By default, MalCare scans only WordPress files. However, you can also add non-WordPress files and then run a scan.