Niraj Pal

Malroot Security is a WordPress malware scanner built specifically to catch the threats that file-based scanners miss. It was created after a real-world investigation of compromised WordPress sites where Wordfence and similar tools failed to detect database-resident malware, rogue REST API endpoints, malicious MySQL triggers, and self-healing rootkit patterns.
<h4>What makes Malroot different</h4>
Most security plugins only scan files on disk. Malroot also looks at:
<ul>
<li>Database content — <code>wp_options</code>, <code>wp_posts</code>, <code>wp_postmeta</code> for injected PHP/JS payloads</li>
<li>MySQL triggers and events — catches rootkits that recreate fake admins on every spam comment</li>
<li>REST API routes — flags non-standard namespaces with dangerous capabilities</li>
<li>mu-plugins — detects self-healing loaders that reinstall malware after deletion</li>
<li>Bot-cloaked content — compares Googlebot vs human page output to detect SEO spam</li>
<li>Outbound connections — logs every external HTTP request and alerts on known C2 hosts</li>
</ul>
<h4>Core features</h4>
<ul>
<li>Eight independent scanner modules with severity-based findings</li>
<li>One-click incident response that replays a complete malware cleanup</li>
<li>Auto-quarantine with full restore for files, options, postmeta, users, triggers, events</li>
<li>Real-time hooks block rogue admin creation and eval-based option injection</li>
<li>WordPress.org checksum verification — official files auto-accept silently</li>
<li>Login security with IP throttling, automated-tool detection, geo-aware new-origin alerts</li>
<li>Built-in 2FA (TOTP, RFC 6238 — works with Google Authenticator, Authy, 1Password)</li>
<li>Spam registration shield with honeypot, pattern blocklist, and bulk subscriber cleanup</li>
<li>Email and Slack alerting with deduplication</li>
<li>CSV export of findings for audit trails</li>
<li>Self-integrity check — Malroot detects tampering with its own code</li>
</ul>
<h4>Plain-language Simple View</h4>
Findings are translated from technical rule IDs into plain English with clear actions:
<ul>
<li>“Hidden trap found in your database” instead of “TR-005: Trigger after_insert_comment”</li>
<li>“Fake admin account found” instead of “UA-010: Known malware admin name”</li>
<li>“Hacker tool found on your site” instead of “MAL-005: WSO/FilesMan webshell signature”</li>
</ul>
Each finding card answers three questions: what happened, why it matters, what to do.
<h4>How verified-safe checking works</h4>
When a file changes, Malroot looks up its MD5 hash in:
<ol>
<li>The official WordPress.org core checksums API</li>
<li>The official plugin checksums at downloads.wordpress.org</li>
<li>A recent plugin/theme update window from the operator’s own update history</li>
</ol>
Files that match an official checksum auto-accept silently — the user never sees them. Files that match a malware signature get flagged as critical regardless of any update window. Custom files and theme edits surface for manual review.
<h4>Real-world validation</h4>
Malroot was developed during the cleanup of compromised WordPress sites, including sites where the rogue plugin had embedded a MySQL trigger that recreated a <code>newsfeed</code> admin user every time a spam comment was posted. That attack pattern is now a built-in detection.
<h3>External services</h3>
This plugin connects to the external services listed below. By default only the WordPress.org checksum APIs are used; the rest are opt-in. Each is documented with what is sent, when, and why.
WordPress.org core checksums API (<code>api.wordpress.org</code>) 
Used to verify whether changed core files match official WordPress release checksums. The plugin sends only the WordPress version string and locale (e.g. <code>6.5.4</code> / <code>en_US</code>) to fetch the public checksum manifest. No site content is sent. This is the same API WordPress core uses for its built-in checksum tool. 
Provider: WordPress Foundation. Privacy policy: https://wordpress.org/about/privacy/. Terms: https://wordpress.org/about/
WordPress.org plugin checksums (<code>downloads.wordpress.org</code>) 
Used to verify whether changed plugin files match the checksums of the version installed from the WordPress.org plugin directory. The plugin sends the plugin slug and version to fetch the public checksum manifest. No site content is sent. 
Provider: WordPress Foundation. Privacy policy: https://wordpress.org/about/privacy/. Terms: https://wordpress.org/about/
ipapi.co GeoIP lookup (<code>ipapi.co</code>) — optional, OFF by default 
Disabled unless the administrator turns on “IP geolocation” on the Settings page. When enabled, it displays a human-readable country and city for IP addresses recorded on the Login Activity page. The plugin sends only the IP address being looked up, and only when an administrator opens the Login Activity page — never during normal site traffic. Results are cached locally for 30 days so each unique IP is queried at most once per month. If the option is left off (the default), no IP address is ever sent and login records simply show the raw IP. 
Provider: ipapi. Privacy policy: https://ipapi.co/privacy/. Terms: https://ipapi.co/terms/
Slack incoming webhook (URL configured by the site administrator, optional) 
If the site administrator enters a Slack incoming webhook URL on the Settings page, critical and high-severity alerts are POSTed to that URL as a short notification payload (event type, severity, summary, and site host). No site content, credentials, or scan results are sent. This service is opt-in and only active when a webhook URL has been configured. 
Provider: Slack. Privacy policy: https://slack.com/trust/privacy/privacy-policy. Terms: https://slack.com/terms-of-service

Malroot Security

Catches database-resident backdoors, rogue admins, malicious MySQL triggers and self-healing rootkits other scanners miss.

Md. Habibur Rahman

Themepaste

Deep Malware Cleaner is a lightweight deep malware scanner built for WordPress. It performs a thorough deep cleanup scan of your <code>wp-content</code> directory, detects backdoors, cleans injected site scripts, fixes redirect hacks, and triggers malware auto-purge — all from your WordPress admin dashboard with no external service, no subscription, and no data ever leaving your server.
Whether you’re dealing with a live attack, a hidden backdoor, or a redirect hack silently sending visitors to malicious sites, Deep Malware Cleaner gives you the tools to scan, alert, and act — fast.
<h4>Core Capabilities</h4>
Deep Cleanup Scan 
Walks your entire <code>wp-content</code> directory, inspecting every PHP file for known malware signatures, obfuscated code, and injected payloads. Results are sorted by severity so the worst threats surface first.
Backdoor Fixer 
Detects PHP backdoors uploaded through vulnerable plugins or themes — including webshells, remote-execution scripts, and hidden PHP files inside the uploads folder where no PHP should ever exist.
Site Script Cleaner 
Identifies injected JavaScript and malicious <code><script></code> tags, hidden iframes, and obfuscated code blocks embedded in your theme or plugin files.
Redirect Hack Fix 
Flags the PHP patterns most commonly responsible for redirect hacks — including <code>header()</code> injection, variable-based shell execution, and compressed payload backdoors used to silently redirect visitors to attack sites.
Malware Auto-Purge 
Remove confirmed threats directly from the scan results screen without touching FTP or cPanel. Quarantine or delete flagged files in one click.
Login Protection 
Hardens your WordPress login against brute-force attacks and unauthorized access attempts — an essential layer of website protection alongside active scanning.
Instant Alerts 
Get notified the moment a scan finds a threat. Real-time alerts keep you informed so you can respond before an attack escalates.
<h4>What the Scanner Detects</h4>
<ul>
<li>eval(base64_decode(…)) — the most widespread PHP malware obfuscation and attack vector.</li>
<li>eval(gzinflate(…)) / eval(gzuncompress(…)) — compressed-payload backdoors.</li>
<li>eval(str_rot13(…)) — rotation-cipher obfuscated malware.</li>
<li>Shell execution with dynamic arguments — <code>shell_exec</code>, <code>passthru</code>, <code>proc_open</code>, <code>popen</code>, and <code>system</code> called with a variable, a classic attack pattern for remote code execution.</li>
<li>Hidden iframes — <code><iframe></code> elements injected with <code>display:none</code> used to load malicious content invisibly.</li>
<li>Long base64 strings — unusually large base64 blobs embedded in PHP, a common technique for hiding large attack payloads.</li>
<li>PHP files inside the uploads directory — any <code>.php</code> file in <code>wp-content/uploads/</code> is flagged High severity; legitimate uploads are never PHP files.</li>
</ul>
<h4>Key Features</h4>
<ul>
<li>Lightweight deep malware scanner — scans up to 500 files per run in under 25 seconds, safe on shared hosting.</li>
<li>On-demand scan — runs only when you click Start Scan, never in the background.</li>
<li>Deep Cleaner dashboard — at-a-glance stats: threats found, files scanned, time since last scan.</li>
<li>Website Security & Website Protection — comprehensive coverage against the most common WordPress attack types.</li>
<li>Troubleshoot mode — detailed per-file reporting to help you understand exactly what was found and why it was flagged.</li>
<li>Secure login hardening included.</li>
<li>All scan history stored in your own database — nothing leaves your server.</li>
<li>No account, no API key, no external requests.</li>
<li>Translatable — full <code>.pot</code> file included.</li>
</ul>
<h4>Who Is This For?</h4>
<ul>
<li>Site owners who received a “this site may be hacked” alert from Google.</li>
<li>Developers who need to troubleshoot a suspected redirect hack or injected script.</li>
<li>Agencies that manage multiple WordPress sites and need a fast, lightweight scanner with no SaaS dependency.</li>
<li>Anyone who wants ongoing website security and website protection without a monthly fee.</li>
</ul>
<h4>Privacy</h4>
This plugin makes zero external HTTP requests. No data is sent to any third-party server. Scan results are stored only in your own WordPress database and are removed when you uninstall the plugin (if that option is enabled in Settings).

Deep Malware Cleaner

Lightweight deep malware scanner for WordPress — deep cleanup scan, backdoor fixer, redirect hack fix, and login protection.

Malroot Security vs Deep Malware Cleaner