Can I scan a WordPress site for malware for free?

Yes. You can combine a public URL scan, a reputable WordPress security plugin scan, and server-side checks such as WP-CLI checksums. The free checks are useful for finding warning signs, but a clean result is not proof that every file and database record is clean.

What does an online WordPress malware scanner see?

An online scanner sees the pages and files your server delivers to it, much like a visitor does. It cannot normally inspect your private WordPress files, database, user accounts, scheduled tasks, or code served only to selected visitors.

Should I delete files a scanner identifies as suspicious?

Not before saving a copy and confirming what the file is. Removing a file at random can break the site and can also erase evidence of how the compromise happened.

How to Scan WordPress for Malware

You can scan WordPress for malware free by combining an external scan, an inside-the-site plugin scan, and server-side file checks. Each view catches different problems, so the useful result is the overlap of all three, not a single green message.

If you already see redirects, browser warnings, spam pages, or unfamiliar administrator accounts, treat the scan as evidence gathering. Preserve a copy before you remove anything, then use the findings to follow a full hacked WordPress cleanup.

A malware scan only sees the part of the site it can reach

The key limitation is access. A public scanner can examine a URL but cannot read your database. A plugin scanner can read files on its WordPress installation but runs inside an environment that may already be compromised. A server-side review has the broadest view, but it still needs an informed person to distinguish a legitimate custom file from malware.

That is why a scan should answer specific questions: Does the public site deliver anything suspicious? Do known bad signatures appear in files? Do WordPress core files match the official release? Are there PHP files where WordPress should only store media? The answers narrow the next step.

Layer one: scan the public site from the outside

External scanners inspect the public output of your domain. You enter the site address and the scanner retrieves pages, JavaScript, and other files a normal visitor can receive. Widely known free tools in this category include Sucuri SiteCheck and VirusTotal's URL scan.

This layer is good at finding visible injected JavaScript, malicious redirects that trigger during its visit, blocklist warnings, and suspicious links in rendered pages. It also works when you cannot log in to WordPress or access hosting.

It has important blind spots:

It cannot browse your server directories or compare PHP files with clean copies.
It cannot inspect wp_users, wp_options, or other database tables.
It may not trigger malware that activates only on mobile, after a referrer from a search engine, or for visitors in a particular country.
A cached clean page can hide an infection in the origin server, while a scanner may also see a temporary false positive from an old cached asset.

Run an external scan from more than one clean device or network if you are investigating redirects. Also open the site in a private browser window, visit from a search result, and test a few normal pages. Do not log in while you are only trying to observe public behavior.

Layer two: use a WordPress plugin scanner carefully

A security plugin scan runs inside WordPress, so it can inspect much more than a public URL scanner. Free offerings from widely used plugins such as Wordfence, Sucuri Security, or Solid Security can flag unexpected core changes, known malware patterns, vulnerable components, or suspicious files.

Install at most one scanner while investigating. Multiple security plugins can consume hosting resources, conflict with one another, or make it harder to understand which tool made a change. If a security plugin is already installed, update it only after you have taken a backup or forensic copy.

Plugin results are leads, not a verdict. Signature-based detection can miss new or obfuscated code, and a modified plugin or compromised administrator can interfere with a scanner that runs inside the same installation. A plugin also may flag a custom integration, minified library, or legitimate child-theme change that needs review rather than deletion.

For every finding, write down the full path, the detection name, the modification date, and whether the file belongs to WordPress core, a plugin, a theme, or custom code. Screenshots and exported scan reports are useful before remediation. If it identifies an unknown administrator, compare it with the accounts in how to find hidden WordPress admin users.

Layer three: verify files from the server

Server-side checks are the strongest free layer because they work with the actual files, not just page output. Use SSH and WP-CLI if your host provides them. Run commands from the directory that contains wp-config.php, preferably after taking a files-and-database copy.

Start with WordPress core:

wp core verify-checksums

WP-CLI compares standard core files against checksums for the installed WordPress version. A reported core mismatch needs attention, but it does not automatically mean malware. It could be a failed update or a legitimate change that should not have been made in core. Replace altered core files with fresh official copies during cleanup, rather than editing them by hand.

Then check installed extensions:

wp plugin verify-checksums --all

Not every plugin publishes checksums, so an incomplete result does not clear the plugins that cannot be checked. Compare any concern with a freshly downloaded copy from its trusted source. Do not overwrite a premium or custom plugin until you have retained the original for review and have a known clean replacement.

Look for PHP in upload directories. On many hosts, this command is a useful starting point:

find wp-content/uploads -type f -name '*.php'

wp-content/uploads is normally for images, documents, and generated media. A PHP file there deserves prompt investigation. Also review recently changed PHP files, unfamiliar directories below wp-content, and modified index.php, .htaccess, wp-config.php, theme functions.php, and mu-plugins files. Do not assume the newest timestamp marks the infection, because timestamps can be preserved or changed.

These checks also miss things. Malware may live in the database, a must-use plugin, a server-level configuration file outside the WordPress directory, a cron job, or a host account alongside the site. Read the server error logs and access logs where available, and ask the host whether it saw suspicious processes or mail activity.

A free WordPress malware scan routine

The following routine gives you a repeatable first pass without changing the evidence unnecessarily.

Record the symptoms, affected URLs, odd search results, and the time you noticed them. Take screenshots from a private browser.
Make a complete copy of the site files and database. Store it away from the hosting account if possible, and do not restore it over the live site yet.
Use one or two external URL scanners and inspect the public site in a private window. Note public findings, redirects, and warning pages.
In the WordPress dashboard, review Users for accounts you cannot identify. Check installed plugins and themes for items you did not approve, but do not delete them yet.
Run one established plugin scanner, save its report, and note paths before taking action.
From SSH, run wp core verify-checksums and wp plugin verify-checksums --all. Review any mismatch against a fresh trusted package.
Search wp-content/uploads for PHP files and inspect recent changes in themes, plugins, mu-plugins, and configuration files.
Check wp_options for unfamiliar active plugins, suspicious siteurl or home values, and unexpected cron entries. Avoid deleting database values based only on a strange name.
If you confirm malware, contain and clean it methodically. Rotate credentials from a clean device, replace compromised components, and address the entry point before returning the site to normal operation.

How to interpret a clean scan

A clean scan means the selected tool did not find a known problem in what it inspected. It does not mean an attacker could not have hidden code elsewhere, especially when symptoms persist. A redirect that only appears for search visitors, new spam pages in search results, unexplained server activity, or a recurring infection is enough reason to investigate beyond scanner results.

For a broader prevention review, use the WordPress hardening checklist after the investigation. It covers the controls that reduce the chance of the same opening being used again.

When to get help

Get help if the scan identifies a backdoor, you cannot account for administrator users, or the site handles customer payments or personal information. Our WordPress malware removal service can investigate an infection, and a security audit can review a site that appears clean but still has unresolved warning signs.

How to Scan a WordPress Site for Malware, Free and Safely