Niraj Pal

<p>Malroot Security is a WordPress malware scanner built specifically to catch the threats that file-based scanners miss. It was created after a real-world investigation of compromised WordPress sites where Wordfence and similar tools failed to detect database-resident malware, rogue REST API endpoints, malicious MySQL triggers, and self-healing rootkit patterns.</p>
<h4>What makes Malroot different</h4>
<p>Most security plugins only scan files on disk. Malroot also looks at:</p>
<ul>
<li><strong>Database content</strong> — <code>wp_options</code>, <code>wp_posts</code>, <code>wp_postmeta</code> for injected PHP/JS payloads</li>
<li><strong>MySQL triggers and events</strong> — catches rootkits that recreate fake admins on every spam comment</li>
<li><strong>REST API routes</strong> — flags non-standard namespaces with dangerous capabilities</li>
<li><strong>mu-plugins</strong> — detects self-healing loaders that reinstall malware after deletion</li>
<li><strong>Bot-cloaked content</strong> — compares Googlebot vs human page output to detect SEO spam</li>
<li><strong>Outbound connections</strong> — logs every external HTTP request and alerts on known C2 hosts</li>
</ul>
<h4>Core features</h4>
<ul>
<li>Eight independent scanner modules with severity-based findings</li>
<li>One-click incident response that replays a complete malware cleanup</li>
<li>Auto-quarantine with full restore for files, options, postmeta, users, triggers, events</li>
<li>Real-time hooks block rogue admin creation and eval-based option injection</li>
<li>WordPress.org checksum verification — official files auto-accept silently</li>
<li>Login security with IP throttling, automated-tool detection, geo-aware new-origin alerts</li>
<li>Built-in 2FA (TOTP, RFC 6238 — works with Google Authenticator, Authy, 1Password)</li>
<li>Spam registration shield with honeypot, pattern blocklist, and bulk subscriber cleanup</li>
<li>Email and Slack alerting with deduplication</li>
<li>CSV export of findings for audit trails</li>
<li>Self-integrity check — Malroot detects tampering with its own code</li>
</ul>
<h4>Plain-language Simple View</h4>
<p>Findings are translated from technical rule IDs into plain English with clear actions:</p>
<ul>
<li>“Hidden trap found in your database” instead of “TR-005: Trigger after_insert_comment”</li>
<li>“Fake admin account found” instead of “UA-010: Known malware admin name”</li>
<li>“Hacker tool found on your site” instead of “MAL-005: WSO/FilesMan webshell signature”</li>
</ul>
<p>Each finding card answers three questions: what happened, why it matters, what to do.</p>
<h4>How verified-safe checking works</h4>
<p>When a file changes, Malroot looks up its MD5 hash in:</p>
<ol>
<li>The official WordPress.org core checksums API</li>
<li>The official plugin checksums at downloads.wordpress.org</li>
<li>A recent plugin/theme update window from the operator’s own update history</li>
</ol>
<p>Files that match an official checksum auto-accept silently — the user never sees them. Files that match a malware signature get flagged as critical regardless of any update window. Custom files and theme edits surface for manual review.</p>
<h4>Real-world validation</h4>
<p>Malroot was developed during the cleanup of compromised WordPress sites, including sites where the rogue plugin had embedded a MySQL trigger that recreated a <code>newsfeed</code> admin user every time a spam comment was posted. That attack pattern is now a built-in detection.</p>
<h3>External services</h3>
<p>This plugin connects to the external services listed below. By default only the WordPress.org checksum APIs are used; the rest are opt-in. Each is documented with what is sent, when, and why.</p>
<p><strong>WordPress.org core checksums API</strong> (<code>api.wordpress.org</code>)<br />
Used to verify whether changed core files match official WordPress release checksums. The plugin sends only the WordPress version string and locale (e.g. <code>6.5.4</code> / <code>en_US</code>) to fetch the public checksum manifest. No site content is sent. This is the same API WordPress core uses for its built-in checksum tool.<br />
Provider: WordPress Foundation. Privacy policy: https://wordpress.org/about/privacy/. Terms: https://wordpress.org/about/</p>
<p><strong>WordPress.org plugin checksums</strong> (<code>downloads.wordpress.org</code>)<br />
Used to verify whether changed plugin files match the checksums of the version installed from the WordPress.org plugin directory. The plugin sends the plugin slug and version to fetch the public checksum manifest. No site content is sent.<br />
Provider: WordPress Foundation. Privacy policy: https://wordpress.org/about/privacy/. Terms: https://wordpress.org/about/</p>
<p><strong>ipapi.co GeoIP lookup</strong> (<code>ipapi.co</code>) — optional, OFF by default<br />
Disabled unless the administrator turns on “IP geolocation” on the Settings page. When enabled, it displays a human-readable country and city for IP addresses recorded on the Login Activity page. The plugin sends only the IP address being looked up, and only when an administrator opens the Login Activity page — never during normal site traffic. Results are cached locally for 30 days so each unique IP is queried at most once per month. If the option is left off (the default), no IP address is ever sent and login records simply show the raw IP.<br />
Provider: ipapi. Privacy policy: https://ipapi.co/privacy/. Terms: https://ipapi.co/terms/</p>
<p><strong>Slack incoming webhook</strong> (URL configured by the site administrator, optional)<br />
If the site administrator enters a Slack incoming webhook URL on the Settings page, critical and high-severity alerts are POSTed to that URL as a short notification payload (event type, severity, summary, and site host). No site content, credentials, or scan results are sent. This service is opt-in and only active when a webhook URL has been configured.<br />
Provider: Slack. Privacy policy: https://slack.com/trust/privacy/privacy-policy. Terms: https://slack.com/terms-of-service</p>


Malroot Security

Catches database-resident backdoors, rogue admins, malicious MySQL triggers and self-healing rootkits other scanners miss.

quttera

<p>Quttera ThreatSign protects your WordPress website with multi-layered security:</p>
<p><strong>Malware Detection:</strong> Powered by Quttera’s AI-driven heuristic engine, the scanner detects malicious PHP, obfuscated JavaScript, hidden iframes, redirects, spam, SEO malware, and credit-card skimmers targeting checkout pages. The plugin performs on-demand scans directly from your WordPress admin and checks your domain against more than 40 global security authorities, including Google, McAfee, Norton, and Yandex. Detection capabilities are continuously enhanced using insights from Quttera’s worldwide threat intelligence network.</p>
<p><strong>Brute Force Protection:</strong> Prevents unauthorized login attempts with IP locking, configurable rate limiting, and environment-aware protection policies. Supports both shared hosting (aggressive locking) and dedicated servers (progressive delays). Includes emergency bypass mechanism for critical situations.</p>
<p><strong>Bot Protection:</strong> Layered defense against automated attacks using multi-stage risk evaluation, token-bucket rate limiting, and legitimate bot recognition (Googlebot, Bingbot, etc.). Protects REST API, XML-RPC, and WooCommerce endpoints with endpoint-specific risk scoring.</p>
<p><strong>Admin User Monitoring:</strong> Real-time detection and alerting for unauthorized admin additions, removals, and role changes with database audit trail and snapshots.</p>
<p>For complete protection—including automated malware removal, scheduled scanning, WAF, and 24/7 monitoring—you can upgrade to a ThreatSign Website Security plan.</p>
<h4>Malware Detection Features:</h4>
<ul>
<li>One-click on-demand scans from WP admin</li>
<li>0-day (unknown threat) detection via heuristic & behavioral analysis</li>
<li>Detection of malicious PHP (backdoors, shells, injections)</li>
<li>Detection of obfuscated or polymorphic JavaScript</li>
<li>Identification of malicious iframes, redirects & hidden links</li>
<li>Detection of spam & SEO malware</li>
<li>Checkout skimmer detection</li>
<li>Inspection of WordPress core file integrity</li>
<li>Detection of alien or unauthorized files in core directories</li>
<li>External links and outbound reference analysis</li>
<li>Blacklist checks across 40+ security authorities</li>
<li>Cloud-based scanning to reduce server resource load</li>
<li>Detailed investigation reports with severity levels</li>
</ul>
<h4>Brute Force Protection Features:</h4>
<ul>
<li>IP-based locking with configurable thresholds</li>
<li>Multi-stage failure detection with soft and hard locks</li>
<li>Environment-aware policies for shared hosting and dedicated servers</li>
<li>IP whitelist/blacklist with CIDR notation support</li>
<li>Emergency bypass mechanism via constant or filter</li>
<li>User account lockout alerts via email</li>
<li>Combo-lock (IP + username) detection</li>
<li>Rate limiting with progressive delays</li>
</ul>
<h4>Bot Protection Features:</h4>
<ul>
<li>Multi-stage risk evaluation with heuristic analysis</li>
<li>Token-bucket rate limiting across multiple lanes (global, REST, XML-RPC, checkout, cart)</li>
<li>Legitimate bot recognition (Googlebot, Bingbot with elevated rate limits)</li>
<li>REST API enumeration and authentication protection</li>
<li>WooCommerce endpoint protection (checkout & cart)</li>
<li>Configurable operation modes (Observe, Balanced, Aggressive)</li>
<li>Risk-based challenge mechanisms and exponential backoff</li>
</ul>
<h4>Admin User Monitoring Features:</h4>
<ul>
<li>Real-time detection of admin user additions and removals</li>
<li>Admin role change tracking</li>
<li>Database snapshot comparison for audit trail</li>
<li>WP-Cron scheduled checks (1-minute intervals)</li>
<li>Immediate detection via WordPress hooks</li>
<li>Email alerts for unauthorized changes</li>
<li>Comprehensive alarm system integration</li>
</ul>
<p>If you need malware removal assistance, contact us at support@quttera.com or sign up for any<br />
of our ThreatSign annual plans, which include cleanup & blacklist removal:<br />
https://quttera.com/anti-malware-website-monitoring-signup</p>
<h3>Credits</h3>
<ul>
<li><a href="https://quttera.com" rel="nofollow ugc">Quttera</a></li>
</ul>
<h3>Plugin’s other home</h3>
<ul>
<li><a href="https://quttera.com/wordpress-malware-scanner" rel="nofollow ugc">WordPress Malware Scanner</a></li>
</ul>


Quttera ThreatSign – Web Malware Scanner for WordPress

WordPress multi-level security scanner detecting malware, 0-day threats, brute-force attacks, bot attacks, and unauthorized admin changes.

Malroot Security vs Quttera ThreatSign – Web Malware Scanner for WordPress