Md. Habibur Rahman

Themepaste

<p><strong>Deep Malware Cleaner</strong> is a lightweight deep malware scanner built for WordPress. It performs a thorough deep cleanup scan of your <code>wp-content</code> directory, detects backdoors, cleans injected site scripts, fixes redirect hacks, and triggers malware auto-purge — all from your WordPress admin dashboard with no external service, no subscription, and no data ever leaving your server.</p>
<p>Whether you’re dealing with a live attack, a hidden backdoor, or a redirect hack silently sending visitors to malicious sites, Deep Malware Cleaner gives you the tools to scan, alert, and act — fast.</p>
<h4>Core Capabilities</h4>
<p><strong>Deep Cleanup Scan</strong><br />
Walks your entire <code>wp-content</code> directory, inspecting every PHP file for known malware signatures, obfuscated code, and injected payloads. Results are sorted by severity so the worst threats surface first.</p>
<p><strong>Backdoor Fixer</strong><br />
Detects PHP backdoors uploaded through vulnerable plugins or themes — including webshells, remote-execution scripts, and hidden PHP files inside the uploads folder where no PHP should ever exist.</p>
<p><strong>Site Script Cleaner</strong><br />
Identifies injected JavaScript and malicious <code><script></code> tags, hidden iframes, and obfuscated code blocks embedded in your theme or plugin files.</p>
<p><strong>Redirect Hack Fix</strong><br />
Flags the PHP patterns most commonly responsible for redirect hacks — including <code>header()</code> injection, variable-based shell execution, and compressed payload backdoors used to silently redirect visitors to attack sites.</p>
<p><strong>Malware Auto-Purge</strong><br />
Remove confirmed threats directly from the scan results screen without touching FTP or cPanel. Quarantine or delete flagged files in one click.</p>
<p><strong>Login Protection</strong><br />
Hardens your WordPress login against brute-force attacks and unauthorized access attempts — an essential layer of website protection alongside active scanning.</p>
<p><strong>Instant Alerts</strong><br />
Get notified the moment a scan finds a threat. Real-time alerts keep you informed so you can respond before an attack escalates.</p>
<h4>What the Scanner Detects</h4>
<ul>
<li><strong>eval(base64_decode(…))</strong> — the most widespread PHP malware obfuscation and attack vector.</li>
<li><strong>eval(gzinflate(…))</strong> / <strong>eval(gzuncompress(…))</strong> — compressed-payload backdoors.</li>
<li><strong>eval(str_rot13(…))</strong> — rotation-cipher obfuscated malware.</li>
<li><strong>Shell execution with dynamic arguments</strong> — <code>shell_exec</code>, <code>passthru</code>, <code>proc_open</code>, <code>popen</code>, and <code>system</code> called with a variable, a classic attack pattern for remote code execution.</li>
<li><strong>Hidden iframes</strong> — <code><iframe></code> elements injected with <code>display:none</code> used to load malicious content invisibly.</li>
<li><strong>Long base64 strings</strong> — unusually large base64 blobs embedded in PHP, a common technique for hiding large attack payloads.</li>
<li><strong>PHP files inside the uploads directory</strong> — any <code>.php</code> file in <code>wp-content/uploads/</code> is flagged High severity; legitimate uploads are never PHP files.</li>
</ul>
<h4>Key Features</h4>
<ul>
<li><strong>Lightweight deep malware scanner</strong> — scans up to 500 files per run in under 25 seconds, safe on shared hosting.</li>
<li><strong>On-demand scan</strong> — runs only when you click Start Scan, never in the background.</li>
<li><strong>Deep Cleaner dashboard</strong> — at-a-glance stats: threats found, files scanned, time since last scan.</li>
<li><strong>Website Security & Website Protection</strong> — comprehensive coverage against the most common WordPress attack types.</li>
<li><strong>Troubleshoot mode</strong> — detailed per-file reporting to help you understand exactly what was found and why it was flagged.</li>
<li><strong>Secure login</strong> hardening included.</li>
<li><strong>All scan history</strong> stored in your own database — nothing leaves your server.</li>
<li><strong>No account, no API key, no external requests.</strong></li>
<li><strong>Translatable</strong> — full <code>.pot</code> file included.</li>
</ul>
<h4>Who Is This For?</h4>
<ul>
<li>Site owners who received a “this site may be hacked” alert from Google.</li>
<li>Developers who need to troubleshoot a suspected redirect hack or injected script.</li>
<li>Agencies that manage multiple WordPress sites and need a fast, lightweight scanner with no SaaS dependency.</li>
<li>Anyone who wants ongoing website security and website protection without a monthly fee.</li>
</ul>
<h4>Privacy</h4>
<p>This plugin makes <strong>zero</strong> external HTTP requests. No data is sent to any third-party server. Scan results are stored only in your own WordPress database and are removed when you uninstall the plugin (if that option is enabled in Settings).</p>


Deep Malware Cleaner

Lightweight deep malware scanner for WordPress — deep cleanup scan, backdoor fixer, redirect hack fix, and login protection.

Code Machine

<h4>Purpose</h4>
<p>Detect WordPress Plugins ‘Fatal Errors’ that might block/prevent site admins from accessing WordPress admin interface in order to deactivate the Plugin that caused the issue! UBP then report/notify (sedning email) site admin with a secure link that valid for 24 hours from which site admin can deactivate the target Plugin by simply clicking the link!</p>
<p>For development state and issue tracking follow the Plugin on <a href="https://github.com/xpointer/ubp" rel="nofollow ugc">GitHub Respository</a></p>
<h4>Mechanism</h4>
<p>The mechanism of the Plugin is to always put itself as the first Plugin to be executed by WordPress Plugins system! The Plugin then just stay away and never get itself involved until the execution of all the other scripts is then terminated! UBP Plugin role is comes when the script is terminated. It then check if the script is terminated with error. If the script if terminated with error UBP send admin mail with backup link that has a secure key by which UBP give the link owner the permission to disable the target Plugin.</p>
<h4>Advantages</h4>
<ul>
<li>There is no need to access throught FTP to force WordPress deactivate the Plugin. You can always use this Plugin to deactivate the target Plugin only with the link sent with the mail.</li>
<li>Load minimum codes/scripts that required only to get involved (listen to errors). Load code required to functional only when error detcted.</li>
</ul>
<h4>Notes</h4>
<ul>
<li>Whenever you active or deactive a Plugin, UBP will always put itself as the first Plugin in WordPress active Plugins queue.</li>
<li>The Plugin won’t install itself while the site is already blocked by the error.</li>
<li>UBP must be installed first while the site is fully functional and then it’ll help you backing up your site if any newly Plugin produced an error.</li>
<li>It Won’t help you on all type of errors you’ve in your WordPress site however it can always give you the chance to get your site functional again after installing any Plugin that prevent you from accessing your backend.</li>
<li>It has no admin user interface and therefor not configurable, however next versions will do.</li>
<li>Send admin mail whatever ‘fatal errors’ is detected and it doesn’t matter if this error blocked your site or not. It’ll also report fatal errors that might happened in a secondary request that doesn’t block you from deacivating the Plugin yourself.</li>
</ul>
<h4>Proof Of Concept</h4>
<p>I still have many useful ideas and feature to add to the Plugin however the Plugin need users reviews to proof that its really helping and its really need to be improved.</p>


Uninterrupted Backup

Detect fatal errors that might be produced by the installed active Plugins, provide secure backdoor for deactivating the target Plugin.

Deep Malware Cleaner vs Uninterrupted Backup