FAQ

Welcome to MalCare FAQ and Support. Have any question about MalCare? You’ll find the answer here.

General

What is MalCare?

MalCare is one of a kind WordPress security plugin. It automatically scans your website once every day. It offers One-Click Cleaning and Site Hardening facilities. Take a look at our feature page.

What is a malware?

Malware (Malicious Software) is a generic term used to refer to a variety of forms of hostile or intrusive software. It includes virus, backdoors, rootkits, adware, spam and many other types.

Do I really need MalCare?

MalCare is a comprehensive deep scanning, and instantaneous cleanup and protection WordPress Security service. It promises to keep your website safe from hackers. If you care about keeping your WordPress website safe, then you definitely need a security solution like MalCare.

Will MalCare work if my site is down?

We understand the pains of a website going down. If a site goes down after you have added the website and installed the plugin from the dashboard, MalCare will clean up your site.

But if you add a website that was down beforehand, i.e. before adding the plugin, then MalCare won’t work.

I already have backup solution. Something happens to my site, I can simply restore. Why do I need a security plugin?

Backups play a very important role in WordPress security, but it has some limitations. We have noticed that in many cases, it is weeks before a site owner realizes that his/her website has been hacked.

During this period multiple backups will be taken and there will be a high chance that the files that contain the hack or the Malware are also backed up.

In such a case restoring from backup is not sufficient as it will not clean your website.

Here is where a Malware solution like MalCare comes in. It does regular automated scans of your website and notifies you if there is any sort of Malicious content on your website.

What is the difference between MalCare free and paid version?

We’ll scan and protect your website with firewall in the free MalCare version.

The paid version includes cleaning a hacked site, website hardening, website management, white-labeling, client reporting, and taking regular backups. KIndly take a look at our feature page for more details. 

Are there any prerequisites for using MalCare?

None. You just need to have a WordPress site. We don’t use your website resources for scanning or cleaning so you will not experience any downtime while executing those functions.

Will MalCare work if I already have a different security plugin installed?

Absolutely yes, MalCare is compatible with all plugins.

Isn’t WordPress secure enough?

WordPress core is safe but the CMS does not work in isolation. Plugins and themes are part of its ecosystem. Several studies on hacked sites show that plugins and themes are responsible for a majority of such compromise. MalCare is an easy and effective way of securing websites and keeping them safe from hack attempts. Look at this full feature list.

Why will an SSL certificate not suffice?

An SSL certificate is used only to encrypt a connection between the browser and server to safely transmit sensitive information. However, MalCare goes beyond and actually protects the database where this information is stored, scans your website files using 100+ intelligent signals automatically and applications, protects from data breaches and spreading of viruses/malware. These functionalities are not provided by an SSL certificate.

What is SSL?

An SSL (Secure Sockets Layer) is a certificate on the website that allows for the safe passage of information from the client to the host server via encryption. If your site uses an SSL certificate, you have to know the status of the certificate to keep your site’s visitor information secure. This is particularly important for WooCommerce sites.

Does MalCare work with all hosting providers?

MalCare works with all web hosts. We will protect your WordPress site, whether it’s on popular web host like GoDaddy, BlueHost, HostGator, 1 & 1, DreamHost, WPEngine, etc, or if it’s on a smaller web host.

How is MalCare the best for agencies or developers?

We’re the best because of three features:

  • We have developer-friendly plans that are easy on the wallet. If you’re a developer or an agency that hosts about 10 websites, chances are that enterprise-level security packages would be too expensive for you. If you’ve got anything more than seven sites, take a look at our unlimited plans.
  • Our auto-clean feature makes sure that you can scan, and clean your sites by yourself, so you don’t waste precious time.
  • MalCare’s regular scans alerts you whenever it identifies hacks so your sites are always secure.

 

Why am I getting so many failed login attempts?

Our WordPress security plugin offers to alert you when there are malicious attempts made to log into your website admin panel. You can disable the brute force attack alerts whenever you want, and the plugin will still keep a log for you to manually review.

What resources does MalCare need?

None at all. We make the use of MalCare server so as to ensure your site does not experience any downtime, and your resources are used only by our site.

What platforms does MalCare support?

We support WordPress and WooCommerce sites.

Is there a minimum commitment needed for the subscription or can it be cancelled at any time?

There is no minimum commitment needed to subscribe to MalCare. You can cancel your account at any time, without any penalties. You are only charged as long as you are using the service.

Can I scan multiple websites?

Yes, of course, you can! MalCare is capable of securing multiple websites. If you have more than one, we highly recommend the Business or Developer plans. These plans are great for small businesses, designers, developers, and agencies.

Can I remove one domain and add another, as long as there are 5 (or more) websites as per the limit?

You can most certainly change domains once in a quarter. No hard binding for life.

Does MalCare store passwords?

No, we do not access or store any passwords.

What information does MalCare store?

We only store data related to your site structure such as plugins/themes with their respective versions. This helps us identify vulnerabilities that may be present on the site. We track the IPs of visitors to your site, to identify malicious actors who might attack your site.

How to get started with MalCare?

You can purchase MalCare from the pricing page. Based on your requirements, choose a suitable plan. Here’s a guide on how to get to get started with MalCare.

Will my site experience any down time?

MalCare doesn’t use any of your website resources for scanning or cleaning so you will not experience any downtime while executing those functions.

My site got infected and I didn’t receive any alerts?

This shouldn’t happen. Please check your spam box and if there is really nothing there please open a ticket in our system and we’ll check this out.

What makes MalCare better than other security plugins?

MalCare was developed after analyzing 240,000+ websites.

  • It uses 100+ internal signals to Scan and identifies the most complex malware.
  • It pinpoints the malware’s exact location on your site. It does remote scanning, to ensure there are Zero loads on your server.
  • MalCare comes with an industry first One-Click Malware removal service that eliminates any malware in a jiffy.
  • We alert you only when there is a legitimate malicious discovery rather than ‘possible hacks.’

We feel these features set us apart from most other WordPress security plugins. For further information take a look at how MalCare stands when compared with Top Security Plugins

How do I avail MalCare services for WordPress security?

MalCare is dedicated to making WordPress site secure. Please take a look at this guide on how to get started with MalCare.

Does MalCare create or modify my site files or contents?

No. We do not make any changes to your site contents, and do not add any files from MalCare security operations.

What if I have more than 100 sites?

Please contact us so that we can discuss your needs in details. 

What do I do if I receive an server error alert?

In most cases, you’ll need to check with your host regarding server errors. We will try our best to help you if you get in touch with us

Will I have to scan or clean my website from the shell or cron?

Once MalCare is installed on your website, it intelligently handles complete site security without requiring user intervention. There will be no need to worry about session time-out in security operations, as might be the case in other security plugins. MalCare runs on its own off-site servers.

If I install MalCare, will I get free access to BlogVault too?

To use the backup service that BlogVault (our sister product) offers, you will need to upgrade to a Security + Backup plan. Take a look at the pricing page.

What other WordPress products have you got?

We have a sister product called BlogVault. It’s a website backup plugin, dedicated to making WordPress backups and security easy and efficient.

I already have a security plugin installed. What should I do?

MalCare is compatible with all plugins. It works even if you have a different security plugin installed. But if you want to uninstall a plugin and install MalCare plugin, kindly take a look at our guide on how to switch to MalCare.

Can I use your Website Backup service if I am not a MalCare customer?

We have a WordPress backup and security plugin called BlogVault which you can install from here.

Account Management and Settings

How do I create an account?

To create an account, kindly view this sign up procedure.

Do I need a plugin?

Yes, MalCare plugin needs to be installed and activated on your website. The plugin is a necessity because it works in tandem with our server.

Here’s a summary of how the MalCare plugin works:

  • After you add a site and install the MalCare plugin, the plugin helps copy all executable files from your website to our MalCare server.
  • We then scan these files on our server which takes off load from your server. As a result, your website does not experience any downtime.
  • In all subsequent scans, the plugin only copies the incremental changes to the site.

 

What if I forgot the email I use for sign up?

If you face such problem, please don’t hesitate to reach out to us using the contact us page.

Can I Add Sites to my MalCare Dashboard?

Yes, you can. Simply follow our guide on how to add websites to MalCare account.

Can I change the password associated with my MalCare account?

Yes. We have a guide on how to change or reset a password. Please take a look.

Can I view my current MalCare subscription?

Yes. Kindly take a look at our guide on how to view current subscriptions

Can I cancel my account at any time?

Yes. Although we’d hate to see you go, you can cancel your account from your account dashboard any time you want. 

How do I create a secure password?

Follow the guidelines for a secure password.

What is the difference between MalCare and BlogVault when the dashboard looks the same?

The difference lies in your subscription plan. For smaller plans, BlogVault is focused only on backups and MalCare only on security despite similar looking dashboard. Higher plans for BlogVault and MalCare are same and there is no difference in the service.

Can I change the email address associated to my MalCare account?

Yes. Please take a look at this guide to changing or resetting your email address.

Can I change or reset my password?

Yes. Kindly take a look at our guide to changing or resetting passwords.

Can I cancel my MalCare subscription?

Yes. We are sorry to see you go but you can cancel your MalCare subscription any time you want.

Can I search for a specific site on the Site Listing Page?

Yes. Please take a look at our guide to using MalCare’s Advanced Search Option.

Can I remove the branding or disable the MalCare badge from my website?

The badge doubles up as an affiliate but you can remove it whenever you want. Kindly take a look at this guide on how to remove MalCare badge.

Can I deactivate the branding or logo from my dashboard?

Yes, you absolutely can. Kindly follow our guide on how to remove the MalCare branding.

What is the benefit of having the MalCare badge on my site?

The benefits are two folds:
1. It helps a visitor trust your website because it’s using a WordPress Security Plugin. It means that the website cares about keeping itself and it’s visitors safe.
2. The badge doubles up as an affiliate. Anyone who clicks on the badge consequently lands on the MalCare page. If they sign up, you get a commission.

I disabled the badge, but why does it still show on my website?

Cache is likely preventing you from seeing the change you have just made. Kindly clear your cache using a WordPress cache plugin.

Can I change coverage between sites?

You can change coverage between sites but only every quarter. Once you add a domain, it’s attached to the account for the next 90 days. Only after this period of time is over, you can remove a domain and add a new domain in its place.

Please upgrade your MalCare subscription if you need to add more domains.

Can I cover my subdomains and test sites?

For us, every single WordPress install is a separate site. It means that if you have a network of websites on a single WordPress installation, we treat that as a single license.

How do you handle WordPress Multisite installs?

We completely understand the concern and complexities surrounding WordPress Multisite installs. We treat each WordPress install as a license. It means that if you have a network of websites on a single WordPress installation, we treat that as a single license.

Will you clean all the websites at the root of my user account?

Each MalCare plan is per site, so you should either upgrade your account to cover all websites on your server, or you can isolate your site that is under our protection to its own server.

We cannot effectively clean one site on your server if all the other sites are infected. Cross-site contamination will lead to sites infecting one another in an endless circle.

Features

Scan

Does MalCare scan all the files on my website?

By default, MalCare scans only WordPress files. However, you can also add non-WordPress files and then run a scan.

Does MalCare scan my website's database?

MalCare is working on enabling scanning of the database. Sign up for our newsletter and be the first one to know when the feature arrives.

What are skipped files?

By default, MalCare scans only WordPress files. Skipped files are non-WordPress files. However, MalCare allows you to add non-WordPress files and then run a scan.

What are skipped tables?

By default, MalCare scans only WordPress tables. Skipped files are non-WordPress tables. However, you can also add other tables and then run a scan.

How many times does MalCare auto-scan a website?

MalCare auto-scans a website once every 24 hours. 

What is a false positive?

At MalCare we care about our customers. That is why we don’t want you to be distracted by false alarms. MalCare notifies you only if a harmful malware has been detected without the false-positives.

How does MalCare detect complex malware?

MalCare scans all your website WordPress files beyond just signatures and evaluates it automatically using powerful technology with the collective knowledge of 240,000+ sites. It uses 100 + intelligent signals automatically for deep scanning and combing through all the files. That is how it detects even the most complex and well-hidden malware on your site. 

How does MalCare avoid overloading website server?

MalCare performs all the heavy lifting of scanning your entire site WordPress files on its own. It does not use your site resources. MalCare runs its security operations on MalCare servers, thereby ensuring zero loads on your site.

Are Deep Scans truly automatic?

Yes. By automatic we do not mean, we take over the working of your website, but instead, help you run your site successfully, side by side. MalCare performs daily checks and routine deep scans using 100+ intelligent signals across all your WordPress files, only after you authorize it, the first time. To know more take a look at our MalCare Scan feature

Why is it important that MalCare detects malware earlier than other security plugins?

The objective of a good security plugin is to find malware. MalCare goes beyond by pinpointing exact nature and location of any malware detected on your site, with great speed. This means you are alerted to the malware before any damage occurs to your sites, like search engine blacklisting or web host blocking of your site. 

How do I know that MalCare is accurate?

MalCare does not allow room for faulty security. It catches malware on your site, and only after it verifies that the malware is truly malicious, it alerts the user. MalCare does not give you false alarms with false positives.

Does MalCare affect my site performance?

No, not at all. MalCare performs all the heavy lifting of scanning your entire site WordPress files on its own. It does not use your site resources. MalCare runs its security operations on MalCare servers, thereby ensuring zero loads from its side on your website.

How do I exclude all files with a particular extension (e.g. .zip) from being scanned?

Unfortunately, you cannot exclude any WordPress files from being scanned. It is better to scan every file in WordPress directories so as to find any malware on your site.

Can I scan my website whenever I want?

Yes. We have a guide on how to do on-demand scanning, please take a look.

Can I exclude particular tables or files or directories from the scanning?

Unfortunately, you can’t exclude WordPress files from being scanned. It is better to scan every file in your WordPress directories so as to find any malware on your site.

Can I custom schedule the scanning process?

Yes. Here’s our guide on how to custom schedule the scanning process from your MalCare dashboard.

Can I configure a site to never scan?

Yes. You can Disable Security features on MalCare dashboard.

Does MalCare scan website database?

We currently do not scan Database but this feature is coming out very soon.

Clean up

Are clean ups automatic?

MalCare’s clean up process is automatic. Our uniquely developed system makes the process easy and without the need of a human intervention. Kindly have a look at our guide on how to auto-cleanup a site.

How do I report a hack or malware in my site?

Please contact us and we will get back to you asap. 

Will your software remove only the infected code from the files and then let the clean file(s) stay on the server?

Yes, MalCare will only remove the infected code from the files and the clean files will stay on the server.

Does MalCare remove or delete infected files that are part of the website and WordPress?

No, we do not delete files. As far as it’s possible, we avoid deleting files which are a part of WordPress and the website. We also take extra precautions to make sure that the site does not break. For instance, if we find a complex hack in the file, our team manually looks into this file and removes the malware or hack. We even keep a copy of the files in case something goes wrong with the website.

Do you offer one-time cleanup?

Unfortunately, we don’t offer one-time cleanup at the moment. But, it’s a feature we are working on and will be enabling soon. 

How does the unlimited cleanup policy work?

A situation may occur where your site is being repeatedly infected. In such events, there is no limit to the number of times you can clean up a hacked website.

But if the situation persists, then cleaning up the site, again and again, will not solve the problem. In such cases, you can contact us and we will help improve your security posture. We’d ask you to take proactive measures based on the recommendation of the Support team. We reserve the right to refuse service until appropriate actions are taken from your end. In cases like this, we also reserve the right to deny refund or cancellation of the account.

How do I begin the cleanup process?

Once our system alerts you of a hack found on your website, you will need to log in to your MalCare account. Next, select the hacked site that you want to clean. To initiate the cleanup process, please follow our guide.

How do I stop an in-progress scan or clean up?

While you cannot stop an in-progress scan due to security reasons, you can, however, cancel the cleanup activity once it has started by simply clicking the Cancel button on the Clean up window from your MalCare dashboard.

Will the cleanup process break my site?

We do our very best to keep any of your site’s functionality from failing. In instances when your site’s functionalities fail, we urge you reach out to our Support team. We are here to help.

Will MalCare leave large temporary or cache files behind after cleaning up?

Rest assured. MalCare does not leave any files behind on your website.

Does my site get cleaned manually or automatically?

Both. Normally the hacks are cleaned automatically but there are instances where a hack that is more complex, or is present in sensitive locations of a website. In such situations, our engineers intervene to further investigate the file and manually remove the malware.

I got an email regarding manual clean up. What do I do?

You can send an email to the support team on support@malcare.com and notify our team regarding this. Our engineers intervene to further investigate the file and manually remove the malware.

After scanning of my website once, how long do I have to wait to run another on-demand scan?

You will need to wait for at least 30 minutes. And only after that can you scan your site again.

Will you clean my website if it’s already infected?

Yes, we will clean your website if it’s currently hacked. Please take a look at our guide on cleaning a hacked website.

What do I need to clean my website?

In order to begin the cleanup process, we need access to your server and its associated files.
We get this access in the form of FTP, SFTP, or SSH access to your server. FTP stands for File Transfer Protocol, sFTP for Secure File Transfer Protocol, and SSH for Secure Shell. These are connection protocol mechanisms that allow us to log into servers to edit/add/remove files.
These connection protocols allow us to log into your websites, specifically the server, and perform the remediation process. If you for some reason are unfamiliar with these protocols, don’t worry, our team of analysts is prepared to assist you in the process. To do so, you’ll need to be willing to share access information to your hosting account.

We covered how to clean a website here. Here’s a guide on how to find FTP credentials and another guide on how to locate a folder where WordPress is installed.

What do I need to clean my website?If the whole file is bad and is not part of the website or WordPress, then will your software remove the file completely?

Yes. If the file is not a part of WordPress and the entire file is infected, then we will remove the entire file from your website.

Can I clean multiple websites?

Yes, you can add multiple sites to MalCare dashboard and clean them one by one.

How many times can I clean my site?

With MalCare you can clean your websites as many times as you want, given that a hack has been detected.


How long does it take to clean a site?

It really depends on the size of the website. In average, cleaning up with MalCare usually takes 5-10 mins.

Do you backup the site before cleaning?

We back up the entire site – every file, and database on your website. 

I could not auto-clean my website. What do I do?

You can send an email to the support team on support@malcare.com and notify our team regarding this. Our engineers intervene to further investigate the file and manually remove the malware.

How long does it take to clean my website under Emergency clean up?

It takes us 4-6 hours to clean your website.

Protection

How does the protection work?

We provide protection via our Web Application Firewall and Login Protection features. The firewall helps evaluate IP requests and blocks specific IPs who are known for their malicious intent from sending a request to your website. As for MalCare’s Login Protection feature, it prevents bots from entering your website stealing your data, spamming and other malicious activities.

WordPress has recommended few extra security measures which will harden the security of your website. We have incorporated those recommendations in our Site Hardening feature. Kindly have a look at our guide on how to implement Site Hardening.

What do I have to do to activate the protection?

When you add a site to your MalCare account, the Web Application Firewall and Login Protection is automatically enabled.

WordPress has recommended few extra security measures which will harden the security of your website. We have incorporated those recommendations in our Site Hardening feature. Kindly have a look at our guide on how to implement Site Hardening.  

Can I expect any down time?

No, downtime is not expected when activating the protection.

Why does my site need login protection?

Hackers can bypass the login security measures of a website. Limiting the number of failed login attempts from one IP address within a limited period of time is one of the most effective strategies for keeping pesky hackers away. Please take a look at how to enable Log in Protection

When is captcha protection enabled?

Suspicious login activity will face automatic captcha based login protection. This is done so that hackers trying to log in using bots can be kept at bay. It’s a well-known fact that bots cannot solve captcha-based problems.

Can I protect multiple websites?

Yes, you can add multiple sites to MalCare dashboard and protect them from brute force attacks, multiple login attempts, bot attacks etc. using MalCare. We highly recommend the Business or Developer plans if you have a large number of users. These plans are great for small businesses, designers, developers, and agencies.

How does MalCare protect my site from hackers and bots?

MalCare offers a wide range of features designed specifically to keep malicious hackers and bots at bay. Please take a look at our feature page

Will it stop hackers from exploiting vulnerabilities?

MalCare protects against vulnerabilities, however, there are certain vulnerabilities that our Firewall cannot protect against, hence we recommend that you keep your WordPress site fully updated all the time. For further information, have a look at Why Updates are Important For WordPress Security.

What is site hardening?

Site Hardening includes all the best industry standard security practices are used to:

  • Prevent the execution of PHP files in folders that get new files created like your cache or uploads, which are vulnerable to malware attacks.
  • Change the database prefix to help prevent SQL injections, when coupled with firewall protection.
  • Disable the Files-Editor so that they cannot make changes to any of your site’s files, just in case someone does access the backend of your website.

Please take a look at our guide on how to enable site hardening.

How does the MalCare Firewall work?

MalCare was created after analyzing over 240,000 sites from scratch. The Firewall constantly monitors traffic from all places and automatically blocks IP’s that seem malicious in nature. As such, it is automatically enabled and needs minimal overseeing.

MalCare Firewall ensures that attacks on your site by even bots are mitigated, without affecting your WordPress site. It monitors bots across a global level without ever overloading your server.

Will the Firewall feature affect my SEO?

No, the Firewall will not negatively affect your website SEO.

Is it possible to limit or block all login attemps from a country?

This feature is coming to MalCare very soon.

Will the Firewall work with my service or plugin or theme?

MalCare Firewall does not interrupt any legitimate plugin, theme, or service. Ours is an application-level firewall that allows all legitimate WordPress functionalities.

What do the statistics on the Firewall section indicate?

Traffic Logs show the IP requests and the incoming traffic requests made on the website.  It will show you

  • Allowed IPs
  • Blocked IPs
  • IPs that Bypassed protection due to whitelisting

The Blocked Requests are the number of malicious requests that were automatically blocked by MalCare. Please see How can I see the Traffic Logs made on my website?

Will my website experience downtime during Firewall activation process?

No. The Firewall is activated automatically without causing any downtime.

Do you guarantee my website won’t get compromised?

We guarantee that we’ll do everything in our power to protect your website from the likes of brute force attacks, hackers, bot attacks and the rest. Firewall will help block any sort of unwanted traffic to your website and Login Protection will help prevent any kind of brute force attempt to access your website.

Will you configure the Firewall for me?

Yes. When you add a site to your MalCare account, our firewall is automatically enabled for that site.

What does blocking PHP execution in untrusted folders mean?

This particular feature helps prevent execution of PHP files in folders which get new files created such as cache or uploads. Hence, saving your website from TimThumb/MailPoet attacks. To enable this feature, please take a look at our guide on how to enable site hardening

What is changing database prefix?

This particular option changes the database prefix for different tables on the site. While not sufficient by itself, coupled with our firewall, this makes SQL Injection vulnerabilities very difficult. To enable this feature, please take a look at our guide on how to enable site hardening

What does blocking plugin or theme installation mean?

It disallows plugins or themes from being installed or updated. Therefore, blocking hackers from installing their own malicious scripts if they get access to your site. To enable this feature, please take a look at our guide on how to enable site hardening

What does changing security keys mean?

You’ll be changing the security keys in wp-config.php. This will invalidate all the cookies etc. To enable this feature, please take a look at our guide on how to enable site hardening

What does resetting all my passwords mean?

You will be resetting all the passwords and activation keys for all the users. To enable this feature, please take a look at our guide on how to enable site hardening

What does disabling file editor mean?

This will help remove the File-Editor from the WordPress dashboard. It’ll help block someone who gains access to the site from modifying any files. To enable this feature, please take a look at our guide on how to enable site hardening

Can I whitelist IPs?
Do you block SQL and Java Injections?

We work on the IP level and hence do not scan for injection.

User Management

Can I disable the security operations whenever I want?

Yes, you can. Simply click on Disable Security option next to the Security section on your Malcare dashboard for your website.

What can I do when I notice suspicious malware on my website?

You can clean your site right away using the one-click Scan Now button. Kindly take a look at this guide

How can I look for specific sites on my MalCare dashboard?

Use Advanced Search feature to narrow down options and perform bulk actions on multiple sites based on the attributes you specify.

What is the difference between Clients and Team users?

Our client feature is for your reference alone. You can assign a client to their site. If you want to give a user, the dashboard access please add them as your team members under team section. Learn more here. Find out how to add clients or team members here.

Will I be able to access MalCare dashboard even when my site is down?

Yes. You can access and navigate the powerful MalCare dashboard to restore your site, even if your site might be hacked, or down.

Can I update plugins, themes and WordPress core within the MalCare dashboard?

Yes. Please take a look at this, this and this to learn about the process. 

Can I manage user roles in my site on MalCare dashboard?

Yes. You can delete, or change the role or password of users, remotely from the Account Settings page on MalCare dashboard. Here’s a guide on how to add Team members.

How does MalCare check for plugin updates?

We go through the detailed logs for the upgrade operation.

  • We scan the site once a day to get the list of updates.
  • Even when you update plugins, themes, or Core on our dashboard, before we update the plugins on a site, we refresh the list of plugins once more to get any new updates which might have come in.
  • If the above does not indicate any new version, then no new update is identified.

Malware Reports

What are MalCare reports?


MalCare reports will contain
1. Firewall audit logs
2. Site scan history

Can I show my clients the security scans made by MalCare?

Yes, you can show them the site scan details without giving them access to your MalCare dashboard. Send them a PDF document of Site Scan History under Reports. It is a log of MalCare scan history where you can see when your site was scanned exactly and how many times in the selected date range.

Can I show my clients the status of site security?

Yes, you can show the site’s Firewall audit logs. It will list down the malicious threats found on your website, and their status.

How to sort dashboard by site name?

Currently, we don’t have this functionality on our dashboard. We might add this very soon.

Can I check what MalCare is scanning?

Yes. Go to site details page, click on security widget and see the history.

Can I see malware stopped by MalCare?

Yes, go to site details page, click on firewall widget and see history.

What will the security report contain?

In the site details page, click firewall widget and see history.

MalCare security reports act as documentation for MalCare security operations like scanning and cleaning.
It will contain details on the site like:

  • Length, duration, and type of hack
  • Site cleaning timeline
  • Files compromised and/or hacked timeline
  • Number and type of attacks thwarted proactively
  • Firewall blocks
  • IP blocks
How to sort dashboard by site name?

Currently, we don’t have this functionality on our dashboard. We might add this very soon.

Manage Plugin

I am unable to reach the plugin. What can I do?

You can send an email to the support team on support@malcare.com and notify our team regarding this.

How do I contact the support team?

There are three ways of reaching out to us: use the small chat button, down in the right hand corner of the page. Or leave us a message in the contact us page. Or email us at support@malcare.com.

Can I have both the free and premium plugin installed on my website?

MalCare Premium has all the features from the free version. You can remove the Free version.

Can I update or change the URL of the site myself?

Currently we do not have an option for users to change site URL. You can provide us the URL which you want to updated, we will update it for you.

Does you service slow our website?

MalCare runs on its own servers. We take great care to ensure that we do not add load to your site. We do all the hard work of scanning, cleaning and protecting, on our servers and this is our USP.

Very happy with the service and want to give you guys a review. Where do I do it?

Thank you. We would love it if you could review our service here: https://wordpress.org/support/plugin/blogvault-real-time-backup/reviews/

Customer Support

Can I directly talk to the support team?

Yes, most definitely. Please reach out to us using this contact us page. We are always here to help you out.

How do I contact the support team?

There are three ways of reaching out to us: use the small chat button, down in the right hand corner of the page. Or leave us a message in the contact us page. Or email us at support@malcare.com.

Do I need to pay for support and help?

No, you don’t. We’d be happy to help you with any queries or issue.

Do you have a support ticketing system?

Yes, please leave us a message here.

Do you work every day?

We are available from Monday to Friday. Please feel free to reach out to us between 10 am to 8 pm IST.

You can reach out to us using the contact page or email us at support@malcare.com.

Subscription plans and Payment

Which plan should I choose?

Depending on the number of sites you want to secure using MalCare, you can choose between:

  • Personal (up to 1 site)
  • Business (up to 5 sites)
  • Developer (up to 20 sites) and
  • Agency plans (up to 100 sites)

MalCare Security plan focuses on security features such as Daily Automatic Scan, One-Click Malware Removal, and Website Protection.

MalCare Security + BackUp plan includes backup services as well. Kindly refer to our pricing page.

How are the features different between plans?

MalCare Security plan focuses on security features such as Daily Automatic Scan, One-Click Malware Removal and Website Protection. MalCare Security + BackUp plan includes backup services as well. Apart from this, the number of websites that you can add to your MalCare differs from plan to plan.

How do I purchase MalCare?

You can purchase MalCare from our pricing page. Based on your requirements, choose a suitable plan and then proceed to sign up

Can I pay monthly?

Our Personal and Developer plans are billed annually. Developer, Dev Plus and Agency plans are monthly plans. Please see our pricing page. Based on your requirements, choose a suitable plan and then proceed to sign up

What about a free plan?

We have a free plugin that scans a website once every 24 hours. Cleaning of an infected site, Website Protection, On-Demand Scan, Support is paid services.

Can I purchase two or more plans?

Yes. Please do remember to use different email addresses when subscribing to different plans.

Do you offer volume pricing?

Yes. Please get in touch with us and so that we can discuss the matter.

What types of payment do you accept?

We accept Credit Card payment. We use Stripe which is one of the safest mode of credit card transaction. Right now, we only accept payments online. We will not be able to accept purchase orders over the phone.

What payment currencies do you accept?

All prices are in USD. We’re not able to bill for MalCare Plans in any other currencies right now. We are working on making currencies flexible in future.

Can I pay through PayPal?

Please contact us at support@malcare.com or leave us a message here.

What if my credit card is declined?

There are a few reasons why a credit card may be declined on our payment page. The most common reason is that the credit card number, or CVV, or expiration date are incorrectly typed. Please try again, and enter all the details carefully. If you need further assistance, drop us a mail at support@malcare.com.

I signed up and paid, what do I do now?

After signing up and paying, you can start using MalCare. We have a Help Document to assist you in getting started.

Is there a setup fee?

There are no setup fee for any of our plans.

Can I upgrade or downgrade anytime?

Yes. Kindly refer to the Help Document to see how to upgrade or downgrade your plan.

Are there discounts for upgrading from one plan to another?

We love our customers. When you upgrade from a Monthly plan to Yearly, you pay only for 10 months and the rest 2 are on us.

What's the difference between the $249 Emergency Clean Up plan and Personal plan?

Our Emergency malware removal plan is for websites that are offline or blocked. If the user is not able to install MalCare plugin to the website, then our engineers will have to manually remove the hack and then install the plugin. This takes 4-6 hours and is done on a high priority basis. Our Personal plan is for websites that you can still install the MalCare plugin on. This way MalCare can be activated on your website and we can secure your site.

Do you charge VAT or GST?

No.

Can I change the credit card linked to my MalCare account?

Yes. Take a look at our guide on how to change the credit card linked to from your MalCare dashboard.

Can I change my current billing address?

Yes. Please see our help document on how to change the current billing address

Can I download my invoices?

Yes. We have a guide on how to download invoices, please take a look. 

Can I print an invoice?

Yes. Kindly, see this guide to learn how to print an invoice

Can I cancel my MalCare account whenever I want?

Yes. Kindly go ahead and take a look at our guide on how to cancel MalCare account.

Can I cancel automatic renewals for my MalCare subscription?

Yes. To cancel automatic renewals you will need to cancel your MalCare account. We have a guide to help you through the process. 

Do you have any cancellation fee?

MalCare is a pay-as-you-go service. We do not have any cancellation fees. When you cancel your MalCare account, you’ll be billed for the current cycle only and you won’t be billed again.

Is there any minimum commitment or can I cancel my MalCare account any time I want?

There is no minimum commitment for a MalCare user. You can cancel your account whenever you want, without any penalties. You are only charged as long as you are using the service.

Can you lower the prices?

MalCare is the first fully automatic WordPress malware scanning and cleaning plugin. It was developed after analyzing over 240,000 websites.

  • It uses 100+ signals to identify a malware and provides an instant one-click malware removal feature. Unlike other Security Plugins, with MalCare you can clean your website as many times as you want. We don’t charge you every time you want to clean your site.
  • MalCare’s firewall identifies and blocks malicious traffic before they access your website, saving it from brute force attacks, hackers, bot and the rest.
  • We are sure you appreciate making an investment for the sake of keeping your website safe from a hack. We urge you to please take a look at our feature page.
What are the terms of subscription?

All our plans are available either for monthly or yearly subscriptions without any minimum commitments. You can cancel your MalCare account from the dashboard whenever you want.

Is there a refund policy?

Refunds are only available within 30 days of purchase and will only be issued in case malware removal was not completed. Otherwise, you can cancel the account, but a refund will not be provided.

Do I need to pay for help and support?

We don’t charge you for help and support. We’d be happy to help you with any queries or issue.

Is the payment after a renewal automatic?

We will automatically charge your card on the record,on the renewal date.

How long does it take to clean my website under Emergency clean up?

It takes us 4-6 hours to clean your website.

FTP

I don’t have my FTP details. What do I do?

FTP is a way to transfer files online. Please refer to this article for details.

Are my FTP details stored anywhere?

No. None of your FTP details are stored by MalCare – on your site, or our servers. FTP data is simply copied to our servers and afterwards, it is wiped from our servers.

Error: “FTP permission issues, FTP is correct but we might not have permissions to upload or remove a file.”

This could happen when you’re on shared hosting. Contact your host and ask them to grant you access to upload files via FTP.

Where are my FTP details processed?

FTP details input into BlogVault are processed on our servers. We need your FTP credentials to access your website’s files and folders. We feel that FTP transfer is the safest way to transfer data to and from a site. However, they are treated like payment details (i.e. they’re not stored on our servers). Once we’ve processed them, they’re deleted from our servers.

You can provide SSH key in PEM format.

You can provide SSH key in PEM format.

Error: “Execution expired, Connection timed out, Connection reset by peer in both FTP and HTTP requests”

Nothing to worry, this notification means your destination server denied our requests to offload your site’s data. This could be because of a few reasons:

  • Your destination site isn’t reachable. You’ll have to contact your destination web host about this.
  • You have a firewall installed, which is blocking consecutive requests from the same source in which case please wait for some time and try again.

Multisite and Subdomains

Is each site treated as a separate site or is the entire install considered one site for backups?

Each WordPress install is considered as a single site. So you can go ahead and add as many sites as you want under one WordPress install, and MalCare will be sure to handle security for all of them.

Is each site treated as a separate license for Multisite WordPress?

Yes. Each subsite is considered a separate license. In case you work with a large number of subsites, or have custom Multisite WordPress requirements,  please do get in touch, and we’ll be sure to customize a plan for you.

What if I have multiple WordPress sites on my server via add-on domain? If site A, B, and C are in different folders do they count as 3 different sites?

MalCare considers each WordPress install as a single license, so if your site A, B and C has separate WordPress setup they will be considered as 3 different sites or if they are a part of a WordPress Multisite setup, they will be considered as a single site.

Is it possible to scan and clean a single site in a multisite environment?

While scanning your Multisite WordPress, MalCare treats all sites in your WordPress installation as one. It scans all the subsites in your network. However, since MalCare treats the multisite as one WordPress install, you cannot scan or clean a single subsite on the network.

Does a subdomain count as a separate site?

You will need to upgrade your plan for adding one more site. We count every WordPress install as a separate site.

Licensing and Legalities

Is MalCare GPL compliant?


Yes, MalCare plugin is released under GPL v2 License.

Can I install MalCare on my clients’ sites?

Yes, you can.

Are there coupons available for discounted upgrades?

We have offers and discounts regularly. To keep track of these, please join our newsletters, or contact us.

 

Feel free to contact MalCare Support for further help if it is needed.