The Server Side Scanner lets us check files on your hosting server directly. It checks your website files looking for backdoors, phishing, and other security issues that our remote scanners might miss.
You can find the Server Side Scanner activation page within the Settings tab of the monitoring dashboard. Select the dropdown for Server Side Scanner.
The scan can be enabled a few different ways, as described below.
SFTP
From the Authentication Method dropdown, select Password. Required Information:
- Host IP
- SFTP Port
- Username
- Password
- Directory Path
Once your information is submitted, select Enable Server Side Scanner.
SSH Public Key
From the Authentication Method dropdown, select SSH Key.
- Download our public key. Keep the file as-is; don’t open and edit it.
- Connect to the server you want scanned.
- Add the public key.
nano ~/.ssh/authorized_keysIn the editor, go to the end of the file, paste the entire public key on its own line, then save and exit.
In nano, press Ctrl+O, then Enter to save, and Ctrl+X to exit. If the file already contains keys, leave them in place and add our key on a new line. - Set the file permissions.
chmod 600 ~/.ssh/authorized_keys - Fill out the SSH connection details- server address, SSH port (usually 22), username, and directory path.
- Select Enable Server Side Scanner.
Server Instructions
SSH Key management by Hosting Provider
Bluehost
Cloudways
Digital Ocean
DreamHost
GoDaddy
HostGator
Hostinger
InMotion Hosting
Kinsta
Rackspace
SiteGround
WP Engine
Once access is authorized, the Server Side Scan will connect using the key and will upload the required PHP script to your server.
If you can’t connect or don’t have permission to edit ~/.ssh/authorized_keys, ask your hosting provider or server administrator to add the public key to the correct account for you.
Manual
Select the Enable manually instead option in the Settings.
- Download the file.
- Upload the file to your site’s root directory using file manager or an FTP client such as Filezilla.
- Select Verify & Enable
Note:
- SFTP access is only required during the initial setup for uploading the PHP script to the server. If you created an SFTP user for this purpose, it is advised that you reset the password or delete the user account after.
- Password authentication is supported, but it is more vulnerable to brute-force attacks and stolen credentials. For enhanced security, we strongly recommend using SSH key authentication or enabling the scan manually.
- Hosting requirements for using the Server Side Scanner can be found here.