Mageargus Malware Scanner

MageArgus Security Scanner for Magento 2 by W3CTRL Know exactly how secure your store is. MageArgus runs a white-box audit from inside your installation — reading the real filesystem, database and configuration — so it catches what an external scanner never can. Every scan produces a clear 0–100 security score, a graded report grouped by category, and copy-paste (or one-click) fixes.

This extension for Magento works by performing a locked, time-budgeted scan across ten security domains, then weighting every finding into a single shareable score and A–F grade. It confirms on disk whether critical CVEs — including SessionReaper and CosmicSting — are genuinely patched, rather than guessing from your version string, and flags whether your release is current, behind, or unsupported. It signature- and heuristic-scans high-risk directories for webshells, fake-image polyglots and PHP hidden under pub/media, and inspects CMS blocks, pages and store configuration for injected Magecart/skimmer code. An admin-hardening audit reviews 2FA, secret-key URLs, custom admin paths, CAPTCHA, login lockout, session lifetime and rogue admin accounts, while an exposure check finds reachable .git folders, env.php backups, public database dumps and dev tools such as phpinfo or Adminer. For example, a merchant preparing for a PCI assessment can run a scan before an audit, hand the graded PDF report to their assessor, and use the one-click auto-fix to correct file permissions and hardening settings directly from the Magento admin — while suspected malware is always flagged for manual review and never touched automatically. Results appear on a native admin dashboard with live score cards and full scan history, and scans can be run manually, on a daily/weekly/monthly cron with emailed PDF reports, or from the command line for CI pipelines.

 Key Features

• ✅ Security Score (0–100) & Grade (A–F): Every finding is weighted into one shareable score with a clear grade.
• ✅ On-Disk Patch Confirmation: Verifies critical CVEs (SessionReaper, CosmicSting and more) are actually patched on disk — not just guessed from the version string.
• ✅ Version Currency Check: Flags whether your Magento release is up to date, behind, or unsupported.
• ✅ File Malware & Webshell Detection: Signature + heuristic scan of high-risk directories, fake-image polyglots and PHP under pub/media.
• ✅ Database Malware Scan: Detects injected skimmer/Magecart code in CMS blocks, pages and store configuration.
• ✅ Admin Hardening Audit: 2FA, secret-key URLs,  custom admin path, CAPTCHA, login lockout, session lifetime, account  sharing + rogue-admin & integration-token detection.
• ✅ Exposed Files & Secrets: Finds .git folders, env.php backups, public database dumps and dev tools (phpinfo/adminer) reachable from the web.
• ✅ Permission & Integrity Audit: Checks env.php permissions, world-writable paths, deploy mode and cron health.
• ✅ One-Click Auto-Fix: Safely fixes permissions and hardening settings straight from the dashboard — never touches suspected malware automatically.
• ✅ Security Dashboard & Scan History: Live score, pass/fail summary cards and a full history of every scan (manual, cron or CLI).
• ✅ Detailed Reports + PDF: Grouped, native-admin report with Download PDF and emailed reports.
• ✅ Scheduled Scans: Automated daily / weekly / monthly cron scans with email alerts and a PDF attachment.
• ✅ Email Reports: Full report delivered to your inbox — always, or only when critical findings appear.
• ✅ Command-Line Scanner: bin/magento mageargus:secscan:run with a clean, colourised report for CI/automation.

Why Choose This Extension?

• Professional development by Magento experts
• White-box depth the free online scanners can’t reach (filesystem + database + config)
• Lightweight by design — locked, time-budgeted scans that won’t overload your server
• PHP 8.4 compatible with modern coding standards
• Multi-store support
• Easy installation via Composer
• Comprehensive documentation
• 6 months priority support
• 12 months free updates

Requirements

Magento 2.4.x | PHP 8.1, 8.2, 8.3, or 8.4 | MySQL 8.0+ or MariaDB 10.4+