I m Chris. I ve spent 9+ years in cybersecurity and cleaned up more than 180 compromised WordPress sites in the last 12 months alone. Almost every one of those jobs started the same way: SSH into the server and figure out which files have been tampered with, fast.
That s why I built WPSniffer, an open-source, YARA-based malware scanner you run directly on the server from the command line. Think of it as a lightweight alternative to Wordfence CLI: no plugin to install inside a site that s already compromised, and it can sweep every WordPress install on the box in one pass.
We launch tomorrow, and before then I d love to hear from people who deal with this regularly:
WPSniffer is a free, open-source CLI that scans WordPress and PHP files for malware using ~5,000 community YARA rules from YARA Forge, powered by the YARA-X engine. Install with pip, run it over SSH, cron or CI, and get CSV, TSV, text or email reports. Multi-process, scans whole files up to 50 MiB, and supports your own .yar rules. No account, license key or telemetry: your files never leave your server. Built for freelancers, agencies and hosts cleaning up hacked sites.
