What a WordPress malware scanner can and can’t catch
A WordPress malware scanner reliably catches known malware in files, many obfuscated variants, modified core files and injected scripts in the database. It can miss brand-new or heavily disguised code, malware outside the folders it scans, and attacks that don’t leave files at all, such as a stolen password. Scanning is one layer: pair it with file integrity checks, a firewall and alerts.