Moatline Malware Scanner -- WordPress 插件

开发者	n2securityio nextnova ibrahimshah2144
更新时间	2026年10月23日 09:22
PHP版本:	7.0 及以上
WordPress版本:	7.1
版权:	GPLv2 or later
版权网址:	版权信息

Moatline Malware Scanner is built by a team that cleans up hacked WordPress sites for a living. It looks for the techniques modern infections use to hide and come back: code injected into legitimate plugin files, fake "verify you're human" pop-ups (ClickFix), blockchain-hosted loaders (EtherHiding), webshells in the uploads folder and hidden reinfection tasks in the database. Malware scanner

Scans plugins, mu-plugins, the active theme, drop-ins, wp-login.php and the uploads folder.
Signature detection for known WordPress malware families, plus heuristic checks for obfuscated code and webshells.
Finds PHP webshells in uploads, fake image files used to store stolen credentials, decoy plugins and payload files.
Checks the database for malicious options, cron hooks, rogue administrator accounts and scripts injected into posts and pages.
Results name the malware family that matched, so you know what you're dealing with.
Checks WordPress core files against WordPress.org and finds files that don't belong in wp-admin and wp-includes.
Warns you when a plugin, theme or your WordPress version is under active attack, with an email the first time it happens.
Automatic weekly scans in the background, with an email when something is found.
File change monitoring: reports PHP and JavaScript files that are new or changed since the last scan, even when malware backdates them.
Find the source: when a malicious script is found, names the file or database entry that keeps adding it back.
WP-CLI commands for scans, results and database cleanup.

Content scan Some infections never touch a file. Attackers who get into an account, or abuse a vulnerable plugin, hide their script inside the database instead.

Checks posts, pages, revisions, page-builder data (such as Elementor) and widgets for injected scripts.
Detects DNS-based script loaders, blockchain-hosted loaders, heavily obfuscated JavaScript and known malware domains.
Ordinary scripts such as analytics or form embeds are not flagged.
Each finding links straight to the post or widget so you can remove the injected code.

Integrity check against WordPress.org Every file in a plugin from the WordPress.org directory is compared with the official release of that exact version.

Files identical to the official release are verified clean and skipped, which keeps false positives low.
Files that differ are flagged as modified. That is exactly where injected malware hides.

Two-factor login

Works with any authenticator app: Google Authenticator, Microsoft Authenticator, Authy, 1Password and others.
Each user scans a QR code on their profile. The QR code is drawn on your site; the secret never leaves it.
10 single-use backup codes, and administrators can reset two-factor login for a user who lost their phone.
Password logins over XML-RPC are refused for two-factor users, so the code screen can't be bypassed. Apps use application passwords.

XML-RPC protection

Three modes: allow, Jetpack-safe (only Jetpack's signed requests are accepted) or block completely.
Refuse password logins over XML-RPC and disable system.multicall, which attackers use to try hundreds of passwords in one request.
Jetpack is detected automatically. If it is activated while XML-RPC is blocked, the plugin switches to Jetpack-safe mode and tells you.
Optional server rule for Apache and LiteSpeed (added to .htaccess only when you click the button, removed on deactivation). Nginx users get the rule to copy.

Limit login attempts on the login page, XML-RPC and the REST API, with an IP allowlist.
Hide usernames from the REST API and block ?author= username scans.
Block REST API batch requests from logged-out visitors, the door used by the wp2shell attacks on WordPress core.
See every active login session with IP address and browser, including sessions left by deleted users.
One-click buttons: log everyone out, force a password reset for other administrators, regenerate the security keys and salts in wp-config.php.
Audit and revoke application passwords, or turn them off.

Every option that blocks something is off until you turn it on, and each one explains what it might affect. Live monitoring

Records who saves a malicious script into a post, page or Elementor data, with the user, IP address and method (dashboard, XML-RPC or REST API).
Records logins and XML-RPC write calls such as wp.editPost, so an incident can be traced without server logs.

Lockdown

One-click file modification lock (DISALLOW_FILE_EDIT / DISALLOW_FILE_MODS) so attackers can't install or edit plugins and themes through the dashboard.
Block PHP execution in the uploads folder (Apache rule written for you; Nginx rule provided).

Move the login page to a custom URL and hide wp-login.php.
Send bots probing the default login page to a 404.

Database cron cleaner

Removes known malicious cron hooks and option keys that reinstall malware after a cleanup. Runs only when you click "Clean database", and backs up everything it removes so you can restore it.

Activity log

Records security-relevant events such as suspicious cron registrations, with export to JSON.

Security score

A dashboard score and checklist that shows what to fix next.

Pro add-on The free plugin finds and reports threats. The Pro add-on is a separate, optional plugin for people who want them fixed automatically: one-click malware removal, restoring modified plugin files from WordPress.org, one-click fixes for core files, server settings and database triggers, AI verification of findings, blocking of malware call-home connections (including blockchain gateways), daily scans, the full vulnerability database from Wordfence Intelligence, and a white-label security report for clients. Pro is never required to use the features above. Links

1.2.3

New: finds static pages that replace your WordPress pages: a folder in the site root named like one of your pages, with its own index.html, which the server shows instead of your page. Hacked sites get gambling pages planted this way (October 2026).
New: lists Google Search Console verification files in the site root, so you can spot one an attacker added to take over your site in Search Console.
New: detects the "WP Poster" fake plugin that publishes spam posts under a real administrator's name, and administrators with @local.invalid email addresses.
New: detects remote code loaders: files that download code from the internet and run it (for example wp-obf.php).
New: detects the backdoor in ARVE Advanced Responsive Video Embedder 10.8.7 and 10.8.8 (CVE-2026-18072) and the diksimarina administrator created through Everest Forms Pro (CVE-2026-3300).
New: detects a newer version of the malware that wipes other plugins' files (it writes "return;" into them). Moatline is not affected.
Changed: the "under attack" list includes WordPress core file inclusion (CVE-2026-87902), ARVE and Everest Forms Pro.

1.2.2

New: checks your PHP version. Warns when it is under active attack (PHP2Shell, CVE-2026-109618 and CVE-2026-109619, October 2026) or no longer gets security fixes, and explains that your host updates PHP, not WordPress.
New: detects the October 2026 attacks through Ninja Forms and WPC Product Bundles: the fake "WP Smart Thumbnails" plugin, the must-use plugins that hide an administrator, their database options and code.
New: finds administrators hidden from the Users screen by the list filter this malware uses, and warns about administrators with an @wordpress.org email address.
New: detects more accounts made by the UpdraftCentral backdoor (@example.com addresses and the usernames reported so far) and its "_9f5696" trigger.
New: warns about must-use plugins that change the Users screen and its counts.
New: Moatline can now be translated. Every screen, message and email is ready for translators at translate.wordpress.org.
Changed: the "under attack" list includes PHP2Shell, Elementor Pro, Ninja Forms, WPC Product Bundles and WooCommerce Wholesale Lead Capture.

1.2.1

New: detects the Rank Math PRO 3.0.123 supply-chain backdoor (October 2026): the fake wp-includes/class-wp-cache-util.php file, its database options, its code and command server, wpsupport_ administrators and @wp-mail.net addresses, .htaccess rules that run .cache files as PHP, and .cache files holding PHP code.
New: detects the backdoor plugins installed through stolen UpdraftCentral keys (October 2026) and the "Site Tools" / @example.org accounts they create.
New: warns when a non-administrator account can change settings or install plugins, either given to that account directly or through its role.
New: if this site has UpdraftCentral keys, the dashboard explains the risk and offers a "Delete UpdraftCentral keys" button. UpdraftPlus backups keep working. If you use UpdraftCentral, you can keep the keys and Moatline only asks again when a new key is added.
Changed: the "under attack" list includes Rank Math PRO 3.0.123 and sites connected to UpdraftCentral.
Changed: a compact one-line header: the logo on the left and the menu on the right. The "Run scan" header button is gone (Scan now is on the dashboard).
Fixed: checkboxes on the Protection and Settings pages now line up with their text.
Fixed: opening a row's details (such as Show sessions) keeps its buttons at the top of the row.
Fixed: the Protection page now shows Protection, not Settings, as the current menu tab.

1.2.0

New: simpler admin. Four pages instead of seven: Dashboard, Protection, Activity Log and Settings. Old addresses open the right new page.
New: the dashboard now holds the scanner. A compact security score, Scan now, the scan progress, the last scan's results and any threats are on one page.
New: the security score has six checks. "No known vulnerabilities" is new, and a scan older than 7 days earns fewer points, so an old clean scan no longer shows Grade A.
New: Protection page. The plugin lock, file editor, PHP-in-uploads block, custom login URL, two-step login, login limits, REST and XML-RPC settings, sessions and application passwords are in one place, with one Save button.
New: "Unlock for 30 minutes". The plugin and theme lock switches itself back on, so you never forget to re-lock after installing or updating.
Changed: long explanations are folded away under "details" links, and each row shows its status at a glance.
For add-ons: Moatline Pro 1.3.0 shows its settings next to the free settings they belong with.

1.1.1

New: warns you when your WordPress version itself is under active attack. First entry: the wp2shell attacks on WordPress 6.8 to 7.0.1 (CVE-2026-63030, CVE-2026-60137), fixed in 7.0.2, 6.9.5 and 6.8.6.
New: Hardening → "Block batch requests from logged-out visitors". Closes /wp-json/batch/v1, which wp2shell uses, so a site is protected even before WordPress is updated. Off until you turn it on.
New: detects what the wp2shell attackers leave behind: admins named wp2_ or w2s_ or with a wp2shell email address, the CMSmap webshell plugin, REST backdoor plugins and one-line webshells.
New: detects the "SC" self-healing malware's plugin, must-use plugin and theme copies, the Essential Plugin backdoor, the Steam-comments loader, and a fake plugin that pretends Wordfence is protecting the site.
New: flags PHP files in the site root named like a WordPress core file (for example wp-comments-posts.php), and security plugin folders renamed to switch them off (for example wordfence1).
New: lists administrators with application passwords, so you can revoke any you don't recognise.
Changed: the "under attack" list now includes Gravity SMTP and the 31 closed Essential Plugin plugins.

1.1.0

New: warns you when an installed plugin or theme is under active attack. A short list kept by the Moatline team is checked twice a day, and you get an email the first time a plugin on your site appears on it. The dashboard shows a red warning until you update.
New: automatic weekly scans in the background (Settings → Automatic scans), with an email when threats are found. Long scans run in short slices, so they work on any host.
New: file change monitoring. Each scan remembers a fingerprint of every PHP and JavaScript file and reports files that are new or changed since the last scan, unless that software was updated. This catches self-healing malware that rewrites files and backdates them.
New: "find the source". When the scan finds a malicious script, it also looks for the file or database entry that keeps adding it, and names it.
New: WP-CLI commands: wp moatline scan, wp moatline threats, wp moatline status and wp moatline clean-db. wp moatline scan --fail-on-threats exits with an error for monitoring scripts.
New: checks WordPress core files against the official checksums from WordPress.org, and finds PHP files in wp-admin and wp-includes that WordPress doesn't ship.
New: checks wp-config.php for injected code, PHP files in the site root and directly in wp-content, and hidden PHP files whose names start with a dot.
New: finds auto_prepend_file lines in .user.ini, php.ini and .htaccess that run a file before every page (the first stage of 2026's self-healing "SC" malware).
New: scans every installed theme, not only the active one.
New: finds administrators hidden from the Users screen, admin names matching 2026 malware patterns, registration set to give new users the Administrator role, and database triggers.
New: finds compressed PHP code stored in the database.
Changed: findings that must be fixed by hand (core files, wp-config.php, server settings, triggers) say exactly how, and are never offered for deletion.
Changed: "Clean database" now removes every database entry the scan reports as a known malware key, and both use one list of malware cron jobs.
Changed: fewer false alarms: plugins' own test folders and short chr() byte sequences (such as CSV byte-order marks) no longer trigger warnings.
Changed: deleting the plugin now removes the plugin-install lock (DISALLOW_FILE_MODS) that Moatline added to wp-config.php, so the site can install and update plugins again. A lock added by you or your host is left alone.
Fixed: the custom login address can no longer be switched on when the server can't reach it (Plain permalinks or missing rewrite rules), which could lock you out. If permalinks are later set to Plain, the normal login page is used.
Fixed: when the live home page check can't load your site, the results now say so instead of looking clean.

1.0.6

Fixed: the uploads scan now finds PHP files renamed to .phtml, .php5, .php7, .php8, .pht, .phtm, .phar or .phps, and upper-case names such as .PHP. Attackers exploiting the Bricksforge file upload flaw (CVE-2026-85097) use these names.
Fixed: the "Block PHP in uploads" rule now covers the same extensions and ignores letter case. Sites that already had the block turned on are upgraded automatically.
Changed: the Nginx rule shown for manual setup covers the same extensions.

1.0.5

Fixed: on sites without a mu-plugins folder (most sites), the checks for fake plugins and hidden binary payload files were skipped. They now always run.
New: database entries used by the fake CAPTCHA (ClickFix) loader that reads its address from the Polygon blockchain are named as such in scan results.
Changed: cleaner admin screens: no emoji on buttons, a two-column scan progress list, and a red "Threats found" headline on the dashboard while threats remain.
Changed: each database entry is reported once, even when several checks match it.
Fixed: Lockdown now shows "Locked" when DISALLOW_FILE_MODS was added to wp-config.php by hand or by your host.
Fixed: when the plugin folder is a symlink, the scanner now checks every plugin and still skips its own files.
Fixed: finished scan steps no longer keep saying "Scanning...".
Fixed: XML-RPC Jetpack-safe mode now also recognises WooPayments and the standalone Jetpack plugins, which use the same WordPress.com connection.

1.0.4

Fixed: the Moatline logo in the admin header did not show on some installs.

1.0.3

New: redesigned admin screens, with a header and tabs on every page and a new dashboard showing your security score, what to fix next, recent activity and the database cleaner.
New: checks your live home page the way visitors see it, to catch fake CAPTCHA (ClickFix) scripts injected at page load.
New: detects the "X Global Data Flow" / "Traffic Monitor" fake plugins and new White Label CMS loader variants, including malware that empties other security plugins' files.
New: the database cleaner backs up everything it removes, and a "Restore last backup" button puts it back.
New: warns you if Moatline's own files have been emptied by malware, instead of failing silently.
Changed: the Documentation and Support links were removed from the Plugins screen row (they are on the plugin's own pages).

1.0.2

New: detects the fake "WordPress Defender", "WordPress Security" and "White Label" plugins found on hacked sites in 2026, plus plugins whose author is just "WordPress".
New: flags empty plugin files left behind by host malware cleaners, which can crash a site.
New: detects malware plugins that hide themselves from the Plugins list.
New: signatures for the mlroweb, latoem and renotad script injections.
New: Settings, Docs and Support links on the Plugins screen.
Changed: links now point to the new home of the plugin, moatline.io.

1.0.1

Fixed: "Clean DB Now" stayed on "Cleaning..." and never finished.
Fixed: signing in from a custom login URL sent you back to the login page.
Changed: with a custom login URL, logged-out visitors to /wp-login.php and /wp-admin now see "page not found" instead of being sent to the new address.
Fixed: unlocking Full Lockdown no longer turns the file editor back on if you had turned it off separately.
New: Pause, Resume and Stop buttons while a scan is running. A paused scan can be resumed within 24 hours.
Changed: deleting the plugin keeps settings and two-step login setups unless you choose "Delete all plugin data" in Settings.

1.0.0

Initial release.

Moatline Malware Scanner

标签

下载

详情介绍:

安装:

屏幕截图:

升级注意事项:

常见问题:

更新日志: