Malsift – Malware Scanner & Cleanup
| 开发者 | blackspaceapplications |
|---|---|
| 更新时间 | 2026年11月2日 23:05 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Malsift checks a WordPress site the way an incident responder would after a hack, and puts every result on one dashboard.
Files
- Compares WordPress core files with the official WordPress.org checksums.
- Compares plugins from WordPress.org with their official releases and flags modified or extra files.
- Scans everything that cannot be verified (themes, premium and custom plugins, uploads, the site root) for malicious code: encoded loaders, code run from web requests, webshells, droppers and obfuscation.
- Finds hidden loader files, suspicious must-use plugins, look-alike plugin folders, PHP files in uploads, and injected .htaccess / .user.ini rules.
- Lists administrator accounts created in the last 30 days.
- Reviews application passwords (API keys), flags names used by attackers, and lets you approve or revoke each key.
- Finds casino and betting spam: betting brand names in titles, text or links, and bursts of posts created within minutes of each other.
- Finds obfuscated scripts and hidden iframes in settings, widgets and content, and a changed site address.
- Flags suspicious scheduled tasks.
- Checks that PHP has the fixes for PHP2Shell (CVE-2026-109618, CVE-2026-109619).
- Shows whether the theme/plugin code editor is enabled (and can disable it), two-factor coverage for administrators, and pending updates.
- Restore modified core and WordPress.org plugin files with verified official copies.
- Quarantine suspicious files and folders. Quarantined files are stored compressed in a protected folder, cannot run, and can be restored.
- Reinstall WordPress core, and plugins and themes from WordPress.org, in one click. Changed and extra files are backed up to quarantine first.
- Revoke API keys, move spam posts to the trash or delete them permanently (large batches are processed in steps), remove suspicious scheduled tasks.
- "Fix all threats" applies only safe automatic fixes; anything that could break a plugin or theme is left for you to review.
- Daily automatic scan, optional email alerts, scan history and a printable report.
安装:
- Install and activate Malsift.
- Open Malsift in the admin menu and click Run full scan.
- Review threats and warnings. Use Fix all threats for the safe automatic fixes, then run a new scan to confirm the site is clean.
常见问题:
Will it delete my files?
No file is deleted outright. Replaced and removed files go to quarantine, where you can restore them or delete them permanently.
Can a scan break my site?
Scanning only reads files. Fixes that could break a plugin or theme (for example quarantining a file that belongs to it) ask for confirmation first and are never part of "Fix all threats".
Why are some plugins "not verified"?
Premium, custom and outdated plugins have no official checksums. Malsift scans their files for malicious code instead.
Does Malsift clean the database?
It moves spam posts to the trash or deletes them permanently, and revokes API keys. Injected scripts in settings or content are shown for you to remove, because automatic edits to stored settings can break a site.
更新日志:
1.1.0
- New: Reinstall screen for WordPress core, plugins and themes from WordPress.org, with automatic backups of changed files.
- New: spam detection looks at post text and links, not just titles, and flags bursts of posts created within minutes.
- New: delete spam permanently, and an option for "Fix all threats" to do so.
- Large spam batches are removed in steps to avoid timeouts.
- First release.