Almost every WordPress security plugin claims to include a malware scanner. The word covers everything from a serious multi-stage analysis engine to a script that checks a dozen file names and calls it a day. From the settings page, the two look identical. The difference only shows up when there is real malware on your site, which is the worst possible moment to discover your scanner is the shallow kind.
This guide breaks down what a WordPress malware scanner actually needs to do, so you can evaluate any plugin, including ours, against a concrete checklist instead of marketing copy. We build WordSec, so we will use its Scanner module as the running example, and you can hold competitors to the same standard on the comparison page.
Why scanner quality varies so much
Malware authors know their code will be scanned, so they respond: obfuscated payloads, code hidden in the database instead of files, malicious cron jobs that reinstall the backdoor after cleanup, and file names that imitate legitimate WordPress components. A scanner that only greps files for known strings loses this game quickly.
A scanner worth running has to look everywhere malware hides, know what clean looks like, and give you safe tools to respond. That translates into nine concrete capabilities.
The 9 capabilities that matter
1. File integrity checking against known-good sources
The most reliable detection method is not recognizing malware, it is recognizing that a file is no longer what it should be. A proper scanner compares your WordPress core files against the official originals and reports added, deleted, and changed files. Signature-based detection can be evaded by novel malware; an unexplained change to wp-settings.php cannot hide.
WordSec runs file integrity as a dedicated scan stage and reports every addition, deletion, and modification.
2. Signature-based malware detection that gets updated
Integrity checks catch tampering; signatures identify what the tampering is. Ask two questions about any scanner: how many detection rules does it ship, and do they update as new campaigns appear? WordSec currently ships 117 malware detection rules, with 20 available on the free plan and the full set on Premium.
3. Coverage beyond files: database and cron tasks
Two favorite hiding spots of modern WordPress malware are not files at all:
- The database, where injected scripts live inside posts, options, and widgets.
- Scheduled cron tasks, where a malicious job quietly re-downloads the payload after every cleanup. This is how many "I removed it but it came back" stories work.
WordSec dedicates separate scan stages to both, alongside its file stages: seven stages in total, covering file integrity, version checks, permissions and ownership, leftover backup and log files, malware signatures, cron tasks, and the database.
4. Permissions, ownership, and leftover-file auditing
Malware needs writable targets, and attackers love forgotten files. A thorough scanner audits file permissions and ownership for dangerous configurations, and flags leftover backups and log files, the backup.zip and error.log files that leak credentials and site structure to anyone who guesses the URL.
5. Scheduled and remote scans
A scanner you must remember to click is a scanner that stops running the week you get busy. Look for scheduled scans as a baseline. WordSec adds a remote scan trigger, so agencies and monitoring setups can start scans from outside the WordPress admin, and configurable quick-scan stages for a fast daily check between full scans.
6. A low resource mode
Scanning a large site means reading a lot of files, and on shared hosting a careless scanner can slow the site or die mid-scan. WordSec ships a low resource mode that spreads the work out so background scans never compete with your visitors. If a scanner has no answer to the resource question, its full scans will fight your traffic for CPU.
7. Safe inspection of findings
When the scanner flags wp-content/uploads/cache.php, your next step should not be opening that file in cPanel. A good scanner lets you view the flagged content safely inside the dashboard. WordSec goes a step further and lets you check any flagged file on VirusTotal with one click, adding dozens of independent antivirus opinions to the verdict. Among the major WordPress security plugins, that VirusTotal integration is currently unique to WordSec.
8. Quarantine, delete, and restore
Response actions need an undo button. False positives happen with every scanner, and deleting a file a plugin depended on takes a site down. The safe workflow is quarantine first: disarm the file, watch the site, then delete permanently or restore the original if it turns out clean. WordSec supports all three actions per finding, plus an auto fix for common issues like modified core files.
9. Scan history
One scan is a snapshot; a history is a trend. Keeping full scan history lets you answer questions that matter during an incident: when did this file first appear, was last month clean, did the cleanup actually stick? WordSec stores the complete history of every scan.
The checklist, in one table
| Capability | Why it matters | WordSec |
|---|---|---|
| File integrity vs core originals | Catches tampering signatures miss | Yes, dedicated stage |
| Updated malware signatures | Identifies known campaigns | 117 rules |
| Database scanning | Finds injections outside files | Yes, dedicated stage |
| Cron task scanning | Stops self-reinstalling malware | Yes, dedicated stage |
| Permissions and leftover-file audit | Closes attack enablers | Yes |
| Scheduled and remote scans | Detection without human memory | Yes |
| Low resource mode | No performance hit on shared hosting | Yes |
| Safe content view plus VirusTotal | Verify findings without risk | Yes |
| Quarantine, delete, restore, auto fix | Reversible response | Yes |
| Scan history | Incident timeline and trend | Yes |
Print this table and test any security plugin against it. Where a vendor's docs go quiet on a row, that row is usually the answer.
Scanning is detection, not prevention
One honest note to close the loop: even a perfect scanner tells you about malware after it arrives. The full defense pairs the scanner with a firewall to block payloads on the way in, login protection to keep credentials safe, and supply chain monitoring to warn about vulnerable plugins before they are exploited. WordSec bundles all of these in one plugin, which is exactly the point of it.
Frequently asked questions
What is the best free WordPress malware scanner?
Judge any candidate against the nine capabilities above, applied to its free tier. WordSec's free plan includes the full seven-stage scan engine, file integrity monitoring, scheduled scans, quarantine and restore, and 20 malware detection rules, with the complete 117-rule set on Premium. The comparison table shows how that free tier stacks up against other plugins' free scanners.
How often should I scan my WordPress site for malware?
Run a full scan at least daily via scheduling, with quick scans more often if the site is high-value. Scans are automated, so frequency costs you nothing in effort, especially with a low resource mode keeping performance flat.
Can malware hide from a scanner?
It tries. Obfuscation dodges weak signature matching, database injections dodge file-only scanners, and cron-based droppers dodge one-time cleanups. That is exactly why multi-stage coverage, integrity checking, and cron and database stages are the difference between a scanner and a checkbox.
My scanner found a file. Should I delete it?
Quarantine it instead. Quarantine disarms the file but keeps it restorable if it turns out to be a false positive. Verify with the built-in content view and a VirusTotal check, then delete once you are sure. The full workflow is in How to Find Malicious Files in WordPress.
Does malware scanning slow down a website?
It can, if the scanner reads thousands of files at full speed on shared hosting. WordSec's low resource mode throttles the scan so visitors never notice, which is also why scheduled daily scans are practical rather than painful.
See what a real scan finds: install WordSec free, run the seven-stage scan, and if something turns up, the removal guide takes you the rest of the way.