Thank you for signing up, and congratulations for choosing the best eCommerce protection for your store! eComscan is a clever server-side scanner and monitoring solution. It can be run as a single scan, or in monitoring mode.
eComscan should be installed by a developer or a server administrator (such as your hosting provider). SSH access is required.
eComscan runs on your production (Linux) server. To install the system, log in via SSH and run:
mkdir -p ~/bin curl -sL https://mageintel.com/ecomscan/ecomscan-linux_amd64.gz |gzip -d> ~/bin/ecomscan chmod 755 ~/bin/ecomscan
eComscan is now installed in your home directory under "bin". If you are the system administrator, you can also install it under /usr/local/bin.
Run a single scan
Start a single scan, where you replace key with your license key, and base path with your store folder.
~/bin/ecomscan -k <key> --report <email> <path>
So for example:
~/bin/ecomscan -k n8sFtfpWzz --report email@example.com /var/www/magento
eComscan performs an extensive file and database scan. The database credentials are taken from your store's configuration files (such as local.xml). The scan should take 5-30 minutes (depending on the size of your store and the speed of your server) and then report how many issues were found. If that does not yield any surprises: congratulations! You can now install it in monitoring mode, see the next section.
Set up monitoring
In normal operation, you only want to get notified of relevant changes to your store. This is what monitoring does: eComscan runs continuously and alerts you on suspicious or insecure changes to your store. Log in via SSH and add a new cronjob using the "crontab -e" command. Then, add a new line, where you replace key, email and path with the correct values:
10 * * * * ~/bin/ecomscan -k <your_key> --monitor <your_email> <path>
eComscan will run at the lowest priority, so it will not affect the performance of your store. Should it find anything out of the ordinary, it will alert you via mail. It will not send you repeat alerts. However, you can always do a full scan with the --report option.
Are you hosted on Magemojo Stratus? Then you should enter the cronjob via the Magemojo cronjob web panel, as normal cronjobs are silently ignored. A sample Stratus cronjob command is:
/srv/bin/ecomscan -k YOURKEY --monitor YOUR@EMAIL /srv/public_html
If you have been breached
In certain case, such as when responding to an incident, you should run eComscan in scrutinize mode. This will take a long time and may produce false positives, so the results should be carefully examined by you or your developer:
~/bin/ecomscan -k <key> --min-confidence=0 --deep <path>
This will also display lower confidence hits (such as obfuscated - but not always malicious - code) and scan all files, instead of only executable files.