Malcure Malware Scanner — Precision Virus Scan and Firewall

The Only Security Plugin You Need: Detection, Protection, and Reporting.

When your site is hacked, you don’t need «maybe». You need «definitely». Malcure Malware Scanner is precision-engineered to detect over 50,000+ threats with Zero False Positives.

Trusted by 10,000+ site owners and security professionals, Malcure doesn’t just «scan» — it investigates. From hidden backdoors in your database to obfuscated code in your images, we find what others miss.

Powered by Malcure API: Real-Time Threat Intelligence

Hackers don’t sleep, and neither do we. Malcure connects to our real-time API to fetch the latest threat definitions.

This plugin relies on the Malcure API to provide real-time threat intelligence and checksum verification. — Data Transmission: To perform scans, the plugin sends file checksums and your site’s domain to Malcure servers. No sensitive user data or file contents are transmitted unless you explicitly use the «Inspect File» feature. — Terms & Privacy: Use of the API is subject to our Terms of Use and Privacy Policy.

• Zero-Day Alerts: Our API analyzes new threats in real-time, ensuring the site is scanned against the latest vulnerabilities.
• Smart Checksums: We verify your core files against the official WordPress repository using our API, ensuring absolute integrity.
• Lightweight: By offloading heavy analysis to our API, we keep your server fast and responsive.

Why Malcure?

• Precision, Not Noise: Our advanced heuristic engine is tuned to distinguish between legitimate code and malicious payloads. No more heart attacks over false alarms.
• Surgical Cleanup: Don’t nuke your site. Malcure identifies the exact infection so you can surgically remove the malicious code while keeping your website fully functional.
• Performance First: Built to be lightweight. We scan rigorously without bringing your server to its knees.

Who This Plugin Is For

• Site owners who want clear, actionable results (what was flagged and where).
• Agencies & developers who need fast triage across multiple sites.
• WooCommerce / membership / lead-gen sites where downtime and SEO damage are expensive.
• Anyone who wants a scanner that cuts through the noise to focus on signal—real threats with practical remediation paths.

How It Works (Scan → Review → Clean)

1. Scan

   • Go to Malcure Scanner in your WordPress admin.
   • Run a scan to check your files and database for malware, backdoors, suspicious code, and integrity issues.

2. Review

   • Malcure reports findings with clear locations (file paths / database records) so you can verify what changed and why it was flagged.
   • Use the results to decide what should be repaired, deleted, or kept (for example, legitimate custom code).

3. Clean & Recover

   • The free edition helps you identify issues and understand what needs fixing.
   • The Advanced Edition adds cleanup tools (Inspect / Repair / Delete for infected files) and workflow features like custom whitelisting.

Free vs Advanced (Feature Comparison)

Below is a practical feature comparison to help you choose the right edition.

Feature Free Advanced

Deep malware scan (files + database) Yes Yes

Checksum verification (WordPress core integrity) Yes Yes

Vulnerability scanner Yes Yes

Firewall (WAF) & hardening Yes Yes

Incident response toolkit (sessions, salts, etc.) Yes Yes

Event logging Yes Yes

Google Search Console integration Yes Yes

1‑click cleanup actions (Inspect / Repair / Delete infected files) No Yes

Custom whitelisting (files/folders) No Yes

WP‑CLI integration No Yes

High‑priority support No Yes

Real‑time definition updates No Yes

Core Features (Free Forever)

• Deep Malware Scan: Scans core files, themes, plugins, images, and your entire database for viruses, trojans, backdoors, and malicious redirects.
  • Files: Scans core files, themes, plugins, images, and uploads for backdoors, shells (C99, R57), and obfuscated code.
  • Database: Scans database tables for malicious injections and spam links.
  • SEO Spam Detection: Specifically checks page titles and database records for «Japanese Keyword Hack», «Pharma Hack» and other SEO spam symptoms.
  • Vulnerability Scanner: Checks your installed plugins and themes against our real-time database of known security vulnerabilities.
  • Intelligent Checksum Verification: Automatically verifies your files against the official WordPress repository. If a core file has been tampered with, we know instantly.
  • Uncompromising Detection: Detects C99, R57, RootShell, Crystal Shell, Matamu, and thousands of other known and unknown variants.
• Firewall (WAF) & Hardening:
  • Block Path Traversal: Stops attackers from accessing sensitive system files.
  • Block PHP Uploads: Prevents malicious scripts from being uploaded to your site.
  • Stop User Enumeration: Blocks bots from fishing for your username.
  • REST API Protection: Prevents user data leakage via the WP REST API.
  • Security Hardening: Learn more about securing your WordPress site.
• Incident Response Toolkit:
  • Nuke User Sessions: Instantly force-logout every user on the site to kick out intruders.
  • Salt Shuffler: One-click rotation of WordPress security keys (salts) to invalidate all browser cookies.
  • Comprehensive Event Logging: Track every security event. Know exactly when and how a breach might have occurred with our 100-day event log.
• Google Search Console Integration: Connect directly to Google to fetch security warnings and blacklist status in real-time.
• Real-Time API Updates: Connects to the Malcure Cloud to detect the latest threats and vulnerabilities.

Upgrade to Advanced Edition

For mission-critical websites that demand comprehensive protection and recovery tools.

• 1-Click Fixes: Inspect, Delete or Repair infected files instantly with a single clicks.
• Real-Time Definition Updates: Stay protected against the very latest threats discovered by our security labs.
• WP-CLI Integration: Automate scans and cleanups via command line — a developer’s dream. See our WP-CLI Cheatsheet.
• Custom Whitelisting: Full control to whitelist specific files or folders.
• High-Priority Support: Direct access to our security analysts.

Get Malcure Advanced Edition

What Our Users Say

«Best by far, better than Wordfence and other giants… I spent hours trying to find a plugin like this… Simple and effective.» — @dalingzaf

«The ONLY plugin that scans files in real time. I am a web developer and have tried many malware removal plugins, including popular ones like Wordfence and Sucuri. However, none of them detected some unusual files that were actually malware causing regular attacks.» — @devzeeshanx

«Accurately shows which Database table row is infected and it helps resolve the hacking attempt instantly. Saves a lot of time for the developers.» — @s3630

«It’s not just a “teaser”. This plugin really found the malware, and removed it. Really for free.» — @halucska

Additional Resources for Malware Removal

Follow these expert guides to remove malware, recover lost traffic, and restore your online reputation:

• A step by step guide to remove the malware
• Japanese Keyword Hack: How to Remove SEO Spam
• What is the WordPress Pharma Hack & How to fix it
• How to Fix Google Ads Disapproved for Malicious Software
• How to Prevent WordPress SQL Injection Attacks
• Live Malware Infection Removal & Analysis
• How to Fix “This Site May Harm Your Computer” Warning
• Comprehensive Guide to Removing JavaScript Redirect Malware
• How to Fix a Blank WP-Admin Page
• Malcure WP CLI Integration & Cheatsheet
• How to Prevent Brute Force Attacks
• How to Change WordPress Salt Keys

Expert Malware Removal Service

In over your head? Our security analysts are on standby. We offer a complete Malware Removal Service that includes: — 100% Removal Guarantee: We guarantee to remove all malware from your website. — Same Day Service: Fast turnaround time to get your business back online. — DeepScan™ Technology: Scans backups, archives, images, and hidden files where malware hides. — Manual Inspection: Our experts manually inspect critical files (htaccess, wp-config, index.php) and your database. — Blacklist Removal: We handle the removal of your site from blacklists like Google, Norton, McAfee, etc. — Security Hardening: We identify the root cause and patch vulnerabilities to prevent future infections. — 15-Day Cover: Security analysts available 24/7/365 to ensure your site stays clean.

Book Expert Malware Removal

Troubleshooting

Some files are detected by Malcure Malware Scanner as «suspicious». What gives?

Malcure’s SmartScan checks each file for malware. However some files aren’t pure malware but may contain code that is suspicious and could do nasty things. You should carefully review and analyse them to see if they indeed do anything nasty.

I can’t get Malcure Malware Scanner to work. It hangs / doesn’t complete the scan / breaks for some reason.

If you think that the plugin is broken, please report it here.

Malcure Malware Scanner (or for that matter other plugins) may break on malware affected / broken websites. Malcure Advanced Edition integrates with WP CLI and allows you to complete the scan from WP CLI.

My site is infected however Malcure Malware Scanner doesn’t detect the infection.

Malware keeps evolving. If you come across malware that Malcure Malware Scanner is not able to identify, you may please report it here.

The scan gets stuck midway. What should I do?

In case of such an event, please file a support request with us and we’ll be more than happy to troubleshoot the issue.

Please visit this page.

I cleaned my site but it got infected again. What should I do?

Malware cleanup is a waste of time and effort unless you find the root cause behind the malware infection. How was someone able to infect your website? Have you plugged in that security hole?

Please read Why Do Websites Get Hacked.

Google Safe Browsing site status (or some other scanner) still shows my site as infected. What should I do?

First make sure you purge your site cache. Second, Google (and other scanners) cache the results for some time. You’ll need to force or refresh the scan. You can also file a request with us to get your site off any blacklists.

I found a suspicious file, what now?

If Malcure flags it, it’s likely malicious. You can inspect the file content using our built-in inspector. If you’re unsure, consider our Expert Malware Removal Service.