# Scan your sites for security issues

Check WordPress sites and Node applications for malware and known vulnerabilities, deal with what the scan finds and let scans run on a schedule.

## Before you start

- A WordPress site or a Node application that is running. Static and PHP sites can't be scanned yet.
- A role that can manage sites. See [Roles and permissions](https://app.nuvlo.dev/docs/roles-and-permissions).

## What a scan checks

| Site type | What is checked |
| --- | --- |
| WordPress | WordPress core files are compared with the official release, and `wp-content` is searched for malware, such as web shells, obfuscated code and PHP files in the uploads folder. |
| Node application | A dependency audit looks for packages with known security advisories, and the source files are searched for malware. |

Files that the scan is very sure are malicious are **quarantined** automatically: they are moved out of the live site until you restore or delete them. Everything else is only reported.

## Step 1: Open Security scans

In the sidebar, select **Resources** and then **Security scans**. The table lists every site with its scan **Status**, the number of **Findings** and when it was **Last scanned**.

![The Security scans page with sites, their scan status, findings and last scan time](https://app.nuvlo.dev/docs/shots/security-scans--overview.webp)

- **Never scanned**: no scan has run yet.
- **No issues found**: the last scan found nothing.
- **Needs attention**: the last scan has findings.
- **Scan failed**: the scan couldn't finish. Run it again.
- **Not supported**: the site type can't be scanned.

A shield icon next to a site means scheduled scans are on for it.

## Step 2: Run a scan

Click **Run scan** on the site's row. The status shows the current step while the scan runs, and the page updates by itself when it's done.

You can also start a scan on the site itself: **Scan now** on a WordPress site's **Security** tab, or **Run security scan** on an application's **Security** tab. A stopped site can't be scanned; start it first.

## Step 3: Review the results

Click the arrow at the end of the row to open the site's results.

On a WordPress site, the **Malware scan** card shows two lines. **Core files** says **Match the official release** or **Changed from the official release**. **Malware** says **None found** or how many suspicious files there are. Each file is listed below with the reason it was flagged.

![The Malware scan card of a WordPress site with the core file check, malware result and a flagged file](https://app.nuvlo.dev/docs/shots/security-scans--wordpress-results.webp)

On an application, the **Security scan** card shows the number of **Findings**, how many are **Critical**, how many files are **Quarantined** and when the last scan ran. The table lists each finding with its **Severity** and **Status**.

![The Security scan card of an application with finding counts and a findings table](https://app.nuvlo.dev/docs/shots/security-scans--application-results.webp)

## Step 4: Deal with each finding

- **Restore file** moves a quarantined file back to where it was. Use it when you're sure the file is safe.
- **Delete file** removes a quarantined file from the server for good. Nuvlo asks you to confirm with **Delete file**.
- **Ignore** (on WordPress) or **Ignore finding** (on applications) leaves a file where it is and stops flagging it.
- A vulnerable dependency can't be quarantined. Upgrade the package in your project and deploy again, then run a new scan.

> **Warning:** Deleting a quarantined file can't be undone. If you aren't sure what a file does, [back up the site](https://app.nuvlo.dev/docs/back-up-a-site) first.

## Step 5: Schedule automatic scans

On a WordPress site, open the **Security** tab. Under **Automatic scans**, turn on **Scan automatically**, choose **How often** (**Every day** or **Every week**) and a **Time**, then click **Save scan schedule**.

![The Automatic scans section with Scan automatically turned on, a frequency and a time](https://app.nuvlo.dev/docs/shots/security-scans--wordpress-schedule.webp)

On an application, open **Security** and the **Scan** view. In **Scheduled scanning**, choose the **Frequency**, enter the **Hour (UTC)** from 0 to 23, set **Schedule status** to **Enabled** and click **Save schedule**.

![The Scheduled scanning card of an application with Frequency, Hour (UTC) and Schedule status](https://app.nuvlo.dev/docs/shots/security-scans--application-schedule.webp)

Times are in UTC. Scheduled scans skip sites that are stopped or paused.

## What happens next

When a scan finds something, you get a notification such as **Security scan found 2 issues on example.com**. A failed scan also creates a notification. See [Notifications](https://app.nuvlo.dev/docs/notifications).

Scan history is kept for 90 days.

---
Source: https://app.nuvlo.dev/docs/security-scans