- Newwarns you when an installed plugin or theme is under active attack. A short list kept by the Moatline team is checked twice a day, and you get an email the first time a plugin on your site appears on it. The dashboard shows a red warning until you update.
- Newautomatic weekly scans in the background (Settings → Automatic scans), with an email when threats are found. Long scans run in short slices, so they work on any host.
- Newfile change monitoring. Each scan remembers a fingerprint of every PHP and JavaScript file and reports files that are new or changed since the last scan, unless that software was updated. This catches self-healing malware that rewrites files and backdates them.
- New“find the source”. When the scan finds a malicious script, it also looks for the file or database entry that keeps adding it, and names it.
- NewWP-CLI commands: wp moatline scan, wp moatline threats, wp moatline status and wp moatline clean-db. wp moatline scan --fail-on-threats exits with an error for monitoring scripts.
- Newchecks WordPress core files against the official checksums from WordPress.org, and finds PHP files in wp-admin and wp-includes that WordPress doesn’t ship.
- Newchecks wp-config.php for injected code, PHP files in the site root and directly in wp-content, and hidden PHP files whose names start with a dot.
- Newfinds auto_prepend_file lines in .user.ini, php.ini and .htaccess that run a file before every page (the first stage of 2026’s self-healing “SC” malware).
- Newscans every installed theme, not only the active one.
- Newfinds administrators hidden from the Users screen, admin names matching 2026 malware patterns, registration set to give new users the Administrator role, and database triggers.
- Newfinds compressed PHP code stored in the database.
- Changedfindings that must be fixed by hand (core files, wp-config.php, server settings, triggers) say exactly how, and are never offered for deletion.
- Changed“Clean database” now removes every database entry the scan reports as a known malware key, and both use one list of malware cron jobs.
- Changedfewer false alarms: plugins’ own test folders and short chr() byte sequences (such as CSV byte-order marks) no longer trigger warnings.
- Changeddeleting the plugin now removes the plugin-install lock (DISALLOW_FILE_MODS) that Moatline added to wp-config.php, so the site can install and update plugins again. A lock added by you or your host is left alone.
- Fixedthe custom login address can no longer be switched on when the server can’t reach it (Plain permalinks or missing rewrite rules), which could lock you out. If permalinks are later set to Plain, the normal login page is used.
- Fixedwhen the live home page check can’t load your site, the results now say so instead of looking clean.
Changelog
What changed in each release of the free plugin and the Pro add-on. Updates arrive through your WordPress dashboard as usual.
Moatline Malware Scanner free plugin
- Fixedthe uploads scan now finds PHP files renamed to .phtml, .php5, .php7, .php8, .pht, .phtm, .phar or .phps, and upper-case names such as .PHP. Attackers exploiting the Bricksforge file upload flaw (CVE-2026-85097) use these names.
- Fixedthe “Block PHP in uploads” rule now covers the same extensions and ignores letter case. Sites that already had the block turned on are upgraded automatically.
- Changedthe Nginx rule shown for manual setup covers the same extensions.
- Fixedon sites without a mu-plugins folder (most sites), the checks for fake plugins and hidden binary payload files were skipped. They now always run.
- Newdatabase entries used by the fake CAPTCHA (ClickFix) loader that reads its address from the Polygon blockchain are named as such in scan results.
- Changedcleaner admin screens: no more emoji on buttons, a two-column scan progress list, and a red “Threats found” headline on the dashboard while threats remain.
- Changedeach database entry is reported once, even when several checks match it.
- FixedLockdown now shows “Locked” when DISALLOW_FILE_MODS was added to wp-config.php by hand or by your host.
- Fixedwhen Moatline’s folder is a symlink, the scanner now checks every plugin and still skips its own files.
- Fixedfinished scan steps no longer keep saying “Scanning…”.
- FixedXML-RPC Jetpack-safe mode now also recognises WooPayments and the standalone Jetpack plugins, which use the same WordPress.com connection.
- Fixedthe Moatline logo in the admin header did not show on some installs.
- Newredesigned admin screens, with a header and tabs on every page and a dashboard showing your security score, what to fix next, recent activity and the database cleaner.
- Newchecks your live home page the way visitors see it, to catch fake CAPTCHA (ClickFix) scripts injected at page load.
- Newdetects the “X Global Data Flow” / “Traffic Monitor” fake plugins and new White Label CMS loader variants, including malware that empties other security plugins’ files.
- Newthe database cleaner backs up everything it removes, and “Restore last backup” puts it back.
- Newwarns you if Moatline’s own files have been emptied by malware, instead of failing silently.
- Newdetects the fake “WordPress Defender”, “WordPress Security” and “White Label” plugins found on hacked sites in 2026, plus plugins whose author is just “WordPress”.
- Newflags empty plugin files left behind by host malware cleaners, which can crash a site.
- Newdetects malware plugins that hide themselves from the Plugins list.
- Newsignatures for the mlroweb, latoem and renotad script injections.
- NewPause, Resume and Stop buttons while a scan is running.
- Fixedthe database cleaner stayed on “Cleaning…” and never finished.
- Fixedsigning in from a custom login URL sent you back to the login page.
- Changeddeleting the plugin keeps settings and two-step login setups unless you choose “Delete all plugin data”.
- First release on WordPress.org.
Moatline Pro add-on
- Newone-click fixes for changed WordPress core files (official copy, checksum-verified), auto_prepend_file loaders, malicious database triggers and an unsafe default role. Each change is backed up first.
- Newfull vulnerability database from Wordfence Intelligence (free API key), added to the free plugin’s “under attack” warnings.
- Newblocks requests to public blockchain gateways used by self-healing and fake CAPTCHA malware (Pro Settings → Block malware command channels).
- Newwhite-label security report under Malware Scanner → Security Report, with your name, logo, colour and notes, for 7, 30 or 90 days.
- Newremoves files the free plugin reports as new since the last scan.
- Newwp moatline remove <id> and wp moatline remove --all for WP-CLI.
- Changeddaily scans now run in the background in short slices through the free plugin’s scheduler, so they finish on slow hosts too.
- Fixed“Remove” and “Remove all threats” never delete wp-config.php, .htaccess, .user.ini, WordPress core files, the active theme’s main files, or anything outside the WordPress folder. Each gives the safe fix instead.
- Fixedthe nnms-backups folder is always protected from web access, including on Apache 2.4.
- Fixedremoving a fake plugin now deletes its whole folder, not just the flagged file.
- Pro pages use the new Moatline header and tabs.
- Live home-page findings are reported with clear instructions instead of a remove button.
- Simpler Account page.
- Licenses, purchases and updates are now handled by Freemius.
- First release.