Writable paths
Flags executable or disguised PHP patterns in upload and cache locations where they deserve investigation.
Free plugin download · no signup
Scan WordPress for malware with a free local plugin
Download the plugin, run file checks inside WordPress, review suspicious evidence, and quarantine one verified file at a time without uploading site files to this portfolio.
Free local scan, not an online URL scan
Install the ZIP in WordPress to check high-risk writable paths and compare available core files with WordPress.org checksums. A clean result is not proof that the site is secure, and the plugin does not delete findings automatically.
What it checks
A conservative review queue for WordPress files
The plugin reports explicit evidence so an administrator or developer can review context before changing the site.
Core checksums
Compares available WordPress core files with official WordPress.org checksums and leaves mismatches for review.
Reversible quarantine
Moves one reviewed file to a protected local folder, changes its executable extension, and keeps a restore action.
Local-first privacy
The scan and quarantine workflow stays on the WordPress installation and does not upload site files here.
Choose the right scan
Local file scanning is different from a public URL scan.
An online scanner can inspect the public response, blacklist status, and exposed browser content without installing software. This downloadable plugin runs inside WordPress so it can review local files that a public URL scan cannot see.
Use both perspectives when an infection is suspected, then compare findings with known plugin sources, access logs, recent changes, users, scheduled tasks, and database content.
Plugin requirements
- WordPress 6.0 or later
- PHP 7.4 or later
- Administrator access to upload and activate a plugin
- A recoverable file and database backup
- A staging or maintenance plan before cleanup
Installation
Install and run the WordPress malware scan
No account or connection code is required for local scanning or quarantine.
- 01Back up the site
Confirm that the WordPress files and database can be restored before any investigation or cleanup.
- 02Upload the ZIP
Open Plugins → Add New → Upload Plugin, choose the downloaded ZIP, then install and activate it.
- 03Run the local scan
Open Adnan Khan Security in WordPress admin and start the file safety scan.
- 04Review before quarantine
Compare each finding with trusted sources and logs; quarantine only a file whose context has been checked.
Questions
WordPress malware scanner FAQ
Is this an online WordPress malware scanner?
No. It is a downloadable WordPress plugin that runs file checks inside the site. Use a reputable remote scanner as a separate public-response and blacklist check.
Does a clean scan prove that WordPress is secure?
No. The plugin is intentionally conservative and cannot identify every compromise. Review users, logs, scheduled tasks, database content, plugins, themes, access keys, and recent changes when an infection is suspected.
Does the plugin scan the WordPress database?
No. This release focuses on writable-path file patterns and available WordPress core checksums. Database review is a separate investigation.
Will the scanner delete malware automatically?
No. It does not bulk-delete findings. A reviewed file can be moved into reversible local quarantine, and core mismatches remain review-only.
After the scan
Turn the findings into a safe cleanup decision
No findings does not prove that a site is clean. Review administrator accounts, recent changes, scheduled tasks, access logs, database content, plugins, themes, and credentials when compromise is suspected.
For a checksum mismatch or suspicious writable file, compare the file with a trusted source and preserve a recoverable backup before quarantine or replacement.
Need a second review?
Share the scan result, affected URL, recent symptoms, and hosting context through Upwork. The first step is to verify the evidence and define a contained investigation, not to promise an automatic cleanup.
Discuss a WordPress security review