Skip to content

Malware

Malware scanner

Every planAbout Malware Scanning

Searches your site's files for malicious code, checks WordPress's own files against the official copies, and flags plugins and themes that are far behind on updates.

What it does

Core file integrity compares every WordPress file with the official copy for your version and language, and flags extra PHP files in the WordPress folders.

Malware signatures look for the patterns of known back doors, web shells, hidden redirects and injected code.

Heuristic analysis (optional) flags PHP files that look scrambled, with extremely long lines or random-looking text, which is how attackers hide code.

Known vulnerabilities flags plugins and themes that are several versions behind the latest release, because old versions are where known weaknesses live.

Why it matters

Malware is built to stay hidden: the site looks normal while it sends spam, steals data or redirects visitors. A scan finds what you cannot see.

Run a scan

  1. Go to the Malware tab, section Scan, and click Run Scan. Progress shows on the scan console.
  2. When it finishes, review section Findings, sorted with the most serious first. Click a finding to see the file, the rule that matched and when it was first found.
  3. Deal with each finding: see Findings and quarantine.

Scan on a schedule

  1. In section Schedule and scope, switch on Scheduled scans.
  2. Choose daily, weekly or monthly, the day and the time, then click Save Settings.
  3. Under Scan checks, choose which checks run. Heuristics find more but also flag some harmless files.
  4. To get an email when something is found, switch on the Malware Issues Found alert on the Notifications tab.

Good to know

Manual scan policy only marks scans as overdue on this tab when you have not scanned for a while. It never starts a scan by itself.

The signature check skips uploads and cache folders and files over 5 MB.

The vulnerability check compares version numbers; it does not look up a vulnerability database. A known vulnerability lookup is on the roadmap.

Which plan includes it

Manual scans with core, signature and heuristic checks are in every plan. Scheduled scans and the vulnerability check are part of Pro.

How it works, for developers
  • Core check: MD5 hashes from api.wordpress.org/core/checksums/1.0 for your version and locale, falling back to en_US.
  • Signatures are regular expressions run over .php, .js, .htaccess, .html and .htm files; the quarantine and backup folders are skipped.
  • Heuristics: PHP files under 2 MB with lines over 5,000 characters, or text randomness (Shannon entropy) above 5.5 in files over 1 KB.
  • Version check: asks the WordPress.org plugin and theme directories for the latest version. Plugins 3 or more versions behind are medium, 5 or more high; themes 2 or more are medium.
  • Results are stored in the smg_malware_scans and smg_malware_issues tables. The schedule uses the smg_malware_scan task, booked one run at a time. Scans and resolved findings older than 90 days are removed daily, always keeping the latest 10 scans.
  • Settings: smg_malware_check_core, smg_malware_check_signatures, smg_malware_check_heuristics, smg_malware_check_vulns, smg_malware_manual_policy, smg_malware_schedule_enabled, smg_malware_scan_frequency and the day and time fields.

Quick answers about malware scanner

What does Malware scanner do in Stack Guard?

Core file integrity compares every WordPress file with the official copy for your version and language, and flags extra PHP files in the WordPress folders. Malware signatures look for the patterns of known back doors, web shells, hidden redirects and injected code. Heuristic analysis (optional) flags PHP files that look scrambled, with extremely long lines or random-looking text, which is how attackers hide code. Known vulnerabilities flags plugins and themes that are several versions behind the latest release, because old versions are where known weaknesses live.

Why use malware scanner on a WordPress site?

Malware is built to stay hidden: the site looks normal while it sends spam, steals data or redirects visitors. A scan finds what you cannot see.

How do I set up malware scanner?

1. Go to the Malware tab, section Scan, and click Run Scan. Progress shows on the scan console. 2. When it finishes, review section Findings, sorted with the most serious first. Click a finding to see the file, the rule that matched and when it was first found. 3. Deal with each finding: see Findings and quarantine.

Which Stack Guard plan includes malware scanner?

Manual scans with core, signature and heuristic checks are in every plan. Scheduled scans and the vulnerability check are part of Pro.

More in Malware

Not running Stack Guard yet? It is free.

Download Free