Scheduled Scanning

Manual scanning fails for an entirely human reason. It works well for a fortnight after you install something, and then a busy week arrives, and the next scan is six weeks later, usually prompted by a customer asking why the site is redirecting them somewhere strange.

The interval between compromise and discovery is where the cost of an incident accumulates. Card details are skimmed for as long as the skimmer runs, spam pages get indexed and stay indexed after removal, domain reputation is spent, and search engines begin showing a warning beside your name. None of that is set at the moment of the breach; all of it is set by how long nobody noticed.

Scheduling removes the human variable. A scan that runs on its own at three in the morning is a scan that runs on the week you are too busy to think about it, which is reliably the week it matters.

The free plugin schedules daily or weekly. Pro moves to hourly. The right choice follows from two things: how often the site changes, and what an unnoticed hour actually costs you.

A brochure site edited twice a year gains very little from hourly scanning, and weekly is an honest answer rather than a compromise. A store taking card details is a different calculation, because losses accrue per hour of trading, at that point hourly scanning is inexpensive against the thing it is protecting.

File and database scans schedule independently, which matters because they cost different amounts and answer different questions. A site with a large uploads directory and a small database can sensibly run one more often than the other.

Scheduled scans can be scoped rather than always full-site: core, plugins, themes or uploads. A frequent uploads-only scan plus a weekly full scan often gives better real coverage than a daily full scan that takes long enough to be inconvenient, because the uploads directory is where compromises most often land first.

Timing is worth a moment's thought even though scanning runs off your server and costs your visitors nothing. Scheduling outside your busiest window keeps the reporting clean and means an alert lands when somebody is able to read it.

For agencies, bulk scheduling covers the fleet and staggers runs so forty sites are not all scanned in the same hour. Digest emails then summarise the estate, because a per-event stream across forty sites is unreadable by construction and gets ignored within a week.

A scheduled scan produces a result whether or not anybody looks. On the free plugin that result waits in the dashboard, which suits an owner who checks weekly and fails an owner who does not.

Email notifications at Basic close that gap by pushing findings rather than waiting to be visited, and real-time file monitoring at the same tier narrows detection from the next scheduled run to the moment a file changes. Scheduling and notification are two halves of one mechanism.

Three on-demand scans a day sit on top of the schedule on the free plugin, and unlimited on Pro. That is what you use during a cleanup, when the question is whether the last fix worked and waiting for tomorrow's run is not an option.