A WordPress malware scanner that shows you what it found

What a WordPress malware scanner looks for

Malware is built to stay hidden. The site looks normal while it sends spam, steals data or redirects visitors. Typical finds are back doors, web shells, hidden redirects and injected code, plus changed WordPress core files and extra PHP files that have no business in a WordPress folder.

A scanner finds what you cannot see by browsing the site. It is one layer: it tells you something is wrong and where, so you can act.

How the Stack Guard malware scan works

Open the Malware tab and click Run Scan. Progress shows on the scan console. When it finishes, findings are sorted with the most serious first, and each shows the file, the rule that matched and when it was first found. Manual scans with the core, signature and heuristic checks are in every plan.

• Core file integrity: compares every WordPress file with the official copy for your version and language, and flags extra PHP files in the WordPress folders.
• Malware signatures: patterns of known back doors, web shells, hidden redirects and injected code. Uploads and cache folders and files over 5 MB are skipped.
• Heuristic analysis (optional): flags PHP files that look scrambled, with extremely long lines or random-looking text, which is how attackers hide code. It finds more but also flags some harmless files.
• Outdated plugin and theme check (Pro): flags plugins and themes several versions behind the latest release. It compares version numbers and does not look up a vulnerability database. A known vulnerability lookup is coming soon.

Deal with findings safely

Findings sit in three lists: Open, Quarantined and Ignored. Take a backup first, then open the finding and click View file to see where the match is.

For a changed WordPress core file, Restore original replaces it with the official copy and keeps your current file in the quarantine folder as a backup. For anything else you do not recognise, Quarantine moves the file into a locked folder where it cannot run and remembers where it came from, so you can put it back from the Quarantine vault. Delete removes a file for good. If a finding is a harmless file you trust, Ignore it; it is reported again if the file changes. Viewing and ignoring are in every plan, and quarantine, delete and restore original are Pro.

Files WordPress cannot run without, such as wp-config.php and index.php, are never moved or deleted. Finding malware means someone got in, so after cleaning, change passwords, rotate the security keys and update everything.

Scheduled scans, alerts and who this suits

On Pro, switch on Scheduled scans and choose daily, weekly or monthly with a day and time. Turn on the Malware Issues Found alert on the Notifications tab to get an email when something turns up. Manual scan policy only marks a scan as overdue on the Malware tab. It never starts one by itself.

Every WordPress site benefits from a regular scan, and it matters most on sites that run many plugins, take payments or hold client data. Stack Guard's security score rewards a scan in the last 7 days. Pair the scanner with file change monitoring and verified backups so you can both spot a change and undo it.