How a WordPress malware scanner works
Almost every WordPress malware scanner combines a few techniques. Knowing which one found a problem, or could have, tells you how much to trust a clean result.
| Technique | What it does | Strength | Weakness |
|---|---|---|---|
| Signatures | Matches files against patterns of known malware | Very few false alarms; names the threat | Only finds what someone has already seen and described |
| Heuristics | Flags suspicious behaviour such as eval on decoded input, long encoded strings, or file writes from uploads | Can catch new variants | More false positives; obfuscated legitimate code looks suspicious too |
| Integrity checks | Compares files with the official checksums for that exact release | Catches any change to core files, known or not | Only works for files with a published known-good version |
| Database scanning | Searches posts, options and widgets for injected scripts and links | Finds infections that never touch a file | Legitimate content contains scripts too, so results need review |
| Runtime detection | Watches what code does while the site runs | Sees malware that only decodes itself in memory | Only sees code paths that actually execute |
Silent Threads uses 74 built-in signatures plus live signatures from a signed cloud feed (immediately on Pro and Agency, 30 days after release on Basic). It adds Core File Integrity, Database, Persistence and Attack Surface scanners on every plan, and Runtime Malware Detection on Pro.
What scanners catch well
- Known web shells and backdoors, including the many copies of the same families that circulate between attackers.
- Modified WordPress core files. Integrity checks catch these even when the change is new, because any difference from the official file is a finding.
- PHP files where they don’t belong, such as in uploads.
- Common SEO-spam and redirect injections in theme files and the database.
- Known card-skimmer scripts on shop pages, if the scanner looks at front-end JavaScript (Pro, in our case).
- Persistence tricks: unknown must-use plugins, scheduled tasks that re-download malware, and rogue administrator accounts.
What a scanner can miss
No scanner sees everything, and any vendor who says otherwise is overselling. These are the honest gaps:
- Brand-new malware. Signatures exist only after someone has analysed a sample. Heuristics help, but a careful attacker can write code that looks ordinary.
- Heavy obfuscation in places that are normally obfuscated. Some premium plugins and themes encode their own licence code, which gives malware somewhere to hide.
- Files outside the scanned area. A backdoor in another site on the same hosting account, or elsewhere on the server, is invisible to a scan of one WordPress folder.
- Attacks with no malicious file. A stolen administrator password, a legitimate plugin used in a harmful way, or a change to a setting is not “malware” to a file scanner.
- Malware that lives off-site. A single harmless-looking tag that loads a script from another domain may only turn malicious at that domain, and only for some visitors.
- Changes inside premium plugins, when there is no public known-good copy to compare against. Silent Threads’s Premium Plugin Drift (Pro) tracks unexpected changes to paid plugin code over time for this reason.
Why scanners flag clean files
False positives come mostly from heuristics. Minified JavaScript, encoded licence checks, backup tools that use eval or base64, and security plugins’ own signature files can all look suspicious. Before deleting a flagged file, compare it with a fresh copy of the same version from its source. If they match, it’s a false positive. Good scanners let you mark a file as reviewed so it doesn’t keep alerting.
The same caution applies to new detection rules. Silent Threads starts every new live firewall rule in report-only mode, and it only blocks once the rule has run in the wild without false positives.
Closing the gaps a scanner leaves
- Block the way in. A web application firewall stops many exploit attempts before any file is written. Ours has 356 built-in rules on every plan.
- Protect logins. Two-factor authentication and brute-force protection stop the “no malware needed” attacks. Both are on every plan.
- Alert on the things that matter. A new administrator account is the clearest sign of a compromise, so get an instant email when one appears.
- Watch outbound connections. Malware that phones home shows up as connections your site never used to make (Outbound Connection Monitor, Pro).
- Keep backups you can date, so “clean” has a reference point.
How to read a scan result
Treat a finding by its type. A modified core file or PHP in uploads is a near-certain compromise. A heuristic warning in a premium plugin is a question to answer, not a verdict. A clean result means the scanner found nothing it knows to look for, so it’s strongest when it follows a clean-up that replaced files from trusted sources, as described in how to remove malware from WordPress. If you’re not sure whether you’ve been hacked at all, start with the signs of a hacked WordPress site.
What to ask when you choose a scanner
- Does it scan the database, not just files?
- Does it check core files against official checksums?
- How do new signatures arrive, how fast, and are they signed?
- Can you see why something was flagged?
- What does it send off your server to do the scan?
Our guide to choosing a WordPress security plugin covers these and eight other questions.
How we checked this guide
This article describes general detection techniques and their known limits; it is not a benchmark of any product, and it doesn’t claim detection rates. Silent Threads features are named with the plan that includes them.