Malware happens. And when it does, having the right tools to scan for malware attacks and detect threats can guard your site against security conflicts. Unlike Content Hub, WordPress sites require the right WordPress plugins that can help detect malicious code and guard your site against possible threats. By getting ahead of potential compromise with comprehensive threat detection and remediation, the right plugins can keep your site clean and healthy.
Here’s a look at WordPress malware monitoring plugins that can help save your site — and give you much-needed peace of mind.
Plugins to Detect Malicious Code
- Sucuri Security
- Wordfence Security
- AntiVirus
- Quttera Web Malware Scanner
- Anti-Malware
- SecuPress Free
- MalCare
- Titan Anti-Spam & Security
- WP Cerber Security
1. Sucuri Security
Price: Free
Sucuri is a leading name in website security in the WordPress community.
The Sucuri Security WordPress Security plugin is free for any WordPress user; this plugin offers key security services that will keep your site safe. It will help you with file integrity monitoring, remote malware scanning, blacklist monitoring, and a lot more.
With remote malware scanning, security hardening, activity and file monitoring, you can rest easy knowing that your site is always protected against potential malware threats.
2. Wordfence Security
Price: Free, with premium plans available
Wordfence is one of the most popular WordPress security plugins with more than a million downloads to date. This plugin can tell if your site has already been affected by bad quality code and does a deep security check into your WordPress core, themes, and plugins.
It uses gathered experience to safeguard your site against known attackers and will block entire malicious networks. It includes advanced IP and Domain WHOIS to report malicious IPs or networks and will also block entire networks using a firewall. The plugin is regularly updated to ensure your site is always defended by cutting-edge protection algorithms.
3. AntiVirus
Price: Free
This plugin was created to fight spam, but can also create a protective shield around your site, perform automated daily scans, and send reports to your email account so you can always be updated and take proactive measures to protect your site.
This plugin shows virus alerts in the WordPress admin panel, can perform daily security checks, clean up your site after the removal of any plugins, and check databases, themes, and templates to ensure everything on your site is safe. It also offers checksum verification for WordPress Core files and Google Safe Browsing to help monitor for malware and phishing attacks.
4. Quttera Web Malware Scanner
Price: Free
Quttera Web Malware Scanner is a free and powerful security plugin for WordPress that will scan your website for malware, trojans, backdoors, worms, viruses, and spyware. It can also check for other threats as well like JavaScript code obfuscation, exploits, malicious iframes, malicious code injections, malicious code obfuscation, auto-generated malicious content, redirects, hidden eval code, and more.
Additionally, this plugin will check if your site is blacklisted and ensure that you can take protective action against any possible threats. Other features include one-click scan capability, external links detection, an AI-based intelligence scan engine, and PHP malware detection.
5. Anti-Malware
Price: Free
This is a custom WordPress plugin that fights malware and protects your site. It runs a complete scan of your WordPress site and removes all possible security threats to ensure that your site is healthy and safe.
Anti-Malware also includes the ability to download definition updates which help defend your site against new threats and upgrade vulnerable script versions to prevent undetected exploits. In addition, you can check the integrity of your WordPress core files to ensure no malware code has compromised key features and assets.
6. SecuPress Free
Price: Free, with premium plans available
SecuPress Free makes its mission clear: “You made it, we keep it safe!”
This free tool includes malware scanning that helps block malicious bots and suspicious IP addresses, and also offers a complete WordPress security toolkit as a for-pay plugin. SecuPress is also GDPR compliant, making it a great choice for any WordPress site hosted in the EU or that handles EU-origin data.
Some SecuPress features include anti brute force login protection, firewall tools, security alerts and country blocking by geolocation. The tool is easy to use and install, making it a great choice for front-line malware detection and removal.
7. MalCare
Price: $99/year for 1 site, $599 for 20 sites
MalCare brands itself as “the only WordPress security plugin with instant WordPress malware removal,” and this premium plugin is used by several well-known sites to help keep their data and WordPress assets safe.
Offering real-time protection with its “smart” firewall technology and using its own servers for malware scanning, MalCare won’t slow down your site — and promises effective malware removal in less than a minute.
In addition, MalCare targets malware by removing affected portions of files rather than the files themselves, leaving your site intact and fully-functional. While the service isn’t cheap, it’s worth considering if you have a substantive amount of WordPress data to protect.
8. Titan Anti-Spam & Security
Price: Free, with premium plans available
Previously called Anti-Spam, this plugin was recently rebranded as Titan Anti-Spam and Security.
The free version offers anti-spam, firewall, malware scanning and site accessibility features to help safeguard your site against possible attacks. Its anti-spam feature checks comments on your site against a global database to help identify potential threats, while its malware scanning functionality checks system files, themes, and plugins for malware, backdoors, malicious redirects and code injections.
The Pro version includes advanced scanning with more than 6000 signatures along with the ability to update firewall rules in real-time.
9. WP Cerber Security
Price: Free
With more than 200,000 installations, this free malware scanner plugin can help keep your site safe and secure without breaking your budget.
WP Cerber Security includes login attempt limitations that monitor login forms, XML-RPC, REST API, and auth cookie requests. It leverages Google reCAPTCHA to defend your registration, contact, and comments forms from bad actors attempting to spam your site.
This tool also gives you the ability to permit or restrict access on a per-IP basis using single IPs, IP ranges or subnets, and allows you to create custom login URLs.
How to Remove Malware From a WordPress Site
If your WordPress website is behaving oddly — such as taking more time than usual to respond, opening new links without your permission, or displaying strange error messages — you may have been compromised by malware.
When it comes to removing malware from your WordPress site, you’ve got two options: Take on this task yourself or use a purpose-built WordPress plugin. While the plugins described above all offer ways to automatically remove malware from your site, you may also want to conduct your own assessment to ensure no malicious files or folders have made their way into your site’s framework.
Start by backing up your site. Many reputable web hosts offer a site backup feature that lets you take a snapshot of your site and save it to a local desktop. You can also use a WordPress backup plugin to create a backup if your site host doesn’t offer this feature.
Next, open your backup and examine key files such as wp-config.php and .htaccess along with your wp-content folder. You’re looking for anything out of place, such as additional file lines or strange web addresses that could indicate a malware compromise.
Best bet? Run a local malware scanning tool on your desktop to assess the files automatically and remove any malware.
Once your backup is confirmed clean, delete all files in your public_html folder, then reset all your site passwords and upload your backup image back into your WordPress site. Finally, scan your site again using one of the WordPress plugins listed above to ensure the removal was successful.
Secure Your WordPress Site
WordPress plugins can detect malicious code and safeguard your site from potential threats. Find one that best meets your needs and budget and run it regularly to help reduce the risk of malware infection and limit the impact of code compromise.
This post was originally published in January 2020 and has been updated for comprehensiveness.
