Trigger an on-demand scan

You can start a malware scan at any time, on every plan. Scans run automatically too (see the end of this article), so an on-demand scan is for when you want a fresh result right away.

From the site page

1. Open Dashboard → Sites and click the site
2. Click Scan at the top of the page
3. The scan starts on the site and progress updates live under Findings → Malware on the same page

From the Scans page

1. Open Dashboard → Scans
2. Click Scan on a site's row, or Scan all to scan every site

From WordPress

In your WordPress admin, open PowerSEC → File Scanner, choose the Malware scan tab and click Scan now.

From the command line

With the PowerSEC CLI (version 1.0.1 or newer):

npm install -g @powersec/cli
psec login --api-key psec_live_xxx

# Start a scan and follow it until it finishes
psec scan run example.com --wait

# Last scan result for a site
psec scan status example.com

Stopping --wait (or pressing Ctrl-C) does not stop the scan; it keeps running on the site.

Via the API

Create an API key under Dashboard → Settings → API Keys (it starts with psec_live_), then:

TOKEN="psec_live_xxx"
SITE_ID="your-site-id"

# Start a scan
curl -s -X POST "https://powersec.io/api/sites/$SITE_ID/malware-scan/start" \
  -H "Authorization: Bearer $TOKEN"

# Check progress (use the run id returned by the start call)
curl -s "https://powersec.io/api/sites/$SITE_ID/malware-scan/status?runId=<runId>" \
  -H "Authorization: Bearer $TOKEN"

If a scan is already running on the site, the start call returns that scan instead of starting a second one.

Reading scan results

Open the site and look at Findings → Malware. It shows the flagged files with their severity, and how many files the last scan reviewed. The Scans page lists every site with the age of its last malware scan and file scan, and lets you filter by sites with threats, stale scans, clean results or no scan yet.

How often scans run automatically

The vulnerability data the checks use is rebuilt every day.

On-demand scans are available on all plans. To protect your server, a site accepts a limited number of scan starts from Central per hour.