Malware scanning and cleanup

The Malware tab of a site’s Security page finds injected and modified code and lets you clean it up from the dashboard: delete, quarantine, or restore the original file. It is built to work even on a site that malware or a bad update has already broken.

How the scan works

Instead of guessing, the scan compares your site against known-good originals wherever originals exist:

• WordPress core is verified file by file against the official checksums from WordPress.org, including unexpected extra files in core directories.
• Plugins from WordPress.org are verified against their official checksums.
• Themes from WordPress.org are verified against the official theme packages (code files, where injected malware actually lives).
• Everything else (uploads and remaining wp-content) goes through heuristics that catch the classic patterns: PHP files inside uploads, hijacked auto-load settings, obfuscated code and web shells.

The scan runs on the site in short slices, like backups, so shared hosting handles it fine.

Reading the results

Each finding shows the file, why it was flagged, its severity, and a snippet of the suspicious code so you can judge it yourself. A modified core file is not always malware (some hosts patch files), which is exactly why you see the evidence before acting.

Cleaning up

Every finding offers only the actions that make sense for it:

• Restore original: for modified core files. The pristine file is downloaded from WordPress.org, checksum-verified, and swapped in atomically.
• Quarantine: moves the file into a locked folder on the site (wp-content/dwp-quarantine, blocked from the web) where it can do no harm but is not lost. If the file turns out to be legitimate, Restore from quarantine puts it back.
• Delete: removes the file permanently. Prefer quarantine unless you are sure.

Each action asks you to confirm with a second click, and the finding’s status updates in place as actions complete. A few files are protected and can never be deleted or quarantined through the dashboard: wp-config.php and the connector itself.

Broken sites still scan

Malware scans and cleanup deliberately use the connector’s rescue path, the same mechanism that lets backups restore a fataling site. A site that crashes on every request because of injected code is exactly the site that most needs the scan, and it still works there.

Scanning automatically

With automatic scans enabled (Premium), the malware scan runs on schedule together with the security scan, and its result feeds the security score. Manual scans with the tab’s Scan now button are free on every plan.