DevDome Malware Scanner checks WordPress files and database content for malware, backdoors and suspicious changes, and shows the evidence behind every finding. Scanning, quarantine, eligible repairs and reinfection checks work without an account.
Free and GPL licensed, reviewed by the WordPress.org plugin team.
Inspect files, database content and possible routes back into the site. Each finding explains what was flagged so you can decide whether it needs cleanup or further investigation.
Verify WordPress core and WordPress.org plugins against official checksums, and WordPress.org themes against their installed-version packages. Premium and custom code baselines track later changes. They record existing code without establishing safety.
Find suspicious execution, hidden code and remote downloads. PHP analysis checks behavior including request input reaching execution and downloaded content written to disk. Upload checks flag executable files and PHP disguised as images or documents.
Check options, posts, revisions and metadata for injected scripts, hidden iframes, spam and hidden links. Inspect wp-config.php, .htaccess and .user.ini for suspicious code or settings. Findings remain available for your review and decision.
Open findings to see affected items, flagging reasons and supporting evidence. Compare modified core and WordPress.org plugin files with official copies. Coverage gaps show skipped, failed or partial checks, identifying where the verdict is incomplete.
One-click fix quarantines or officially repairs eligible findings. Quarantine removes files from disk, keeping restorable database copies. Repair backs up affected files, reinstalls the same core or plugin version from WordPress.org and verifies the resulting package.
Review unexpected administrators, scheduled tasks, must-use plugins and drop-ins together. Where available, Neutralize removes administrator rights or scheduled events, or quarantines suspicious files, helping address access and files left after cleanup. The plugin cannot restore removed scheduled tasks.
Run scans manually, daily or weekly, and pause, resume or cancel. Adjust batch duration, deep-scan size limits or excluded paths. Scans use short batches with WP-Cron fallback when the admin tab closes, and report reduced coverage with results.
On WordPress 6.9+, compatible AI agents use WordPress Abilities to read findings, control scans, manage settings and perform cleanup. MCP requires an adapter; permission rules remain unchanged. Cleanup, restore and permanent deletion require an explicit confirmation flag from the agent.
The first scan checks integrity and records the file baseline. Later scans add the change timeline. An account connection is optional.
Install DevDome Malware Scanner and open Malware Scanner in the WordPress admin menu. Start without connecting a DevDome account.
Keep the admin page open to drive short scan batches. After closing it, progress depends on the WP-Cron fallback. Pause, resume or cancel the scan.
Review threat status, severity counts, evidence and unverified areas before deciding. Use available cleanup actions for eligible findings; review Needs your decision items. After cleanup, rescan to check what remains.
Quarantine removes files from disk but keeps their contents in the plugin database for restoration. Restore returns files to their original paths and verifies their hashes. Restoring suspicious files restores their original contents too. Permanent deletion is separate. Uninstalling also removes the quarantine table, so restore any copies you need first.
Yes. Repair reinstalls the whole core or plugin package at the installed version. It backs up files in quarantine first, then checks the result against official checksums. If reinstallation fails, it attempts to restore backups and reports remaining recovery work. Repair is available only for eligible findings.
Scanning uses PHP time on your server. Batches default to 8 seconds per request, adjustable from 3 to 25 seconds. On constrained hosting, lower the batch duration or pause the scan. Scheduled scans and progress after closing the admin page depend on WordPress cron running.
No. Scanning, quarantine, eligible repairs, reinfection checks and local scan history work without one. A free account adds downloaded byte-pattern signatures, known-malware hash lookups, cloud reports and threat alert emails. Without ever connecting, there is no known-malware signature matching. After disconnecting, downloaded byte patterns can still match locally, but updates and hash lookups stop.
The scanner and local cleanup tools are free. The optional account for byte-pattern signatures, hash lookups, the security dashboard and threat alert emails is also free. No scanner feature requires a paid DevDome plan.
Excluded paths, unreadable files, size limits and failed checks can leave areas partly checked or unchecked. Coverage gaps identify these limits. Premium or custom code baselines only record the starting state; unchanged does not mean safe. Vulnerability checks are optional and off by default. Read the verdict alongside its coverage notes.
Changed files or new administrators warrant investigation but do not prove infection. Severity describes potential impact; confidence describes how strongly evidence suggests malicious activity. Low and Info findings are review notes. Inspect evidence and available file comparisons before acting. You can report false alarms without an account and preview reports before sending.
Official verification sends WordPress.org version and package details. Account-based malware lookups send file hashes, not contents. Cloud reports include finding summaries and paths. Enhanced analysis is a separate opt-in sending short suspicious code fragments and a path hint. It attempts to redact secrets but cannot cover every format. Optional detection telemetry is off by default.
Installation, settings, data use and troubleshooting, before you install.
Install DevDome Malware Scanner from WordPress.org (Plugins, Add New, search for DevDome Malware Scanner) or upload the ZIP, then activate it.
No account is needed for scanning, quarantine, eligible repairs and reinfection checks. A free DevDome account adds downloaded byte-pattern signatures, known-malware hash lookups, cloud reports and threat alert emails.
On multisite, the scanner needs network administrator access because file checks and cleanup can affect shared core and plugin files. Each site keeps its own scan data.
Open Malware Scanner in the admin menu and press Scan Now. The first scan verifies core, plugin and theme files against official copies and records the file baseline; later scans add the change timeline.
Keep the admin page open to drive the scan in short batches (8 seconds per request by default, adjustable from 3 to 25). If you close it, progress depends on the WP-Cron fallback. Scheduled scans run daily or weekly through WordPress cron.
Settings let you adjust batch duration, deep-scan file size limits and excluded paths, and switch on the optional vulnerability check. Reduced coverage is reported with the results.
Official verification contacts WordPress.org with version and package details. Account-based malware lookups send file hashes, not file contents. Cloud reports include severity totals and details for up to 50 findings (titles, relative paths, status, hashes and sizes), the plugin screen address and software versions; critical or high findings can trigger an email to your account address. Connecting an account sends your site address, a generated site ID and a secret site token; connecting through the dashboard card also shares active DevDome plugin versions plus library, WordPress and PHP versions. The plugin catalog is fetched only after connecting.
The optional vulnerability check, off by default, sends the slugs and versions of your installed plugins, themes and WordPress core to wpvulnerability.net and compares them with published records. It does not test the site itself.
Enhanced analysis is a separate opt-in that sends short suspicious code fragments and a path hint; it attempts to redact secrets but cannot cover every format. Optional detection telemetry is off by default and, on unconnected sites only, sends up to 50 finding details with an anonymous site identifier after each scan, never file contents or your email. False-alarm and scan reports show their exact contents before sending and carry your site address, software versions, finding details and your optional note and reply email. Report this error sends redacted error text, software versions, the current screen, the last 20 scanner log lines with secrets removed, your site address and your administrator email, only when you press the button.
Quarantine keeps a restorable copy of each removed file in your own database. Nothing is deleted permanently unless you choose Delete permanently, and uninstalling the plugin also removes the quarantine table with its stored copies.
Updates come from WordPress.org like any other directory plugin: WordPress shows "Update available" on the Plugins screen and installs the new version from there.
Deactivating stops scheduled scans. Deleting the plugin removes its tables, settings and scheduled tasks, including the quarantine table. Restore or delete quarantined files before uninstalling if you still need them.
A changed file or a new administrator is a reason to investigate, not proof of infection. Open the finding to see the evidence and the file comparison before acting. You can report a false alarm without an account and preview the report before it is sent.
Scanning slows the site: lower the batch duration in Settings, pause the scan, or run it at a quieter time. Scheduled scans and progress after closing the page depend on WordPress cron running.
Areas reported as coverage gaps (excluded paths, unreadable files, files above the size limit, failed checks) were not verified. Unscanned areas cannot be called clean.
Still stuck? Ask on the WordPress.org support forum or use the DevDome contact form. For a security problem, use the Report a security issue tab instead.
Read from the WordPress.org release when this site was last synced. The two latest versions are shown here; the full history is on WordPress.org.
Please tell us before telling anyone else, and we will fix it and credit you if you want the credit. Use the contact form and say it is a security report, so it gets read first.
We are a small team, so we will not pretend to a 24/7 security desk or a guaranteed response time. We will read it, reply, and tell you honestly what we are doing about it.
Install DevDome Malware Scanner, open it in WordPress and press Scan Now. No account is required.
