Malware Scanning in WordPress: Tools and Process

What is website malware?

Website malware = malicious code that: - Redirects visitors to other sites - Steals data (card details, passwords) - Injects SEO spam (Viagra, Casino links) - Uses the server for crypto mining - Sends spam emails

How does malware get in?

Sucuri 2024 report: - 39% – Weak password - 28% – Outdated plugin - 22% – Outdated WordPress core - 11% – Weak hosting

Signs of infection

Visual - Strange ads appearing - Users complaining "the page redirected me somewhere" - Different content on mobile vs desktop - Homepage has been defaced

Technical - Search Console warning - Antivirus blocks visitors - Hosting provider sent an email ("incident notice") - Sudden spike in server load - File changes without your permission

SEO - Brand search displays "this site may be hacked" - Traffic dropped sharply - Strange pages indexed (`/casino-online.html`)

Scanning tools

Web scanners (quick) - [Sucuri SiteCheck](https://sitecheck.sucuri.net/) – free, fast - [Google Safe Browsing](https://transparencyreport.google.com/safe-browsing/search) – check if Google is blocking you - [Quttera](https://quttera.com/) – deeper analysis - [VirusTotal](https://www.virustotal.com/) – 70+ scanners at once

WordPress plugins - **Wordfence** – most popular, free + premium - **Sucuri Security** – professional, free - **iThemes Security** – comprehensive - **MalCare** – cloud scanning - **WPScan** (Jetpack) – official vulnerability database

Server-side - **ImunifyAV** – often found in cPanel - **Maldet** (Linux Malware Detect) – server level - **ClamAV** – open-source

The scanning process

1. Initial scan ```bash # Wordfence wp wfconfig set 'highSensitivity' true wp wf scan ```

2. File comparison Original WP files vs server files: ```bash wp core verify-checksums wp plugin verify-checksums --all ```

Any mismatches are suspicious.

3. Database check Search for: - `wp_options` table – strange `siteurl` changes - `wp_users` – unknown administrators - `wp_posts` – hidden posts (`post_status = 'draft'` with spam)

4. .htaccess check Hackers often add redirects: ```apache RewriteCond %{HTTP_USER_AGENT} (google|bing) [NC] RewriteRule ^.*$ http://evil.com [R,L] ```

5. Wp-config.php check Look for: - Eval calls - Base64 encoded code - Strange `define` lines

Common hiding places

In files - `/wp-content/uploads/` – .php files in image folders - `/wp-content/cache/` – hidden among cache files - `wp-includes/` – deep within the core - `favicon_*.ico.php` – disguised files

In code - Base64 encoding: `eval(base64_decode("..."))` - Obfuscation: long variable names, hex codes - Backdoors: `<?php @system($_GET['cmd']); ?>`

Removal process

See the detailed guide: Website hacked – what to do.

In short: 1. Backup the current state (as evidence) 2. Activate maintenance mode 3. Run a full scan 4. Remove malicious files 5. Replace WP core with clean files 6. Clean the database 7. Change ALL passwords 8. Activate 2FA (guide) 9. Add a WAF 10. Resubmit to Google

After cleaning

Search Console - Security Issues → "Request a review" - Usually takes 1–3 days - Include a description of what you did in the request

Monitoring 30 days of supervision: - Daily scanning - File integrity monitoring - Login attempt logs - Server load monitoring

Prevention

1. Regular maintenance – see WordPress updates
2. Strong passwords + password manager
3. 2FA for all admins
4. Plugins only from official repositories
5. Off-site backups
6. Quality hosting
7. WAF (Cloudflare, Sucuri)

Costs

Summary

Malware scanning should occur daily and automatically. Waiting just one day can lead to SEO consequences lasting months. Our management packages include daily scanning and immediate response. Request a quote.

Sources

• Sucuri Website Security Report
• Wordfence Threat Intel
• Google Search Console Help – Hacked Sites