Performance
How scans stay within time and memory budgets on shared hosting.
Design goals
Scans run as queued jobs in small slices so a request never exceeds a safe time/memory budget. You can leave the admin page; progress continues via WP-Cron (or a real cron hitting wp-cron.php).
What uses resources
| Work | Cost | Notes |
|---|---|---|
| First integrity scan | Highest | Hashes the whole tree once to build baselines |
| Later integrity scans | Lower | Compares against baseline + checksums |
| Malware heuristics | Medium | Walks PHP and risky paths under a score budget |
| Vulnerability match | Low | One outbound request when opted in (cached) |
| Weekly digest | Low | Builds from stored findings/events |
Tips
- Prefer a real server cron every 5–15 minutes instead of relying solely on traffic-driven WP-Cron.
- Exclude huge backup folders from the web root when possible — less to walk.
- After big deploys, run Integrity once and Accept intentional baseline changes so the next scan stays quiet.
- On very small shared hosts, run one suite at a time from the Scan tab instead of stacking everything.
Limits
If a job hits its budget it pauses and resumes on the next cron tick. That is expected — not a hang. Check Events for scan.* rows if progress looks stuck.