Install the server agent

Updated 26 October 2026 · Prime Dev Force · agent 0.3.0

An external check can't see your site's files. The agent runs on your own server, checks the files (and, on WordPress, the database, read-only), and reports to your dashboard. You never give us FTP, hosting, database or admin passwords.

What it checks

How sure the results are depends on what the platform publishes. The dashboard always shows which of these applied to your site.

On every platform it also checks:

• PHP files in upload folders (wp-content/uploads, Joomla images, Drupal sites/*/files), which should only ever contain media.
• Known malware patterns (webshells, obfuscated code, injected redirects, malicious .htaccess rules) in every file not proven official.
• Installed versions, matched against known vulnerabilities: Wordfence Intelligence for WordPress; OSV.dev and the NVD for Drupal core and drupal.org modules and themes, and for Joomla core.

WordPress database scan (read-only)

The agent reads posts, options, post meta and the list of administrator accounts, in batches and within a time budget, and looks for:

• scripts from other sites, obfuscated JavaScript, hidden iframes and hidden spam links injected into content;
• PHP code or encoded payloads stored in options or post meta, and scheduled tasks (WP-Cron) with code-like arguments;
• the site address settings (siteurl, home) pointing to another domain;
• administrator accounts that appeared since an earlier scan or were registered recently.

The plugin uses WordPress's own database connection. The command-line agent reads wp-config.php as text (it never runs it) and connects locally. Either way the database credentials never leave your server. It only reads; you can switch the database scan off in the plugin settings or with PDF_DB_SCAN=0.

What it sends

• For a file: its path, SHA-256 hash, the rule that matched, the line number and a short excerpt (at most 200 characters).
• For a database entry: table, row ID, column, the rule, an excerpt of at most 200 characters and SHA-256 hashes. For administrators, only the user ID and registration date: never names, emails or password hashes.
• The list of installed software and versions, and what could and couldn't be checked.

Never whole files or whole database values.

How cleanup works

1. You choose a finding in the dashboard and approve an action: quarantine (move the file out), restore official copy (modified WordPress core or WordPress.org plugin files), or remove fragment (an injected script, iframe or spam block inside a post's content).
2. On its next run, the agent checks that the file or post is still exactly the version you reviewed (same SHA-256), and for a fragment that the exact bytes are still there. If anything changed, it does nothing and reports why.
3. It backs up the file, or the post's full content, to a private quarantine folder (outside the web root when possible) and verifies the backup.
4. For a restore, it downloads the official file from WordPress.org and writes it only if it matches the official checksum. For a fragment, it removes exactly those bytes, in one database transaction.
5. Every action can be undone from the dashboard.

The agent never deletes or edits anything on its own. Settings, options and user accounts are never changed automatically: for those you get step-by-step instructions, because a wrong automated change can lock you out of your own site. For Joomla and Drupal, modified core files can be quarantined; to restore them, reinstall core from the official package (Joomla: System → Update → Joomla → Reinstall; Drupal: reinstall drupal/core with Composer).

Install on WordPress (plugin)

1. In the dashboard, verify your domain and click Generate agent key. Copy the key.
2. Download the plugin zip, then in WordPress go to Plugins → Add New → Upload Plugin.
3. Activate it, open Tools → Prime Dev Force Agent, paste the key and click Run now. After that it runs daily through WP-Cron.

Requirements: PHP 7.4 or newer with the curl extension, and outbound HTTPS from your server.

Install from the command line (WordPress, Joomla, Drupal or any PHP host with cron)

1. Download the CLI agent and unpack it outside your web root.
2. Copy pdf-agent.ini.example to bin/pdf-agent.ini, set your agent key and the site's root folder (PDF_WP_ROOT, the docroot for Joomla or Drupal too). Restrict its permissions (chmod 600).
3. Optional settings: PDF_PLATFORM=php to scan another kind of PHP site; PDF_DB_SCAN=0 to skip the WordPress database; PDF_RELEASE_CHECKS=0 to stop downloading the official Joomla or Drupal package (15–30 MB, once per version).
4. Test it: php bin/pdf-agent.php scan prints findings locally and sends nothing. php bin/pdf-agent.php run --dry-run scans without reporting.
5. Schedule it daily, e.g. 17 3 * * * php /path/pdf-agent/bin/pdf-agent.php run.

Requirements: PHP 7.4+ with curl; the zip extension for Joomla and Drupal integrity; pdo_mysql for the database scan from the command line.

Limits

• Pattern checks find known techniques. New or heavily disguised malware can be missed, and legitimate code can occasionally match. Review each finding before acting.
• The database scan covers WordPress only. It reads up to 200,000 rows within 60 seconds per run, and the dashboard says when it stopped early. Custom tables (for example shop orders) aren't read.
• Premium plugins and themes, Joomla extensions and custom Drupal code have no official checksums, so only pattern checks apply to them.
• Magento and other platforms aren't specifically supported. Use the generic PHP mode, with its lower confidence.
• Very large sites are scanned up to a time and size budget per run. The dashboard shows when a scan was truncated.