How to scan WordPress for malware

Online scanners vs scanner plugins

There are two kinds of WordPress malware scanner:

• Online (remote) scanners load your public pages like a visitor does. They spot known malicious scripts in the HTML and check blocklists such as Google Safe Browsing. They can't see files, the database or anything that only shows to some visitors.
• Scanner plugins run inside WordPress, so they can read every file and database table. This is the only way to find backdoors, fake plugins and code that hides from the outside.

Use an online scanner for a quick outside view, but rely on a plugin to confirm a site is clean.

What a good WordPress malware scan checks

• Integrity: compares WordPress core and every WordPress.org plugin with the official files. Any change is flagged, even code no signature has seen before.
• Known malware signatures for current WordPress malware families.
• Suspicious code patterns such as heavily encoded PHP, eval() on encoded strings and webshell behaviour.
• The uploads folder for PHP files that shouldn't be there.
• mu-plugins and drop-ins, which load automatically and are easy to miss.
• Fake plugins pretending to be security or branding plugins, including ones hidden from the plugin list.
• The database: posts, revisions, widgets, options and page-builder data, where scripts like fake CAPTCHA loaders are injected.
• Scheduled tasks that reinstall malware after a cleanup.

How to run a free malware scan with Moatline

1. In wp-admin go to Plugins → Add New, search for Moatline, then click Install Now and Activate.
2. Open Malware Scanner → Scanner and click Run Full Scan.
3. Leave the page open while the scan runs. You can pause and resume it; a paused scan can be picked up within 24 hours.
4. When it finishes, review the results. Nothing is deleted or changed unless you click a button.

No account or API key is needed. The only outside connection is to WordPress.org, to download the official file checksums.

Reading the results

• Critical: a known malware signature or a fake plugin. Treat it as a real infection.
• Warning: suspicious code or a file that differs from the official copy. Check what changed; if you didn't edit it, replace it with a fresh copy.
• Injected content: a post, page or widget containing a malicious script. Open it and remove the script.

If the scan finds an infection, follow our guide to removing malware from WordPress. If you know a finding is harmless, dismiss it or exclude the path in Settings.

How often should you scan?

Scan once a week as a minimum, after installing or updating plugins, and any time something looks wrong. Most infections we clean had been on the site for weeks before anyone noticed. Moatline Pro adds a daily automatic scan with an email alert.

Frequently asked questions

More guides

• How to remove malware from WordPress
• WordPress site hacked? What to do in the first hour