Niraj Pal

<p>Malroot Security is a WordPress malware scanner built specifically to catch the threats that file-based scanners miss. It was created after a real-world investigation of compromised WordPress sites where Wordfence and similar tools failed to detect database-resident malware, rogue REST API endpoints, malicious MySQL triggers, and self-healing rootkit patterns.</p>
<h4>What makes Malroot different</h4>
<p>Most security plugins only scan files on disk. Malroot also looks at:</p>
<ul>
<li><strong>Database content</strong> — <code>wp_options</code>, <code>wp_posts</code>, <code>wp_postmeta</code> for injected PHP/JS payloads</li>
<li><strong>MySQL triggers and events</strong> — catches rootkits that recreate fake admins on every spam comment</li>
<li><strong>REST API routes</strong> — flags non-standard namespaces with dangerous capabilities</li>
<li><strong>mu-plugins</strong> — detects self-healing loaders that reinstall malware after deletion</li>
<li><strong>Bot-cloaked content</strong> — compares Googlebot vs human page output to detect SEO spam</li>
<li><strong>Outbound connections</strong> — logs every external HTTP request and alerts on known C2 hosts</li>
</ul>
<h4>Core features</h4>
<ul>
<li>Eight independent scanner modules with severity-based findings</li>
<li>One-click incident response that replays a complete malware cleanup</li>
<li>Auto-quarantine with full restore for files, options, postmeta, users, triggers, events</li>
<li>Real-time hooks block rogue admin creation and eval-based option injection</li>
<li>WordPress.org checksum verification — official files auto-accept silently</li>
<li>Login security with IP throttling, automated-tool detection, geo-aware new-origin alerts</li>
<li>Built-in 2FA (TOTP, RFC 6238 — works with Google Authenticator, Authy, 1Password)</li>
<li>Spam registration shield with honeypot, pattern blocklist, and bulk subscriber cleanup</li>
<li>Email and Slack alerting with deduplication</li>
<li>CSV export of findings for audit trails</li>
<li>Self-integrity check — Malroot detects tampering with its own code</li>
</ul>
<h4>Plain-language Simple View</h4>
<p>Findings are translated from technical rule IDs into plain English with clear actions:</p>
<ul>
<li>“Hidden trap found in your database” instead of “TR-005: Trigger after_insert_comment”</li>
<li>“Fake admin account found” instead of “UA-010: Known malware admin name”</li>
<li>“Hacker tool found on your site” instead of “MAL-005: WSO/FilesMan webshell signature”</li>
</ul>
<p>Each finding card answers three questions: what happened, why it matters, what to do.</p>
<h4>How verified-safe checking works</h4>
<p>When a file changes, Malroot looks up its MD5 hash in:</p>
<ol>
<li>The official WordPress.org core checksums API</li>
<li>The official plugin checksums at downloads.wordpress.org</li>
<li>A recent plugin/theme update window from the operator’s own update history</li>
</ol>
<p>Files that match an official checksum auto-accept silently — the user never sees them. Files that match a malware signature get flagged as critical regardless of any update window. Custom files and theme edits surface for manual review.</p>
<h4>Real-world validation</h4>
<p>Malroot was developed during the cleanup of compromised WordPress sites, including sites where the rogue plugin had embedded a MySQL trigger that recreated a <code>newsfeed</code> admin user every time a spam comment was posted. That attack pattern is now a built-in detection.</p>
<h3>External services</h3>
<p>This plugin connects to the external services listed below. By default only the WordPress.org checksum APIs are used; the rest are opt-in. Each is documented with what is sent, when, and why.</p>
<p><strong>WordPress.org core checksums API</strong> (<code>api.wordpress.org</code>)<br />
Used to verify whether changed core files match official WordPress release checksums. The plugin sends only the WordPress version string and locale (e.g. <code>6.5.4</code> / <code>en_US</code>) to fetch the public checksum manifest. No site content is sent. This is the same API WordPress core uses for its built-in checksum tool.<br />
Provider: WordPress Foundation. Privacy policy: https://wordpress.org/about/privacy/. Terms: https://wordpress.org/about/</p>
<p><strong>WordPress.org plugin checksums</strong> (<code>downloads.wordpress.org</code>)<br />
Used to verify whether changed plugin files match the checksums of the version installed from the WordPress.org plugin directory. The plugin sends the plugin slug and version to fetch the public checksum manifest. No site content is sent.<br />
Provider: WordPress Foundation. Privacy policy: https://wordpress.org/about/privacy/. Terms: https://wordpress.org/about/</p>
<p><strong>ipapi.co GeoIP lookup</strong> (<code>ipapi.co</code>) — optional, OFF by default<br />
Disabled unless the administrator turns on “IP geolocation” on the Settings page. When enabled, it displays a human-readable country and city for IP addresses recorded on the Login Activity page. The plugin sends only the IP address being looked up, and only when an administrator opens the Login Activity page — never during normal site traffic. Results are cached locally for 30 days so each unique IP is queried at most once per month. If the option is left off (the default), no IP address is ever sent and login records simply show the raw IP.<br />
Provider: ipapi. Privacy policy: https://ipapi.co/privacy/. Terms: https://ipapi.co/terms/</p>
<p><strong>Slack incoming webhook</strong> (URL configured by the site administrator, optional)<br />
If the site administrator enters a Slack incoming webhook URL on the Settings page, critical and high-severity alerts are POSTed to that URL as a short notification payload (event type, severity, summary, and site host). No site content, credentials, or scan results are sent. This service is opt-in and only active when a webhook URL has been configured.<br />
Provider: Slack. Privacy policy: https://slack.com/trust/privacy/privacy-policy. Terms: https://slack.com/terms-of-service</p>


Malroot Security

Catches database-resident backdoors, rogue admins, malicious MySQL triggers and self-healing rootkits other scanners miss.

miniorange

<p>MALWARE SCANNER |WORDPRESS ANTI-MALWARE PROTECTION</p>
<p>Malware Scanner plugin enables anti malware protection for WordPress websites, detecting web malwares, vulnerabilities and other security threats which can harm your server. Provides  comprehensive anti-malware protection & detailed security checks with malware scan reports, in just One-click scan. Our Anti-Malware plugin detects security threats in your WordPress website like Malware, Trojans,Viruses,Brute force & OWASP attacks, Worms, Backdoors, Spyware, Code injections, etc and provides complete security checks against such malwares. In addition to the above features, our plugin scans, posts and comments data from databases to detect malware and malicious URLs which are blacklisted by google.</p>
<p>With our 4 types of scans,WordPress Malware Scanner Provides detailed Anti-Malware protection which meets the requirements for every use-case:<br />
*   Quick Scan : Scans for compromised malware Securities in plugins & themes<br />
*   Standard scan : scans for malwares & other security threats for millions of signatures<br />
*   Deep scan :Scans for all malwares, Trojans, Backdoors,viruses, external links and performs repository comparison in your WordPress Website.<br />
*   Custom scan : Configure scan, select the level of scanning and security by Detecting changes to only a specific folder/file/directories to be scanned.</p>
<h4>FREE ANTI-MALWARE Plugin Features</h4>
<h4>Free Plugin Features :-</h4>
<ul>
<li>Malware Detection : Constant Malware detection in your WordPress site against BackDoors, Trojans, Brute force, Viruses , Worms, etc. Scans and Detects malware in the files with signatures and updates on a constant basis.</li>
<li>Malware Protection & Securities: The Scanner provides Spam Protection and Login Securities against Brute force attacks in your WordPress website.</li>
<li>Web Application security(WAF):  Web application firewall (WAF) protects web applications from a variety of application layer attacks such as OWASP attacks like cross site scripting(XSS), SQL injection attacks, and cookie poisoning etc. It monitors, and blocks any malicious HTTP/S traffic traveling to the web application, and prevents any unauthorized data from leaving the app.</li>
<li>Bad Bot Detection: Pro-active attention to your site by Blocking hackers & bots.</li>
<li>Repository Version Comparison : Malware scanner checks if you have the latest and correct version plugin which has no known issues. </li>
<li>Security audit log: Record security-related system information.</li>
<li>Monitor file changes : Any changes in the files will be detected by the Scanner and you will be notified.</li>
<li>One click scan : scans for malwares and security attacks in your WordPress website in just a single click.</li>
<li>Authenticity check:WordPress, theme and plugin authenticity check.</li>
<li>Page redirection:Disable programmed redirection to the login page.</li>
<li>Encrypted Backup and Restore</li>
</ul>
<h4>Premium ANTI-MALWARE Plugin Features</h4>
<p>=Premium features :- =</p>
<ul>
<li>Advanced Signatures for Malware Detection: Malware Scanner has its own premium signatures to detect more advanced malwares in the files for WordPress.</li>
<li>Detection Of Trojans and Backdoors: Along with vulnerable code, you will be able to detect malwares like Trojans as well as backdoor code snippets.</li>
<li>External link Detection:Malware Scanner checks for any backlinks or spam links inserted in your website. Spam links can cause a bad reputation for your WordPress website.</li>
<li>Action On Malicious Files:You can View, Delete, Ignore or Repair the files flagged as malicious.</li>
<li>Whitelist URLs : You can whitelist the URLs which are not known by the plugin but are harmless so that they are not marked as spam.</li>
<li>Blacklisted Domains:Malware Scanner detects any blacklisted domain used in your wordpress so that your site does not get bad reputation.</li>
<li>Custom Signatures:You can flag any particular string or code, Malware Scanner can provide it as a custom signature just for you.</li>
<li>SQL Injection Check :Malware Scanner checks for injected SQL queries which can +harm your database and injected shell scripts which can harm your server by executing any commands.</li>
<li>Remote File Inclusion Check: Inclusion of remote files can be harmful as code return in remote files will be executed on your server.</li>
</ul>
<h3>How IS MALWARE SCANNER Different</h3>
<p>Our anti malware plugin provides complete protection for wordpress security by:<br />
*   Malware Scanner has  an initiative dashboard<br />
*   The Scanner provides a detailed report of the analysis through one click scan.<br />
*   Malware Scanner also allows the user to update the plugins; themes;core files of WordPress sites by checking with the repository and Scanning files to Prevent Malicious Files.</p>
<p>Our Malware Scanner plugin includes Advanced Signatures for detecting malware,Spam Protection and Login Security(Brute force) features along with real time blocking analysis from attackers. We suggest combining your site with our plugin that can scan the files on WordPress with the miniOrange malware scanning to keep your website safe with user-friendly experience at an affordable price.</p>
<h4>Checks PHP files vulnerable code</h4>
<p>Malware Scanner checks if your website has a code which is kept hidden or obfuscated to harm your website.</p>
<h4>SQL Injection and injected shell script check</h4>
<p>Malware Scanner checks for injected SQL queries which can harm your database and injected shell scripts which can harm your server by executing any commands.</p>
<h4>Remote File Inclusion</h4>
<p>Inclusion of remote files can be harmful as code return in remote files will be executed on your server.</p>
<h4>External Links Detection</h4>
<p>Malware Scanner checks if anyone is creating backlinks from your WordPress website. Backlinks to blacklisted sites will be added to your website to spam websites list.</p>
<h4>Repository Version Comparison</h4>
<p>Malware Scanner checks the local files with the repository version to warn in case of any mismatches.</p>
<h4>Advanced Signatures for detecting malware</h4>
<p>Malware Scanner checks for more than a million malware signatures to find even the latest malwares.</p>
<h4>Spam Protection and Login Security</h4>
<p>Malware Scanner Provides protection with Brute force, Google reCaptcha, strong passwords, etc and helps to protect your WordPress website against spam attacks.</p>
<h4>LOGIN SECURITY</h4>
<p>Malware Scanner provides Login Securities with Brute Force.</p>
<h4>Web Application Firewall</h4>
<p>Web Application Firewall protects your website from SQL injection, Cross site scripting, Local file inclusion, Remote file inclusion attacks.</p>
<h4>Encrypted Backup and Restore</h4>
<p>Backup your entire website with easy one click backup and restore.</p>
<h3>Documentation</h3>
<p><a href="https://security.miniorange.com/malware-scanner/#anti_malware" rel="nofollow ugc">Here</a> you can get the help on Malware Scanner documentation with ensured content and expectations.</p>
<h4>CUSTOMER SERVICE :</h4>
<p>If you are still nervous about your website security or on how the plugin would work for you specifically, Customized solutions and Active support are available.you can always contact us <a href="https://security.miniorange.com/contact/" rel="nofollow ugc">here</a> ,  or Email us at info@xecurify.com or call us at +1 9786589387 and we would be happy to help you out.</p>


Malware Scanner

Malware scanner provides Anti malware security, Scans & Detects malware like Trojans, Backdoors, Brute force & OWASP attacks.

Malroot Security vs Malware Scanner