Malsift – Malware Scanner & Cleanup

Malsift checks a WordPress site the way an incident responder would after a hack, and puts every result on one dashboard.

Files

• Compares WordPress core files with the official WordPress.org checksums.

• Compares plugins from WordPress.org with their official releases and flags modified or extra files.

• Scans everything that cannot be verified (themes, premium and custom plugins, uploads, the site root) for malicious code: encoded loaders, code run from web requests, webshells, droppers and obfuscation.

• Finds hidden loader files, suspicious must-use plugins, look-alike plugin folders, PHP files in uploads, and injected.htaccess /.user.ini rules.

Access

• Lists administrator accounts created in the last 30 days.

• Reviews application passwords (API keys), flags names used by attackers, and lets you approve or revoke each key.

Database

• Finds casino and betting spam: betting brand names in titles, text or links, and bursts of posts created within minutes of each other.

• Finds obfuscated scripts and hidden iframes in settings, widgets and content, and a changed site address.

• Flags suspicious scheduled tasks.

Hardening

• Checks that PHP has the fixes for PHP2Shell (CVE-2026-109618, CVE-2026-109619).

• Shows whether the theme/plugin code editor is enabled (and can disable it), two-factor coverage for administrators, and pending updates.

Firewall and login protection

• Request firewall that blocks SQL injection, script injection (XSS), path traversal, PHP and shell command injection, and known attack tools. It checks requests while plugins are still loading, before WordPress runs its hooks, so it also protects other plugins. Requests too large to inspect are treated as suspicious.

• Learning mode logs attacks without blocking them, so you can check for false alarms before switching to Protect. Logged-in editors and administrators are never blocked.

• Limits failed logins on wp-login.php and XML-RPC, and locks out password-guessing bots.

• Blocks XML-RPC multi-call password guessing and pingback abuse, or turns XML-RPC off completely.

• Stops visitors from listing usernames through author scans, the users REST endpoint and the users sitemap.

• Optionally blocks PHP from running in the uploads folder (Apache and LiteSpeed), so an uploaded webshell cannot be used.

• Allow and block lists for IP addresses and ranges, and correct visitor IPs behind Cloudflare and proxies on your own network.

• Event log with one-click “Not an attack”, “Block IP” and “Unlock” buttons.

Clean-up

• Restore modified core and WordPress.org plugin files with verified official copies.

• Quarantine suspicious files and folders. Quarantined files are stored compressed in a protected folder, cannot run, and can be restored.

• Reinstall WordPress core, and plugins and themes from WordPress.org, in one click. Changed and extra files are backed up to quarantine first.

• Revoke API keys, move spam posts to the trash or delete them permanently (large batches are processed in steps), remove suspicious scheduled tasks.

• “Fix all threats” applies only safe automatic fixes; anything that could break a plugin or theme is left for you to review.

• Daily automatic scan, optional email alerts, scan history and a printable report.

Every scan runs in short steps, so it works on shared hosting without timeouts.

External services

org only:

• api.wordpress.org – official checksums for your WordPress version (the same service WordPress core uses).

• downloads.wordpress.org – official checksums for plugins hosted on WordPress.org.

• core.svn.wordpress.org and plugins.svn.wordpress.org – clean copies of individual files, downloaded only when you choose to restore a file. Every download is verified against the official checksum before it is written.

• downloads.wordpress.org – WordPress, plugin and theme packages, downloaded only when you choose to reinstall them, through WordPress’s own updater.

Only your WordPress version, locale, and the slug and version of installed plugins are sent, as part of the request URL. No other site data, personal data or file contents are sent anywhere. org/about/privacy/