Most scanners check your files against a list of known malware — and stop. MalCare reads everything — every file, every database table, every plugin, every cron — with AI that recognizes malware by its behavior, not its face. On our servers, so your site never feels a thing.
$ malcare.com/scan — no plugin, no signup · results in ~60 seconds
Redirects you didn't create, spam in your search results, a warning from Google. Run a free scan now — no plugin, no signup, results in about a minute.
Trusted by 400,000+ websites across 120 countries
Modern malware shows you a perfectly healthy site — and shows its real face only to your visitors, or to Google. It lives where nobody looks, and it waits. 43.5% of WordPress hacks are only discovered after the damage is done.
Read: a scanner that "visits your site like a visitor" gets served the clean version. You cannot find cloaked malware without reading the code itself.
A perfectly normal site — cloaked malware shows admins the clean version.
LOOKS FINEHidden pharma links and a redirect to a spam domain — served only to crawlers and visitors.
302 → SPAMOne line of code checks who's asking before deciding which site to show.
CLOAKINGA burglar who trips the alarm is easy. The one to worry about has been living in the attic for months — the average infection sits undiscovered for 180 days.
Cloaked malware inspects each request before responding — user-agent (is this Googlebot?), cookies (is this a logged-in admin?), referrer (did they arrive from a search result?), even IP ranges. Admins get the clean page; everyone else gets redirects, spam, or a phishing kit.
This is why remote scanners that fetch your homepage from outside can't see it: they're shown exactly what you're shown. The only reliable way to find cloaked malware is to read the actual files and database — which is what MalCare does, on every scan.
Every file and every database table is read and analyzed on MalCare's servers — no CPU spike, no timeout, no slowdown of any kind. Depth isn't a setting; it's what off-server architecture makes possible.
Read: on-server scanners can't afford to look everywhere — every file they read costs your visitors performance. We read everything, because it costs your site nothing.
Runs as a plugin on your hosting — CPU spikes past 90%, the scan competes with your visitors, so it skims or slows you down.
CPU 92%Your site syncs to our servers; all three scan layers run there. Every file, every table — your CPU stays at baseline.
BASELINEA signature scan is a mugshot lineup — it catches malware already on a wanted poster. Rewrite one character and it walks straight past. And your host's scanner protects the host's infrastructure, not your WordPress site.
50 recent real-world infections, replayed against each scanner · our test · 2026
Read: a signature list can only grow as fast as humans add mugshots. Behavior doesn't need a mugshot — the second variant is caught the first time it's ever seen.
On the known-malware list — both approaches catch it.
BOTH CATCHOne character changed. Signature scanners: no match, walks past. MalCare: same behavior — writes a file, hides, calls home — caught.
ONLY MALCARESignature matching is useful — it's our first layer too. It's just nowhere near enough on its own.
Signatures catch the known. Integrity checks catch the tampered. Behavioral AI catches the never-seen-before. If any layer flags, the scan flags.
Every file compared against a continuously updated database of known malware — backdoors, shells, injected scripts, SEO spam. The method other scanners end with is where we start.
// continuously updated pattern database scan: /wp-content/uploads/x.php hit: eval(base64_decode($_POST['k'])) FLAGGED · matches known backdoor
the fast pass — catches everything already known
Core, plugin, and theme files verified against official repository checksums. A single injected line flags — which catches supply-chain attacks before any signature for them exists.
wp-includes/functions.php expected: sha256 9f2c…e1 actual: sha256 41b7…9a + line 2041: include '/tmp/.cache.php'; FLAGGED · core file modified
one injected line — flagged, no signature needed
100+ signals recognize malware by what code does — AI-generated code, database-resident payloads, scripts that only fire for certain visitors. Detection by behavior, not by face.
entropy: 7.9 / 8.0 · packed
writes: /uploads/.x.php · executable
condition: runs only if !is_admin()
outbound: hxxp://cdn-metrics.example
FLAGGED · write → hide → call homeno signature required — behavior is enough
Read: no single method catches everything — that's the point of running three. Whatever one layer misses, the next is built to catch.
Known backdoors and shells die here.
FLAGS THE KNOWNTampered core, plugin, and theme files die here — even one injected line.
FLAGS THE TAMPEREDNever-seen-before and AI-generated malware dies here — caught by what it does.
FLAGS THE UNKNOWNSignals are measurable properties of code and data: entropy (is this packed or encoded?), reconstruction (does a string assemble into a callable?), placement (executable code where none belongs — an image, a database row, an option field), conditionality (does it behave differently for admins vs visitors?), and network behavior (does it call out, and to where?). No single signal convicts; the model weighs them together, which is how it stays at a 0.2% false-positive rate.
Our detection methodology is published, so anyone can audit how it works. We think a scanner you're trusting with your site should be able to show its reasoning.
Malware doesn't stay in files anymore. It registers fake plugins, hides PHP inside images, writes itself into database rows, and schedules crons to restore itself after cleanup. Coverage is what decides whether it's found.
A folder named wp-compat that exists in no repository. It has one job: keep a door open.
CAUGHT · L2+L3logo.png opens with <?php. Browsers see a broken image; the attacker sees a shell.
CAUGHT · L3A base64 payload inside wp_options, injected into every page at render time. No file ever changes.
CAUGHT · L3A cron that quietly restores the malware every night at 03:12 — why hacks "keep coming back."
CAUGHT · L3A vague warning creates panic. An exact location creates action — and it's what makes safe, surgical removal possible: the malware goes, your content stays.
The industry's quiet problem isn't just missed malware — it's phantom malware. Crude scanners flag whatever they can't understand, and every false alarm costs you something real: a night of worry, hours of checking, an upgrade or an expert you never needed. 0.2% false positives across all scans — the fewest false alarms in WordPress security.
Read: a missed detection hurts you once. A false alarm hurts you every time it fires — and it fires a lot more often.
"47 suspicious files found. Upgrade to see details." No locations, no evidence.
COSTS YOUR SLEEPHours comparing files against forum threads, trying to be your own analyst.
COSTS YOUR HOURSAn upgrade — or an expert — paid to tell you nothing was wrong.
COSTS YOUR MONEYExact file, line, and evidence — 0.2% false positives. When it fires, act.
MEANS ACTIONThe most expensive thing a false alarm takes isn't money — it's your trust in the next alert. A scanner that cries wolf trains you to ignore the wolf.
A signature-fragment match can't tell an encoder in a legitimate caching plugin from a packer in malware — so signature-based tools flag both and let you sort it out, which is why they're notorious for false-positive notifications. Host scanners lean the same way: flagging aggressively protects their infrastructure and liability, while the investigating is left to you. And a vague "suspicious files found" alert pairs a little too conveniently with a paid upgrade to see the details.
MalCare's model works the other way: no single signal convicts. 100+ signals are weighed together, ambiguity triggers deeper analysis on our side — not an alarm on yours — and what reaches you is a verdict with evidence, not homework.
The scanner wasn't built in a sprint. It was built on 240,000+ analyzed websites, 2.5 years of research, and training on millions of real infections — by the team that has secured WordPress since 2011.
Read: every infection found anywhere on the network becomes training data everywhere. Scale isn't a vanity metric — it's why detection keeps improving.
Securing WordPress with BlogVault.
THE FOUNDATION240,000+ websites analyzed over 2.5 years; model trained on millions of real infections.
THE SCANNER400,000+ sites — every infection found anywhere becomes training data everywhere.
THE FLYWHEELEvery infection we clean anywhere makes the scanner sharper everywhere. 1,500+ sites cleaned every month — each one is training data.
Attackers generate thousands of variants of one payload — every copy unique, no shared signature. But every variant still has to do the same things. Behavior is the one thing malware can't disguise.
Read: AI made writing new malware faces free. It didn't change what malware has to do — and doing is what we detect.
24 AI-generated variants of one payload — only 2 are on any list. 22 walk straight past.
2 / 24 CAUGHTEvery variant still has to write, hide, and call home — so every variant matches.
24 / 24 CAUGHTThe attacker's AI has to fool ours only once. Ours learns from every attempt on 400,000+ sites.
Detection numbers from the live network — not a brochure.
same 50 infections · three scanners · one variable
Point-in-time figures as of July 2026 · refreshed monthly
Enter your URL. We run a deep scan on our servers — no plugin, no signup, no credit card. If it's clean, sleep well. If it's not, you'll know exactly what we found, and exactly what to do next.
No plugin, no signup, no credit card.
10 SECONDSFiles, plugins, database, crons — every layer.
~60 SECONDSA timestamped clean report — or exact locations and a cleanup path.
KNOW EITHER WAYA free scan is a snapshot · continuous protection scans every day and removes what it finds
Scans run automatically, on a schedule matched to what your site does — and detection lands in minutes once a scan runs. If anything is wrong, you get an alert while it's still a small problem, not a warning label or a suspension email.
Read: without a scanner, "detection" is whoever punishes you first. The cadence you choose decides how long malware can exist on your site at all.
Found within the hour, the day, or the week — always ending in an alert to you.
AN ALERTVisitors complain, Google shows "Deceptive Site Ahead" days–weeks later, your host emails a suspension.
A CONSEQUENCEA full deep scan every week, with an alert if anything is ever wrong — free, forever.
EVERY 7 DAYS · FREEYour site is your storefront window. Daily automatic deep scans keep it never more than a day from a verdict.
EVERY 24 HOURSCheckout pages and customer data can't wait overnight. Hourly scans mean an infection's maximum lifespan is one hour.
EVERY HOUREvery scan ends one of two ways: a clean report you never need to read — or an alert that reaches you first. Before Google. Before your host. Before the damage.
Real customers, real infections found — quotes from our case studies.
I had been running iThemes, WordFence & Sucuri, but they kept getting hacked. Then I installed MalCare, which quickly found the malware and cleaned up the entire site.
Adam SilverConciergeWP · FounderI was on the beach with my family when MalCare notified me of a plugin vulnerability across 50 of my sites. With one click on my smartphone, all sites were fixed within minutes.
Paul LaceyWordPress ExpertMalCare's one-click cleanup is exactly what I needed. Instead of waiting, guessing, or dealing with a complicated manual cleanup, I could clean the site quickly and get back to work.
Kristina RomeroWP Care Market · FounderSomething looks strange, Google flagged you, your host sent a scary email — or you just want to know where you stand. Talk to a security engineer before you pay anyone anything.
If you think you're hacked
Run the free scan, then talk to an expert about exactly what it found — including what to do if Google has blacklisted you or your host has suspended you. If you don't need us, we'll say so.
If you just want peace of mind
We clean 1,500+ hacked sites every month. Ask what your host's scan actually covers, what your current setup misses, and what's worth paying for — and what isn't.
Real security engineers · personalized help · no obligation
Host scanners protect the host's infrastructure, not your WordPress application. The places WordPress malware actually lives — the database, plugin folders, uploads, crons — are mostly outside what they read. That's why hacked sites on "scanned" hosting are so common.
Yes. MalCare runs alongside them without conflict. Most customers add us specifically for the layers those tools don't have — off-server depth, database scanning, and behavioral detection.
No. All the heavy file and database reading happens on MalCare's servers, not yours — no CPU spike, no timeout, no slowdown of any kind.
Our false-positive rate is 0.2% across all scans, and every removal runs a safety check before anything is touched. If something is ever ambiguous, we tell you — no silent deletions.
A timestamped report of real scan depth: files checked, database tables read, and every layer that ran. Not a green checkmark — a record you can inspect.
Yes — those are exactly the places signature scanners miss. We scan every database table (including custom ones), premium and non-repo plugins, and uploads, where PHP routinely hides inside image files.
The free scan returns in about 60 seconds. On the plugin, detection typically lands in under 3 minutes, with automatic scans daily — or as often as hourly on higher plans.
You get the exact location of every detection. On paid plans, one-click cleanup removes the malware — never your content. And if Google has blacklisted you or your host suspended you, our experts help with recovery.
A deep scan on our servers, results in about a minute. Malware's whole job is to hide — finding it is ours.
No plugin needed · no credit card · results in ~60 seconds