How to Scan WordPress for Malware with Security Plugins
A compromised WordPress site can show subtle warning signs long before visitors see an obvious redirect. Unfamiliar administrator accounts, sudden slowdowns, altered search results, spam pages and unexpected files may all indicate malicious code. A security plugin gives you a practical way to inspect the installation without manually examining every folder.
Malware scanning works best as part of a wider security routine. You need a recent backup, a current WordPress core, trusted plugins and a clear process for reviewing alerts. This is especially useful for Australian bloggers and small businesses that may run a site on shared hosting in Sydney, Melbourne or another local data centre while managing the website themselves.
Prepare Your WordPress Site Before Scanning
Start by recording the current state of the site. Check the WordPress version, active theme, installed plugins and administrator accounts. Make a full backup of the database and website files before changing anything. Store one copy outside the hosting account, such as in encrypted cloud storage, because malware can sometimes affect backup files kept in the same environment.
Use your hosting control panel to review recent file changes, error logs and login activity if those features are available. A sudden increase in PHP errors or unfamiliar cron jobs can provide useful context for a scan. If your host offers daily backups, confirm how long they are retained and whether you can restore a clean version without waiting for support.
A clean backup is particularly important for sites connected to online shops, bookings or lead forms. A careless cleanup can remove legitimate custom code or break a theme. If the site handles Australian customer information, consider the privacy implications of exposing that data during an incident and follow relevant guidance from the Office of the Australian Information Commissioner.
Choose and Configure a Malware Scanner
Popular WordPress security plugins take different approaches. Wordfence scans core files, themes and plugins against known versions and malware signatures. Sucuri Security provides integrity checks and activity monitoring, while MalCare performs much of its scanning remotely. Solid Security focuses strongly on hardening, login protection and suspicious behaviour detection. Features and pricing change, so check the current plugin documentation before relying on a particular function.
Install a security plugin from the WordPress dashboard or the developer’s official site. Avoid downloading “nulled” premium plugins from file-sharing websites: these are a frequent source of backdoors. After activation, allow the plugin to complete its initial setup, then enable scanning of WordPress core files, plugin files, theme files, uploads and database content where supported.
Review the scan settings before starting. A high-sensitivity scan may find obfuscated code, suspicious links and altered files, but it can also create false positives in custom themes or older plugins. Set email alerts to an address you check regularly, enable two-factor authentication for administrator accounts, and restrict alerts if they become too noisy to be useful. Site owners can also learn more about the person behind this blog through Yuuki’s background before applying broader WordPress and engineering advice.
Run the Scan and Read Its Findings
Begin with a full scan rather than a quick scan. A quick scan may inspect common locations and recent changes, while a full scan examines a wider range of files and database records. On a large site, the process can consume server resources. Schedule it during a quieter period for Australian visitors, such as late evening in the site’s main audience time zone, and monitor CPU and memory usage.
When the scan finishes, classify each result instead of deleting everything marked as suspicious. Compare modified core files with the official WordPress checksums. Look at the file path, the detected code, the date modified and the plugin or theme that owns the file. A PHP file inside an uploads directory deserves close attention because media folders generally should not contain executable scripts.
| Scan finding | What it may indicate | Sensible next step |
|---|---|---|
| Changed WordPress core file | Malware or an incomplete update | Compare checksums and reinstall core files |
| Unknown administrator account | Account compromise or unauthorised access | Preserve evidence, disable the account and reset credentials |
| PHP file in uploads | Web shell or backdoor | Quarantine it and investigate related access logs |
| Suspicious JavaScript | Redirect, skimming code or injected advertising | Inspect the source and test affected pages |
| Outdated vulnerable plugin | Entry point for an attack | Back up, update or remove the plugin |
| False-positive warning in custom code | Legitimate feature flagged by a signature | Verify the source before allowing or excluding it |
An alert is evidence, not an automatic diagnosis. Search the exact filename and code fragment in the plugin’s documentation, support forum or a trusted security resource. Do not whitelist a warning simply because the homepage appears normal. Attackers commonly hide code in less-visited pages, scheduled tasks or administrator profiles.
Respond to Confirmed Malware Carefully
If you confirm malicious code, put the site into maintenance mode or temporarily restrict access while preserving a copy for investigation. Change passwords for WordPress administrators, hosting, SFTP, the database and the domain registrar. Use unique passwords and enable multi-factor authentication wherever possible. Review active sessions and revoke access for accounts you cannot verify.
For a small site with a known clean backup, restoring that backup can be safer than removing individual snippets. Update WordPress, the theme and every required plugin immediately after restoration, then scan again. If no clean backup exists, use the scanner’s repair function only after downloading a backup of the infected state. Automatic repair can overwrite customised files or remove code that the site genuinely needs.
Contact your hosting provider if the infection returns after cleanup, files keep changing or several sites under the same account show symptoms. Shared hosting can allow one vulnerable installation to affect neighbouring sites within the same account. Providers with Australian support teams may align response times with AEST or AEDT, but emergency assistance still depends on the hosting plan. For freelancers handling client websites, documenting the incident and scope of work is as important as the technical fix; a useful reference is this business entity guide.
Build a Repeatable Scanning Routine
A security plugin cannot compensate for neglected maintenance. Set WordPress, plugins and themes to update promptly after checking compatibility and backups. Delete inactive components that are no longer required, because an unused plugin can still contain a vulnerability. Use a reputable managed host, limit administrator privileges and disable file editing from the WordPress dashboard where appropriate.
Run a full malware scan at least weekly for a normal blog, and more often for an online shop, membership site or publication with frequent logins. Review scan logs rather than only reacting to email alerts. A monthly manual check should cover administrator accounts, DNS records, domain renewal settings, payment integrations and recent backup success. Australian businesses may also use the Australian Cyber Security Centre’s guidance to strengthen broader systems beyond WordPress.
Test the site after each cleanup from a private browser window and a mobile connection. Check the homepage, contact forms, checkout, redirects, search snippets and key landing pages. Clear caching layers after remediation so an old infected page is not still being served by the host, CDN or browser.
The practical workflow is simple: create an external backup, run a full scan, verify each alert, quarantine confirmed malware, restore or repair carefully, update every component and scan again. Keeping that routine in a calendar—alongside Australian business and tax deadlines—turns a security plugin from a reactive alarm into a dependable part of WordPress maintenance.