DevDome Malware Scanner tells you whether your WordPress site is infected, backdoored or set up to reinfect itself, and what changed. It verifies core, plugin and theme files against WordPress.org, reads PHP for behaviour chains instead of keywords, checks uploads, configuration, users, cron and the database, then closes the threats it can fix safely with one click. Nothing is deleted: files go to quarantine and can be restored.
Most scanners stop at a count of infected files. DevDome Malware Scanner says what changed, why it is suspicious, how confident it is, and what to do next.
Core files are checked against the official checksums, WordPress.org plugins against theirs, and WordPress.org themes against the official zip of the installed version, including unknown files inside those folders. Premium and custom code is tracked against a baseline with a file change timeline.
PHP is read token by token for behaviour chains: request input to execution, decode to execution, remote download to disk write. Obfuscation signals (encoded blobs, entropy, chr() chains, hex escapes) and disguised media in uploads feed the same risk engine.
Options, posts, revisions and meta are swept for script and iframe injections, encoded payloads, SEO spam and hidden links. wp-config.php, .htaccess and .user.ini are inspected for auto-prepend directives, cloaking redirects and PHP handlers in uploads.
Administrator capabilities are read from usermeta, not just role labels. WP-Cron events, must-use plugins and drop-ins are tracked, and the Advanced Overview warns that the site may reinfect while any persistence finding remains.
Remove threats moves known malware, uploads executables, unexpected core files and high-confidence malicious code to quarantine and puts official copies back for modified core and plugin files, then rescans to verify. Theme files, database content, users, cron and configuration are left to you with plain advice.
Quarantined files sit in a folder blocked from the web and restore with one click. Repairs use the official copy of the same installed version, checksum-verified, written to a random temporary name and swapped in atomically; a failed repair puts the original back. View what changed shows the differing lines first.
The first scan verifies integrity and seeds the file baseline. Later scans add the change timeline.
Install Malware Scanner and open it in the admin menu. No account is needed for the scan itself.
Press Scan Now. The scan runs in short batches while the page is open and continues through WP-Cron when you close it. Pause or cancel at any time.
Read the verdict. Press Remove threats to quarantine known malware and put official copies back; the scan reruns to confirm. Items that need a human come with a plain explanation and a link to the right place.
No. Threats are moved to quarantine (wp-content/devdome-quarantine, blocked from the web) and can be restored from the Quarantine tab at any time. The only deletion is the explicit Delete permanently button on a quarantined file. Uninstalling removes the plugin tables and settings but leaves the quarantine folder as evidence.
No. Every scanning engine runs on your own server. Connecting a free account adds the 90,000+ known-malware signatures, the security dashboard and the alert email. Without an account there is no known-malware signature matching; the scanner relies on its heuristics and says so in the coverage notes.
It is built not to. Files WordPress cannot boot without are never quarantined. A repair replaces a file with the official copy of the same installed version, checksum-verified, after backing up the current file to quarantine; if the write fails, the original is put back. Theme files, database content, user accounts, cron tasks and configuration files are never changed automatically.
Because unscanned is not the same as clean. Excluded paths, files above the deep scan size limit, an unreachable checksum source, a file the previous scan could not finish and a stage that failed are all listed, and findings on files that could not be rechecked are kept, not resolved.
Severity is the potential impact (Critical, High, Medium, Low, Info). Confidence is how likely the finding is malicious. A known-signature match has 100% confidence; a high-entropy blob on its own is only a contributing signal. Low and Info rows are notes, not threats, and never trigger an alert.
Malware Scanner is coming to WordPress.org. Every scanning engine runs on your own server; a free DevDome account adds known-malware signatures, a security dashboard and alert emails.