Scanning a WordPress site for malware sounds simple — run a tool, read the result — but the kind of scan you use makes an enormous difference to what it can actually find. A site can pass one scanner and be riddled with backdoors a different method would catch in seconds. This guide explains the options, in order of how deep they see, and how to act on what they report.
First, the signs you might be infected
Scan straight away if you notice unexpected redirects, spammy pages in search results, a Google “this site may be hacked” warning, admin users you didn’t create, unfamiliar files, sudden slowdowns, or a warning from your host. But don’t wait for symptoms — plenty of infections stay silent for weeks, which is why periodic scanning matters even when everything looks fine.
The three ways to scan, from shallow to deep
1. Online URL scanners. These load your public pages from the outside and look for visible badness — a known-malicious script, a blacklist listing, an obvious redirect. They’re free and instant, and useful as a first check, but they only see what a visitor’s browser sees. Anything on the server that isn’t rendered on the pages they fetch — which includes most backdoors — is completely invisible to them.
2. Signature-based scanners. These run on the site, read your files, and compare them against a database of known malware patterns. This catches commodity malware reliably. The limitation is in the word “known”: a backdoor that is custom-written, obfuscated, or just a few malicious characters tucked into an otherwise-legitimate file has no signature to match, so it slips through. New and targeted infections are exactly the ones signature scanning tends to miss.
3. Integrity-based scanning. Instead of asking “does this file match known malware?”, integrity scanning asks “is this file what it’s supposed to be?” It compares your core, plugin, and theme files against known-good versions — the official WordPress.org checksums, plus a baseline of your own files — and flags anything added, modified, or removed. Because it doesn’t rely on recognising the malware, it catches the unknown and custom threats that defeat signature scanning. This is the method that reliably surfaces injected code and planted backdoors.
How to scan properly
- Start with a quick online URL scan to confirm whether anything is already visible or blacklisted.
- Run an on-site scan that includes an integrity check, so added and altered files show up regardless of whether they match a signature.
- Review the results against what you expect: a file changed right after you updated a plugin is normal; a modified core file or a new script in your uploads folder is not.
- Don’t stop at the first hit. Malware usually comes with company — keep going until the scan is clean.
What to do when a scan finds something
Finding the malware is only half the job. Before you delete anything, take a snapshot for evidence, then trace back to the entry point — the vulnerability that let it in — and remove every backdoor, not just the visible payload. Clean only the symptom and you’ll be scanning again next week; we explain why in why your WordPress site keeps getting hacked. The full recovery sequence is in what to do when your site is hacked.
DefendMyWP’s scanner is built around integrity checking — it compares your files against official WordPress.org hashes and your own baseline, so it catches tampering a signature scan would miss, and keeps watching so you learn about a change in hours rather than when Google does.
