Deep Malware Cleaner

No. The scanner runs only when you click Start Scan in the admin. It does not hook into page loads or run any background cron jobs. Visitor-facing performance is completely unaffected.

The scanner reads PHP-family files (.php, .php3, .php4, .php5, .php7, .phtml, .phar) plus the client-side formats most often used to deliver malware — JavaScript (.js, .mjs), HTML (.html, .htm), .svg, and .htaccess — inside your wp-content directory. To stay fast on shared hosting, it reads only the first 64 KB of each file (malware is injected at the top) and runs under a 20-second time budget per run.

Legitimate image, video, and document uploads are never .php files. If the scanner finds any PHP file inside wp-content/uploads/, it is almost certainly a backdoor uploaded through a vulnerable plugin or theme — a High severity threat that should be removed immediately.

The free plugin detects and reports threats, and lets you dismiss findings you've confirmed are false positives. Automatically moving an infected file out of harm's way — one-click Quarantine, with Restore to put it back — is available in Deep Malware Cleaner Pro. Without Pro you can still remediate manually: use the reported file path to remove or clean the file over SFTP or your host's file manager. Always review the file path and threat type before deleting anything.

Pro adds the one-click remediation engine: Quarantine safely moves an infected file to a protected, non-executable location (with a warning first if the file belongs to an active plugin or theme), and Restore puts it back if a detection turns out to be a false positive. Everything else — the file scan, database scan, pre-install upload guard, scheduled scans, email alerts, and login protection — is included in the free plugin.

Your scan results never leave your site — they are stored only in your own WordPress database. The plugin makes one external request, and only when you run the Core Integrity check: it downloads the official checksums for your WordPress version from api.wordpress.org, sending nothing but the version number and locale. If you never use that screen, no outbound request is made at all.

Every file in your WordPress installation is hashed with MD5 and compared against the official checksum list for your exact version and locale. Modified means a core file's contents no longer match the official release — the strongest single signal of a compromise. Unknown means a PHP file exists inside wp-admin or wp-includes that is not part of WordPress at all. Missing means a file in the checksums is not on disk, which some hosts cause by stripping optional files and is usually harmless.

Do not edit them by hand. Reinstall WordPress from Dashboard → Updates → Re-install now, which overwrites every core file with a clean copy and leaves your content, themes, and plugins alone. If files are still flagged afterwards, restore from a backup taken before the infection.

Not necessarily. The most common cause is an ordinary plugin that was deactivated or deleted without unscheduling its events, which leaves a hook behind that nothing listens for any more. Treat it as worth a look, not as proof. An event that is flagged both as an unknown hook and as having an obfuscated name is far more suspicious, since legitimate plugins do not name their hooks with random hex strings.

The flags describe patterns, not verdicts. An administrator you added last week is correctly flagged as a new account, and a colleague using a Gmail address is correctly flagged as an external email — both are perfectly normal. The audit's job is to make sure no administrator on the list is one you cannot account for. Nothing is ever changed or deleted automatically.

Yes, on almost every site. WordPress stores images, video, and documents in wp-content/uploads, and none of those need PHP to run. Blocking it is one of the standard hardening steps recommended for WordPress. A small number of plugins do place PHP files there and expect to execute them; if something breaks, click Remove Protection and the rules are removed cleanly, leaving any other .htaccess content in that directory untouched.

No — .htaccess files are read by Apache and LiteSpeed, and ignored entirely by Nginx. The plugin detects this and says so on the screen rather than writing rules that would never take effect. On Nginx, ask your host to deny PHP execution under wp-content/uploads in the server configuration.

Login protection limits repeated failed login attempts and helps prevent brute-force attacks against your wp-login.php endpoint — a key layer of website security that works alongside the malware scanner.

Go to Malware Cleaner → Scan Results and click the file path to view the matched pattern. The troubleshoot view shows the exact line and rule that triggered the alert, so you can decide whether it is a false positive or a real threat.

Go to Malware Cleaner → Settings, enable Remove all data on uninstall, then deactivate and delete the plugin. All database tables, scan history, and plugin options will be removed automatically.

To stay safe on resource-constrained servers, the file scan runs under a 20-second time budget and the database scan under its own 10-second budget. On a very large wp-content directory the file scan stops when the budget is reached, so a single run may not reach every file. Run the scan again to continue checking, and remediate the highest-severity findings first.