How to Scan WordPress for Malware

What WordPress malware looks like

Malware is not one thing. These are the types you are most likely to meet.

• Back doors and web shells: small scripts that let an attacker run commands or upload files later.
• Spam injections: hidden links or pages that sell pills, loans or counterfeit goods.
• Redirects: code that sends some visitors, often those arriving from search, to another site.
• Skimmers: scripts that copy form or card details.
• Rogue users and scheduled tasks: accounts and cron events that give the attacker a way back.

Four checks that work together

A good scan does more than one job.

• Core file integrity: compare every WordPress core file with the official copy for your version. Any difference, or any extra PHP file in core folders, is suspicious.
• Signatures: look for patterns of known malware inside your files.
• Heuristics: flag files that look scrambled, with extremely long lines or random-looking text, which is how attackers hide code. This finds more, but also flags some harmless files.
• Outdated components: flag plugins and themes that are far behind, because old versions are where known weaknesses live.

How to scan WordPress for malware with a plugin

A security plugin runs these checks from the dashboard and keeps the results in one list.

1. 1Install a malware scanner and open its scan screen.
2. 2Make sure core, signature and heuristic checks are all switched on.
3. 3Run the scan and wait. Large sites can take several minutes.
4. 4Sort the findings by severity and open the most serious first.
5. 5For each finding, check the file path, the rule that matched and when it was first seen.
6. 6Decide what to do with each one (see below), then scan again to confirm it is gone.

Check by hand with WP-CLI and the shell

If you have command line access, you can run useful checks without a plugin. These compare files against the official WordPress.org copies and surface the places malware likes to hide.

Expect some noise from premium plugins, which WP-CLI cannot verify because they are not on WordPress.org.

# Compare core files with the official checksums
wp core verify-checksums

# Compare wordpress.org plugin files (premium plugins are skipped)
wp plugin verify-checksums --all

# PHP files in uploads are almost never legitimate
find wp-content/uploads -name "*.php"

# Files changed in the last 7 days
find . -type f -mtime -7 -not -path "./wp-content/cache/*"

# Common obfuscation patterns (review matches, do not delete blindly)
grep -rIlE "eval\(base64_decode|gzinflate\(base64_decode" wp-content

Reading results and false positives

Not every finding is malware. Minified scripts, licence checkers and some page builders contain code that looks strange but is harmless. Heuristic checks produce the most false alarms.

Judge a finding by the file, not the label. A hit in a core file that differs from the official copy, a PHP file in uploads, or a file you cannot explain in a plugin you do not use deserves attention. A hit in a well-known plugin's bundled JavaScript is far less likely to be a problem.

What to do with a finding

Resist the urge to delete files blindly. Work through them in a safe order.

1. 1Make a copy of the site first, so you can bring back anything you removed by mistake.
2. 2Replace modified core files with clean ones from WordPress.org rather than editing them.
3. 3Reinstall plugins and themes from their official source instead of deleting single lines.
4. 4Quarantine or remove files that clearly do not belong, such as PHP files in uploads.
5. 5Mark known harmless findings as ignored so they do not bury new ones.
6. 6If you find real malware, treat it as a hack: change passwords and keys, look for back doors and find the way in.

Scan on a schedule and watch for changes

A scan is a snapshot. Malware can arrive tomorrow, so scan daily or weekly and send the result to an inbox somebody reads.

File change monitoring complements scanning. It records a fingerprint of every code file and tells you when one is added, changed or removed, which catches new malware that no signature knows yet. Expect a list of changes after every update and acknowledge the expected ones.

What a clean scan does not prove

A clean result lowers the risk but cannot prove a site is safe. Scanners look for known patterns and suspicious shapes, and attackers write code to avoid both. Malware in the database, in a server outside WordPress, or in files a scanner skips because they are too large can all go unseen.

Combine scanning with updates, strong access control, file change monitoring and tested backups.