits |
| Stolen credentials in use | No | It looks like a normal login |
| Misconfiguration | No | Not what a malware scanner does |
| Data being exfiltrated | No | Needs network-level visibility |
File integrity monitoring adds something different
Rather than asking whether a file matches a known bad pattern, integrity monitoring asks whether a file changed when nobody deployed anything. That question catches a category the pattern approach cannot: novel code that no scanner has seen.
It requires knowing what the files are supposed to look like, which in turn requires deployments to be predictable. That prerequisite is the real work.
Before an incident, not during
- Know where the backups are and confirm a restore actually works. Untested backups are assumptions.
- Know who to call: host, developer, and someone qualified on notification duties if personal data is involved.
- Keep logs long enough to reconstruct what happened. Short retention makes investigation impossible.
- Write down the first three steps so nobody improvises at two in the morning.
- Know what data the system holds. It determines the legal obligations and their deadlines.
If something is found
Cleaning the visible files is the least important part and the part people do first. The questions that matter are how access was obtained, whether it still exists, and what was reachable from there. A site cleaned without answering those is usually compromised again within weeks.
This is work for someone qualified, with access to the system and its logs. It is not work a general text can do, and this one is not attempting to.