Magento 2 Module – Security and Malicious Code Detection Scanner

Magento 2 module for automatic database scanning for malicious code, scripts, and unsafe links.
SKU
M2-SECURITY-SCAN
€30.75
Email to a Friend

Enquire about this product

Description / Magento 2 Module – Security and Malicious Code Detection Scanner

MAGENTO 2 · MONITORING · DETECTION · REPORTS

Detect suspicious changes and assess incidents faster.

Kowal Security Scan

Scan files and selected Magento database content. Combine local detection rules with reporting, optional AI analysis, and URL reputation assessment through Google Safe Browsing.

Files and database · Cron and CLI · Rules and allowlists

HOW IT WORKS IN PRACTICE

01 · Configure scanning
Enable the module, reports, and selected integrations.

02 · The scanner checks the store
Run scans manually or through cron.

03 · The team reviews the report
Verifies detections and takes further action.

What does your store gain?

Explore the module features, use cases, and settings.

Meet the module

Kowal Security Scan is an advanced security module for Magento 2 that helps detect suspicious file changes, malicious code, unsafe URLs, and injections in database content faster. It was designed to run lightly, without additional agents and without a complex deployment.

Key module features

  • File change scan - detects new, modified, and deleted files within the Magento application.
  • Heuristic malware scan - analyzes php, phtml, js, html, svg, htaccess files and other payload carriers.
  • PHP token analysis - detects decode -> execute chains, dynamic callbacks, variable function calls, and suspicious include/require.
  • Database scan - checks selected Magento tables for malicious HTML, JavaScript, SVG, data: URIs, and unsafe links.
  • Google Safe Browsing integration - evaluates the reputation of URLs found in store content.
  • Optional OpenAI analysis - extends the report with risk assessment and action recommendations.
  • Advanced allowlists - help reduce false positives at the domain, file, content, and specific rule levels.
  • Reports with ready-to-use configuration - the module suggests allowlist candidates and generates a normalized JSON export ready for use.

What makes this module different?

  • Stable rule identifiers - file and database rules have their own rule_id, so allowlist configuration does not depend on the full text description.
  • Reports that support incident handling - the report shows not only detections, but also risk level, recommendations, and ready configuration entries.
  • False positive control without disabling the scanner - you can silence a single rule for a specified path or table instead of disabling the entire module.
  • Full automation - the module runs in cron, and each scan can also be started manually through CLI.

What threats does it help detect?

  • obfuscated PHP code based on eval, base64_decode, gzinflate, and similar techniques,
  • malicious JavaScript embeds in CMS content,
  • external iframes and suspicious redirects,
  • SVG payloads and content hidden in data: URIs,
  • unsafe links leading to malware, phishing, or unwanted software,
  • unauthorized changes in application files.

Where does the module look for threats?

The module analyzes key areas of the store where incidents most often appear:

  • Magento application and module files,
  • CMS blocks,
  • CMS pages,
  • core_config_data,
  • Magento and newsletter email templates,
  • product content and customer reviews.

Reports and operational response

  • Results are saved in the module dedicated report table.
  • The report can be sent to the operator by email.
  • Each detection may include a risk level, operational guidance, and the related rule_id.
  • The report can prepare ready-made allowlist suggestions and normalized configuration in JSON.

Example use cases

  • detecting malicious code added after a store breach,
  • monitoring unauthorized changes in deployment files,
  • detecting infected CMS blocks or database content,
  • assessing whether a suspicious URL should be added to an allowlist or removed from the system.

Why choose it?

  • Fast deployment - works as a Magento 2 module without additional infrastructure.
  • Practical reporting - the module does not stop at detection; it helps move toward an operational decision.
  • Better alert quality control - allowlists and rule_id make it easier to maintain high effectiveness without a flood of false alarms.
  • Well suited for production environments - automated scans, email reporting, and manual CLI commands support the daily work of the technical team.

Compatibility

  • Magento Open Source 2.3.x - 2.4.x
  • Adobe Commerce / Magento Commerce

What is included in the package?

  • Magento 2 module with cron jobs and CLI commands,
  • module admin configuration,
  • database and email reporting mechanism,
  • advanced detection rules and an allowlist system.

Documentation and support

Deployment and configuration documentation is available for the module, and its architecture supports further tuning of rules and security processes in a Magento 2 store.

Support earlier incident detection in Magento 2 with Kowal Security Scan.

First scan and monitoring scope

The current description lists Magento Open Source 2.3.x–2.4.x and Adobe Commerce / Magento Commerce. Compatibility with a specific Magento and PHP version should be checked against the delivered package version. The first filecheck run creates a baseline snapshot. Only subsequent scans compare the state and report ADDED, MODIFIED, and REMOVED. Areas such as var, generated, vendor, pub/static, and node_modules are skipped in the change scan.

Database Scan covers selected tables: cms_block, cms_page, core_config_data, email_template, newsletter_template, review_detail, and catalog_product_entity_text. The module is not a guarantee that all threats will be detected and does not automatically remove infections.

Schedule and configuration

In Stores → Configuration → Kowal → Security Scan, you set activity, report recipient and sender, and retention. The default cron runs the change scan at 00:00, malware at 01:00, database at 02:00, and report cleanup at 02:30.

Automation requires a working Magento cron and email delivery. Manual commands are kowal_securityscan:filecheck, kowal_securityscan:malwarecheck, and kowal_securityscan:dbcheck.

Optional APIs and precise exceptions

Without OpenAI and Google Safe Browsing, the basic local scans work. Activated APIs require your own keys and access to the services. AI analysis sends suspicious fragments to OpenAI; you configure the model and maximum context. Safe Browsing checks detected URLs and the base store address.

Silencing a single rule for a file or table is narrower than skipping the entire file or record. Approve allowlist candidates from the report and JSON export after verification — the report supports the operator decision; it does not replace it.

Installation via Composer

Package kowal/module-securityscan, module Kowal_SecurityScan. After configuring access to the Kowal repository, install the package, enable the module, update Magento, and clear the cache. In production, include compilation and static content deployment according to the store process.

From configuration to results

1. Configure scanning
Enable the module, reports, and selected integrations.

2. The scanner checks the store
Run scans manually or through cron.

3. The team reviews the report
Verifies detections and takes further action.

Suspicious script in a CMS block

The database scan detects a JavaScript fragment in CMS content. The report identifies the record and rule, while optional AI analysis helps assess the risk.

The operator checks whether it is an incident or a valid integration. A verified false alarm can be silenced with a precise allowlist rule.

Enable regular Magento monitoring

Want to adapt the module to your store? Ask about implementing Kowal Security Scan and discuss the configuration or required extensions.

More Information

Theme compatibility Luma / Blank, KOWAL

Change Log

Version: 1.0.27

03/31/2026

We expanded the Kowal_SecurityScan module with new features related to threat analysis and report administration.

New features

  • Added OpenAI integration for analyzing changed files and suspicious database records.
  • Reports and email messages now include risk assessment and recommended actions in the following areas:
    • Magento
    • server
    • firewall
  • Added OpenAI configuration in the Magento panel, including:
    • enabling/disabling AI analysis
    • API key
    • model selection
    • context limit passed for analysis

Improvements

  • The list of OpenAI models is now retrieved dynamically from the API and displayed in the configuration as a dropdown.
  • The email content has been extended with Magento store identification:
    • store domain
    • store URL
  • The store domain is also added to the message subject, making it easier to manage multiple instances.

Automation and maintenance

  • Added a new cron job that cleans old entries from the report table.
  • Report retention time is configurable from system.xml as a number of days.

Technical fixes

  • Organized the logic for analyzing suspicious files and records.
  • Improved handling of the data context passed to AI analysis.
  • Resolved a DI compilation issue related to the previous OpenAI client implementation.

Module Installation Instructions

Instructions for the Kowal_SecurityScan module

Overview

The module extends Magento 2 with a security monitoring layer for application files, selected database tables, suspicious URLs, and optional incident analysis through OpenAI.

Reports are saved in the kowal_securityscan_report table and can be sent by email.

Main features

  • Magento file change scan with snapshot comparison,
  • heuristic scan of php, phtml, php5, inc, phar, js, html, htm, svg, htaccess files,
  • PHP token analysis through token_get_all(),
  • scan of selected database tables for malicious HTML, JavaScript, SVG, data: URIs, and suspicious URLs,
  • integration with Google Safe Browsing API,
  • optional OpenAI analysis for detections,
  • configurable allowlists for domains, files, content patterns, and rules,
  • reports with ready-made allowlist suggestions and normalized JSON configuration export.

Requirements

  • Magento 2,
  • available kowal/base module,
  • working Magento cron,
  • properly configured email sending,
  • optionally: OpenAI API key and Google Safe Browsing API key.

Installation

1. Adding the package repository

Add the Kowal Composer repository:

You will receive repository access details for Composer (customer email address and license token) by email after purchase. They are also available in the customer panel after logging in at kowal.store. Replace TWOJ_EMAIL_KLIENTA with your account email address and TWOJ_TOKEN with the token you received. Run the commands in the Magento root directory.

composer config repositories.kowal composer https://repo.kowal.store

If the repository requires authorization:

composer config http-basic.repo.kowal.store 'TWOJ_EMAIL_KLIENTA' 'TWOJ_TOKEN'

2. Package installation

composer require kowal/module-securityscan

3. Module activation

php bin/magento module:enable Kowal_SecurityScan
php bin/magento setup:upgrade
php bin/magento cache:flush

In a production environment, perform the standard Magento deployment steps according to your deployment process.

Cron and scan schedule

The module registers its own cron group securityscan.

  • kowal_securityscan_filecheck - daily at 00:00,
  • kowal_securityscan_malwarecheck - daily at 01:00,
  • kowal_securityscan_dbcheck - daily at 02:00,
  • kowal_securityscan_cleanup_reports - daily at 02:30.

Without a working Magento cron, automatic scans will not run.

Running scans manually

To run scans manually, use:

php bin/magento kowal_securityscan:filecheck
php bin/magento kowal_securityscan:malwarecheck
php bin/magento kowal_securityscan:dbcheck

This is the recommended test method after installation and after configuration changes.

Configuration

Configuration path:

Stores -> Configuration -> kowal -> kowal_security

General settings

  • Włącz moduł
  • Adres e-mail do raportów
  • Adres e-mail nadawcy
  • Retencja raportow w dniach
  • Google Safe Browsing API Key
  • Allowlista domen
  • Allowlista plikow
  • Allowlista wzorcow bazy
  • Allowlista reguł plikow
  • Allowlista reguł bazy

Minimum configuration

  1. enable the module,
  2. set the report recipient address,
  3. set the report sender address,
  4. make sure Magento email sending works,
  5. make sure Magento cron works.

OpenAI analysis

The Analiza OpenAI section lets you extend reports with risk assessment and action recommendations.

Available fields:

  • Włącz analizę AI,
  • OpenAI API Key,
  • Model OpenAI,
  • Maksymalny kontekst dla AI.

How to enable

  1. enable Włącz analizę AI,
  2. complete OpenAI API Key,
  3. save the configuration,
  4. refresh the configuration form,
  5. select the model.

Default behavior

  • default model: gpt-4.1-mini,
  • default context limit: 12000,
  • values below 2000 are increased to 12000,
  • the maximum context limit is 50000.

If OpenAI is disabled or the key is missing, the module still works and uses local heuristics.

Google Safe Browsing

If you complete Google Safe Browsing API Key, the module will:

  • check URLs detected in files and the database,
  • check the store base address.

A missing key does not block the basic scans; it only disables this stage.

File change scan

filecheck works based on a snapshot saved to:

var/security_scan_hashes.json

On the first run:

  • a snapshot is created,
  • there is no change comparison yet,
  • the report indicates that the baseline has been created.

Subsequent runs report changes of type ADDED, MODIFIED, and REMOVED.

The following are skipped, among others:

  • var/,
  • generated/,
  • vendor/,
  • pub/static/,
  • node_modules/.

File malware scan

malwarecheck scans application files based on:

  • regex rules with rule_id,
  • PHP token heuristics,
  • URL checks through Safe Browsing.

Example detection types:

  • file.obfuscated_eval_chain,
  • file.command_execution_from_request,
  • file.encoded_payload_blob,
  • file.token.decode_execute_chain,
  • file.token.include_from_request,
  • file.inline_svg_or_event_handler.

In reports, reasons are presented in the format:

[file.encoded_payload_blob] Encoded payload blob detected

Database scan

dbcheck analyzes selected Magento tables:

  • cms_block,
  • cms_page,
  • core_config_data,
  • email_template,
  • newsletter_template,
  • review_detail,
  • catalog_product_entity_text.

Example rules:

  • db.inline_script_tag,
  • db.html_event_handler,
  • db.external_iframe,
  • db.javascript_uri,
  • db.data_uri_executable,
  • db.embedded_svg_payload,
  • db.javascript_dom_redirect.

Content is first normalized through:

  • html_entity_decode,
  • rawurldecode,
  • whitespace normalization,
  • analysis of multiple variants of the same content.

Advanced configuration: allowlists

Allowlists are used to reduce false positives without disabling the entire module.

1. Domain allowlist

Field: kowal_security/general/allowlisted_domains

Format:

  • one domain per line, or
  • a comma-separated list.
cdn.example.comstatic.example.org

Effect:

  • URLs from these domains will not be treated as suspicious,
  • Safe Browsing will not check them.

2. File allowlist

Field: kowal_security/general/allowlisted_file_patterns

Format:

  • relative paths,
  • glob support.
app/code/Vendor/Module/Test/*pub/media/custom.js

Effect: files matching the pattern are completely skipped by the malware scan. This setting has a broad scope.

3. Database pattern allowlist

Field: kowal_security/general/allowlisted_db_patterns

Format:

  • phrases,
  • HTML or JS fragments,
  • entries separated by a new line or commas.
trusted-inline-widgetdata:image/svg+xml,<svg

Effect: a database record containing such a fragment is skipped by the DB scan. This setting also has a broad scope.

4. File rule allowlist

Field: kowal_security/general/allowlisted_file_rules

Preferred format:

sciezka_lub_glob | rule_id

Example:

app/code/Vendor/Module/* | file.encoded_payload_blobpub/media/custom.js | file.javascript_redirect_or_rewrite

Backward compatibility:

  • old entries using the full rule label still work,
  • new entries should use rule_id.

Effect: only the specified rule is silenced for the specified path, while the rest of the scan for that file continues to work.

5. Database rule allowlist

Field: kowal_security/general/allowlisted_db_rules

Preferred format:

tabela_lub_* | rule_id

Example:

cms_block | db.inline_script_tag* | db.fetch_or_xhr_loader

Effect: only the specified rule is silenced, while the remaining rules still work for that record or table.

Reports

Reports can include:

  • a list of detections,
  • risk assessment,
  • indicators and recommendations,
  • allowlist candidates after manual verification,
  • normalized allowlist configuration in JSON.

Allowlist suggestions in reports

The report section may contain entries such as:

- cms_block | db.inline_script_tag | pewnosc=MEDIUM | zasieg=LOW- app/code/Vendor/Module/* | file.encoded_payload_blob | pewnosc=MEDIUM | zasieg=LOW- data:image/svg+xml,<svg... | pewnosc=LOW | zasieg=HIGH

Interpretation:

  • zasieg=LOW - safer candidate,
  • zasieg=HIGH - broad silencing, only after strict verification,
  • pewnosc=MEDIUM/HIGH - more predictable configuration candidate,
  • pewnosc=LOW - requires caution.

JSON export

The report also includes the Znormalizowana konfiguracja allowlist (JSON) section. This is a ready-made, deduplicated set of values to copy into the configuration.

Recommended usage flow

  1. run all three scans manually after installation,
  2. treat the first filecheck as snapshot creation,
  3. analyze reports and confirm which detections are real,
  4. for false positives, use allowlisted_file_rules and allowlisted_db_rules first,
  5. only when necessary, use allowlisted_domains, allowlisted_file_patterns, and allowlisted_db_patterns,
  6. after changing the configuration, run the appropriate CLI scan again and check the result.

Operational notes

  • on the first run, filecheck does not yet report changes as an incident,
  • the module works without OpenAI and without Safe Browsing, but with less analysis depth,
  • allowlisted_file_patterns and allowlisted_db_patterns have a broad impact and should be used sparingly,
  • the preferred format for rule allowlists is rule_id, not the full text label.
Press to skip carousel

We found other products you might like!

Kowal Purge Varnish Cache
Kowal Purge Varnish Cache
€15.38
View more about Kowal MCP Server for Magento 2 View more about Kowal Purge Varnish Cache
Write Your Own Review
You're reviewing: Magento 2 Module – Security and Malicious Code Detection Scanner
Your Rating:
Quality
Price
Support
loader
Loading...

You submitted your review for moderation.

Questions and Answers

Question
Does the module allow scanning a Magento 2 store for malicious code and security threats?
Answer
Yes. The module compares files with a saved baseline and reports added, changed or deleted files. Separate scans look for suspicious patterns in selected files and database tables. This is monitoring and diagnostics, rather than automatic infection removal or a guarantee of detecting all threats.
Question
Does installing the module require overwriting Magento core or theme files?
Answer
No — modules offered by Kowal are usually extensions compatible with the Magento 2 architecture and do not require modifications to core files. (No information about the need for modification)
Question
Does the module support Magento 2 stores in multi-store and multi-view installations?
Answer
File scans cover the Magento installation rather than a separate directory for every store view. Adapt database table scope and scan configuration to the deployment. This does not mean a separate security audit of every website and integration.
Question
Does the module help meet the security recommendations of the Magento platform or the Magento Security Scan Tool?
Answer
Kowal Security Scan monitors file changes and selected suspicious patterns. It does not replace Magento security updates, permission checks, infrastructure audits or Adobe's external scanner. The module report is additional evidence rather than confirmation that every recommendation has been met.
Question
Does the module significantly affect the store’s performance, for example when scanning large file directories?
Answer
File and database scans use server resources. The module provides CRON scheduling, with individual tasks running at night by default. Load depends on installation size and scan scope. Check execution time and resource usage before enabling the full scope.
Question
Do I receive technical support and updates after purchasing the module?
Answer
Yes — the manufacturer states that it provides free updates and technical support for its extensions.
Update cookie preferences